--===============6114063095565349875==
Content-Type: multipart/alternative; boundary="===============5520073085980316267=="
MIME-Version: 1.0

--===============5520073085980316267==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable

Cybersecurity and Infrastructure Security Agency (CISA)

You are subscribed to Vulnerability Bulletins for Cybersecurity and Infrast= ructure Security Agency. This information has recently been updated and is = now available.

The CISA Vulnerability Bulletin provides a summary of new vulnerabilities t= hat have been recorded in the past week. In some cases, the vulnerabilities=
in the bulletin may not yet have assigned CVSS scores.

Vulnerabilities are based on the=C2=A0Common Vulnerabilities and Exposures =
[ https://www.cve.org/ ]=C2=A0(CVE) vulnerability naming standard and are o= rganized according to severity, determined by the=C2=A0Common Vulnerability=
Scoring System [ https://www.cve.org/about/relatedefforts ]=C2=A0(CVSS) st= andard. The division of high, medium, and low severities correspond to the = following scores:


* *High*: vulnerabilities with a CVSS base score of 7.0=E2=80=9310.0=20

* *Medium*: vulnerabilities with a CVSS base score of 4.0=E2=80=936.9=20

* *Low*: vulnerabilities with a CVSS base score of 0.0=E2=80=933.9=20

Entries may include additional information provided by organizations and ef= forts sponsored by CISA. This information may include identifying informati= on, values, definitions, and related links. Patch information is provided w= hen available. Please note that some of the information in the bulletin is = compiled from external, open-source reports and is not a direct result of C= ISA analysis.

Vulnerability Summary for the Week of July 27, 2026 [ https://www.cisa.gov/= news-events/bulletins/sb26-215 ] 08/03/2026 11:00 AM EDT=20
High Vulnerabilities

Primary
Vendor -- Product Description Published CVSS Score Source Info @fastify/rat= e-limit--@fastify/rate-limit @fastify/rate-limit before 11.2.0 keys rate-li= mit buckets by the verbatim client IP string returned from request.ip. Beca= use a single IPv6 client can control a large address range (a /64 holds 2^6=
4 distinct addresses) and the same address has multiple valid textual repre= sentations, an IPv6 capable client can defeat the rate-limit boundary by ro= tating addresses or by rewriting the same address in different forms. Appli= cations that use @fastify/rate-limit to protect endpoints such as authentic= ation, password reset, OTP delivery, or expensive API calls can be bypassed=
by IPv6 clients behind a proxy that surfaces IPv6 to the origin when trust= Proxy is enabled. The issue is fixed in @fastify/rate-limit 11.2.0, where t=
he default key generator normalizes IPv6 addresses to their canonical form,=
collapses IPv4 mapped IPv6 to IPv4, and applies a configurable prefix mask=
(default /64) via a new ipv6Subnet option. 2026-07-29 7.3 CVE-2026-15144 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-15144 ] acacode--swagger-types= cript-api swagger-typescript-api generates API clients for Fetch or Axios f= rom an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients= /axios-http-client.ejs interpolates servers[0].url from src/code-gen-proces= s.ts into the HttpClient constructor without escaping, allowing an attacker= -controlled OpenAPI spec to inject code that executes when new HttpClient()=
or new Api() is constructed. This issue is fixed in version 13.12.2. 2026-= 07-29 8.3 CVE-2026-54661 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5466=
1 ] acacode--swagger-typescript-api swagger-typescript-api generates API cl= ients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src= /code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.b= aseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates = apiConfig.baseUrl into the generated HttpClient baseUrl field without escap= ing, allowing an attacker-controlled OpenAPI spec to inject TypeScript stat=
ic field code that executes when the generated fetch client module is impor= ted. This issue is fixed in version 13.12.2. 2026-07-29 8.3 CVE-2026-54662 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-54662 ] acacode--swagger-type= script-api swagger-typescript-api generates API clients for Fetch or Axios = from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-sch= ema-parsers/enum.ts passes components.schemas.*.enum[i] values to Ts.String= Value in src/configuration.ts without escaping before templates/base/enum-d= ata-contract.ejs renders TypeScript enum declarations, allowing an attacker= -controlled OpenAPI spec to inject code that executes when the generated mo= dule is imported. This issue is fixed in version 13.12.2. 2026-07-29 8.3 CV= E-2026-54664 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54664 ] acacode-= -swagger-typescript-api swagger-typescript-api generates API clients for Fe= tch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-ro= utes/schema-routes.ts passes OpenAPI path keys through parseRouteName to te= mplates/default/procedure-call.ejs and templates/modular/procedure-call.ejs=
without escaping JavaScript template literal interpolation, allowing an at= tacker-controlled path containing ${...} to execute when the generated meth=
od is called. This issue is fixed in version 13.12.2. 2026-07-29 8.3 CVE-20= 26-54666 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54666 ] acacode--swa= gger-typescript-api swagger-typescript-api generates API clients for Fetch =
or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagge= r-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every = URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache res= olves external $ref URLs, allowing an attacker-controlled OpenAPI spec to e= xfiltrate the developer or CI bearer token to a cross-origin endpoint. This=
issue is fixed in version 13.12.2. 2026-07-29 7.4 CVE-2026-54660 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-54660 ] acowebs--Dynamic Pricing With = Discount Rules for WooCommerce Unauthenticated Cross Site Scripting (XSS) i=
n Dynamic Pricing With Discount Rules for WooCommerce <=3D 4.5.11 versions.=
2026-07-27 7.1 CVE-2026-59556 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-59556 ] Adobe--Adobe Bridge Bridge is affected by an Incorrect Authorizat= ion vulnerability that could result in privilege escalation. An attacker co= uld leverage this vulnerability to gain unauthorized read and write access.=
Exploitation of this issue requires user interaction in that a victim must=
open a malicious file. Scope is changed. 2026-07-28 8.2 CVE-2026-48390 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-48390 ] Adobe--Adobe Bridge Brid=
ge is affected by an Untrusted Search Path vulnerability that could result =
in arbitrary code execution in the context of the current user. A low-privi= leged attacker could exploit this vulnerability to execute arbitrary code. = Exploitation of this issue requires user interaction in that a victim must = open a malicious file. Scope is changed. 2026-07-28 8.2 CVE-2026-48391 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-48391 ] Adobe--Adobe Bridge Bridg=
e is affected by an Untrusted Search Path vulnerability that could result i=
n arbitrary code execution in the context of the current user. An attacker = could exploit this vulnerability to execute arbitrary code. Exploitation of=
this issue requires user interaction in that a victim must open a maliciou=
s file. Scope is changed. 2026-07-28 8.6 CVE-2026-48395 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-48395 ] Adobe--Adobe Bridge Bridge is affected b=
y an Incorrect Authorization vulnerability that could result in arbitrary c= ode execution in the context of the current user. An attacker could exploit=
this vulnerability to execute arbitrary code. Exploitation of this issue r= equires user interaction in that a victim must open a malicious file. Scope=
is changed. 2026-07-28 8.6 CVE-2026-48396 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-48396 ] Adobe--Adobe Bridge Bridge is affected by an Improper=
Limitation of a Pathname to a Restricted Directory ('Path Traversal') vuln= erability that could lead to arbitrary file system read. An attacker could = exploit this vulnerability to access sensitive files and directories outsid=
e the intended access scope. Exploitation of this issue requires user inter= action in that a victim must open a malicious file. 2026-07-28 7.8 CVE-2026= -48374 [ https://www.cve.org/CVERecord?id=3DCVE-2026-48374 ] Adobe--Adobe B= ridge Bridge is affected by an out-of-bounds write vulnerability that could=
result in arbitrary code execution in the context of the current user. Exp= loitation of this issue requires user interaction in that a victim must ope=
n a malicious file. 2026-07-28 7.8 CVE-2026-48392 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-48392 ] Adobe--Adobe Bridge Bridge is affected by an o= ut-of-bounds write vulnerability that could result in arbitrary code execut= ion in the context of the current user. Exploitation of this issue requires=
user interaction in that a victim must open a malicious file. 2026-07-28 7=
.8 CVE-2026-48393 [ https://www.cve.org/CVERecord?id=3DCVE-2026-48393 ] Ado= be--Adobe Bridge Bridge is affected by an out-of-bounds write vulnerability=
that could result in arbitrary code execution in the context of the curren=
t user. Exploitation of this issue requires user interaction in that a vict=
im must open a malicious file. 2026-07-28 7.8 CVE-2026-48394 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-48394 ] Adobe--Adobe Campaign Classic Adobe=
Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerabi= lity that could result in arbitrary code execution in the context of the cu= rrent user. Exploitation of this issue does not require user interaction. S= cope is changed. 2026-07-30 10 CVE-2026-48449 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-48449 ] Adobe--Adobe Campaign Classic Adobe Campaign Class=
ic (ACC) is affected by an Improper Neutralization of Special Elements used=
in an SQL Command ('SQL Injection') vulnerability that could lead to discl= osure of sensitive memory. An attacker could leverage this vulnerability to=
gain file system read access. Exploitation of this issue does not require = user interaction. Scope is changed. 2026-07-30 8.6 CVE-2026-48448 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-48448 ] Adobe--Adobe Photoshop Install=
er Adobe Photoshop Installer was affected by an Uncontrolled Search Path El= ement vulnerability that could have resulted in arbitrary code execution in=
the context of the current user. An attacker could have exploited this vul= nerability by placing a malicious library in a directory searched by the in= staller. Exploitation of this issue required user interaction in that a vic= tim must have been running the installer. Scope is changed. 2026-07-28 8.6 = CVE-2026-48388 [ https://www.cve.org/CVERecord?id=3DCVE-2026-48388 ] Adobe-= -Format Plugins Format Plugins is affected by a Heap-based Buffer Overflow = vulnerability that could result in arbitrary code execution in the context =
of the current user. Exploitation of this issue requires user interaction i=
n that a victim must open a malicious file. 2026-07-28 7.8 CVE-2026-48372 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-48372 ] Adobe--Premiere Premie=
re Pro is affected by an out-of-bounds write vulnerability that could resul=
t in arbitrary code execution in the context of the current user. Exploitat= ion of this issue requires user interaction in that a victim must open a ma= licious file. 2026-07-31 7.8 CVE-2026-34641 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-34641 ] ads-tec Industrial IT--DVG-IRF1401 A low privileged = remote attacker can perform privileged configuration changes reserved for t=
he administrator level including permission management due to incorrect aut= horization. 2026-07-28 8.8 CVE-2026-14167 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-14167 ] ads-tec Industrial IT--DVG-IRF1401 A low privileged re= mote attacker can gain administrator privileges due to missing authorizatio=
n at the insert path of the configuration table resulting in gaining full s= ystem access. 2026-07-28 8.8 CVE-2026-14168 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-14168 ] ads-tec Industrial IT--DVG-IRF1401 Due to incorrect = behavior order a low privileged remote attacker could trigger account incon= sistent state via crafted input and overwrites existing user passwords whic=
h could result in complete administrative unavailability of the device. 202= 6-07-28 8.1 CVE-2026-14169 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14= 169 ] An unrestricted SCORM file upload vulnerability in Koollab LMS allowe=
d an authenticated module designer to upload a SCORM package containing a P=
HP webshell to a publicly accessible directory and execute arbitrary code o=
n the server.--Koollab LMS An unrestricted SCORM file upload vulnerability =
in Koollab LMS allowed an authenticated module designer to upload a SCORM p= ackage containing a PHP webshell to a publicly accessible directory and exe= cute arbitrary code on the server. 2026-07-29 9.9 CVE-2026-63227 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-63227 ] Anchore--Anchore Enterprise Anc= hore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an imprope=
r privilege escalation vulnerability in the user management API. An authent= icated attacker who is able to access the Anchore Enterprise API could issu=
e an API call capable of modifying user permissions to gain access to addit= ional resources and operations. It is not possible to grant the system-admi=
n role, but a read only user could be granted write access. This issue is f= ixed in Anchore Enterprise 5.27.2 and 6.0.1. 2026-07-28 8.8 CVE-2026-63727 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-63727 ] ANDRITZ--HIPASE-250 A=
provisioning script used when installing HIPASE-250 (formerly 250 SCALA) e= ngineering workstations sets a fixed, hard-coded x11vnc password. Because t=
he same credential is applied to every workstation provisioned this way, an=
attacker with adjacent-network access who knows the password can gain VNC = access to affected workstations. 2026-07-31 8.1 CVE-2026-65313 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-65313 ] ANDRITZ--HIPASE-250 ANDRITZ HIPAS= E-250 (formerly 250 SCALA) in affected versions stores and transmits user p= asswords using a reversible format instead of a one-way password hash. This=
allows an attacker able to read the credential store or capture network tr= affic to recover all stored passwords. 2026-07-31 7.5 CVE-2026-65309 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-65309 ] ANDRITZ--HIPASE-250 ANDRITZ=
HIPASE-250 (formerly 250 SCALA), in the default configuration of affected = versions, exposes its data and configuration endpoint without any authentic= ation and permissive CORS on every response. An unauthenticated attacker wi=
th network access can read live process values and server configuration. 20= 26-07-31 7.5 CVE-2026-65310 [ https://www.cve.org/CVERecord?id=3DCVE-2026-6= 5310 ] Anh Tran--Falcon WordPress Optimizations & Tweaks Unauthenticated Un= known in Falcon - WordPress Optimizations & Tweaks <=3D 2.10.0 versions. 20= 26-07-27 7.5 CVE-2026-59531 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5= 9531 ] Apache Software Foundation--Apache Thrift Improper Handling of Highl=
y Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby = bindings. This issue affects Apache Thrift: before 0.24.0. Users are recomm= ended to upgrade to version 0.24.0, which fixes the issue. 2026-07-27 7.5 C= VE-2026-49158 [ https://www.cve.org/CVERecord?id=3DCVE-2026-49158 ] Apache = Software Foundation--Apache Traffic Server Improper Input Validation vulner= ability in Apache Traffic Server. This issue affects Apache Traffic Server:=
from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3. Users are recommend=
ed to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. 2026-07-2=
9 10 CVE-2026-33267 [ https://www.cve.org/CVERecord?id=3DCVE-2026-33267 ] A= pache Software Foundation--Apache Traffic Server Apache Traffic Server allo=
ws request smuggling if chunked messages are malformed. This issue affects = Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14,=
from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.= 2.15 or 10.1.4, which fix the issue. 2026-07-29 10 CVE-2026-57834 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-57834 ] Apache Software Foundation--Ap= ache Traffic Server Apache Traffic Server does not reject Transfer-Encoding=
in HTTP/2 requests, allowing downgrade request smuggling. This issue affec=
ts Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.= 14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version=
9.2.15 or 10.1.4, which fix the issue. 2026-07-29 10 CVE-2026-58150 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-58150 ] Apache Software Foundation-= -Apache Traffic Server The Apache Traffic Server certifier plugin generates=
certificates based on attacker-controlled client SNI. This issue affects A= pache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, = from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2= .15 or 10.1.4, which fix the issue. 2026-07-29 10 CVE-2026-58162 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-58162 ] Apache Software Foundation--Apa= che Traffic Server Improper Access Control vulnerability in Apache Traffic = Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14=
, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9= .1.15 or 10.1.4, which fixes the issue. 2026-07-29 9.3 CVE-2026-41920 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-41920 ] Apache Software Foundation= --Apache Traffic Server Apache Traffic Server truncates over-long header na= mes, allowing header aliasing, request smuggling, and policy bypass. This i= ssue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 th= rough 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade =
to version 9.2.15 or 10.1.4, which fix the issue. 2026-07-29 9.3 CVE-2026-5= 8155 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58155 ] Apache Software = Foundation--Apache Traffic Server Regular Expression without Anchors vulner= ability in Apache Traffic Server. This issue affects Apache Traffic Server:=
from 10.0.X through 10.1.3, from 9.0.X through 9.2.14. Users are recommend=
ed to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. 2026-07-2=
9 8.2 CVE-2026-22068 [ https://www.cve.org/CVERecord?id=3DCVE-2026-22068 ] = Apache Software Foundation--Apache Traffic Server Apache Traffic Server for= wards HTTP/2 origin trailers to HTTP/1 clients without proper chunked frami=
ng when converting HTTP/2 to HTTP/1. This issue affects Apache Traffic Serv= er: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version=
9.2.15 or 10.1.4, which fix the issue. 2026-07-29 8.3 CVE-2026-58153 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-58153 ] Apache Software Foundation= --Apache Traffic Server Apache Traffic Server can write out of bounds or ov= erflow integers while parsing MIME and HTTP headers. This issue affects Apa= che Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, fr=
om 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.1=
5 or 10.1.4, which fix the issue. 2026-07-29 8.9 CVE-2026-58154 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-58154 ] Apache Software Foundation--Apac=
he Traffic Server Apache Traffic Server can reuse server sessions and tunne=
ls improperly, exposing data across client connections. This issue affects = Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14,=
from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.= 2.15 or 10.1.4, which fix the issue. 2026-07-29 8.7 CVE-2026-58157 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-58157 ] Apache Software Foundation--A= pache Traffic Server Apache Traffic Server can bypass IP access controls on=
UDS listeners and through ACL matching errors. This issue affects Apache T= raffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10= .0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or = 10.1.4, which fix the issue. 2026-07-29 8.2 CVE-2026-58159 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-58159 ] Apache Software Foundation--Apache Tr= affic Server The Apache Traffic Server Cripts framework has out-of-bounds w= rites, path traversal, and use-after-free errors. This issue affects Apache=
Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgra=
de to version 10.1.4, which fix the issue. 2026-07-29 8.1 CVE-2026-58177 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-58177 ] Apache Software Foundat= ion--Apache Traffic Server The Apache Traffic Server regex_remap plugin ove= rflows the stack and integers from substitution input. This issue affects A= pache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, = from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2= .15 or 10.1.4, which fix the issue. 2026-07-29 8.1 CVE-2026-58179 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-58179 ] Apache Software Foundation--Ap= ache Traffic Server The Apache Traffic Server ts_lua plugin mishandles init= ialization, transform context, and per-instance state. This issue affects A= pache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, = from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2= .15 or 10.1.4, which fix the issue. 2026-07-29 8.6 CVE-2026-58182 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-58182 ] Apache Software Foundation--Ap= ache Traffic Server The Apache Traffic Server header_rewrite plugin can cra=
sh or corrupt memory during cookie operations and CIDR condition matching. = This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.= 0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to up= grade to version 9.2.15 or 10.1.4, which fix the issue. 2026-07-29 8.2 CVE-= 2026-58184 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58184 ] Apache Sof= tware Foundation--Apache Traffic Server Several Apache Traffic Server exper= imental plugins have memory-safety and limit-bypass errors. This issue affe= cts Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2= .14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to versio=
n 9.2.15 or 10.1.4, which fix the issue. 2026-07-29 8.2 CVE-2026-58188 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-58188 ] Apache Software Foundatio= n--Apache Traffic Server Inconsistent Interpretation of HTTP Requests ('HTT=
P Request/Response Smuggling') vulnerability in Apache Traffic Server. This=
issue affects Apache Traffic Server: from 10.0.0 through 10.1.3, from 9.0.=
0 through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.= 1.4, which fixes the issue. 2026-07-29 7.2 CVE-2026-24033 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-24033 ] Apache Software Foundation--Apache Tra= ffic Server Apache Traffic Server can be crashed or driven to resource exha= ustion by abusive HTTP/2 framing and flow-control. This issue affects Apach=
e Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from=
10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 =
or 10.1.4, which fix the issue. 2026-07-29 7.5 CVE-2026-58151 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-58151 ] Apache Software Foundation--Apache=
Traffic Server Apache Traffic Server can crash from null dereferences and = dangling references in TLS and SNI handling. This issue affects Apache Traf= fic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.=
0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.= 1.4, which fix the issue. 2026-07-29 7.5 CVE-2026-58161 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-58161 ] Apache Software Foundation--Apache Traff=
ic Server Apache Traffic Server mishandles on-disk cache fields and object = lifetimes, corrupting state or crashing. This issue affects Apache Traffic = Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 th= rough 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4,=
which fix the issue. 2026-07-29 7.5 CVE-2026-58163 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-58163 ] Apache Software Foundation--Apache Traffic S= erver Apache Traffic Server has use-after-free and time-of-check/time-of-us=
e errors in remap configuration handling. This issue affects Apache Traffic=
Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 t= hrough 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4=
, which fix the issue. 2026-07-29 7.5 CVE-2026-58164 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-58164 ] Apache Software Foundation--Apache Traffic = Server Apache Traffic Server leaks memory when handling HostDB SRV records.=
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9= .0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to u= pgrade to version 9.2.15 or 10.1.4, which fix the issue. 2026-07-29 7.5 CVE= -2026-58175 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58175 ] Apache So= ftware Foundation--Apache Traffic Server The Apache Traffic Server ESI plug=
in can recurse without bound and fetch attacker-controlled URLs. This issue=
affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 throug=
h 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to v= ersion 9.2.15 or 10.1.4, which fix the issue. 2026-07-29 7.5 CVE-2026-58178=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-58178 ] Apache Software Foun= dation--Apache Traffic Server The Apache Traffic Server txn_box plugin over= flows the stack from attacker-controlled input. This issue affects Apache T= raffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10= .0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or = 10.1.4, which fix the issue. 2026-07-29 7.5 CVE-2026-58180 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-58180 ] Apache Software Foundation--Apache Tr= affic Server The Apache Traffic Server uri_signing and url_sig plugins can = exhaust the stack or crash on attacker input. This issue affects Apache Tra= ffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0=
.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10= .1.4, which fix the issue. 2026-07-29 7.5 CVE-2026-58181 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-58181 ] Apache Software Foundation--Apache Traf= fic Server The Apache Traffic Server webp_transform plugin can decode unsaf= ely and serve mislabeled, cacheable responses. This issue affects Apache Tr= affic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.= 0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 1= 0.1.4, which fix the issue. 2026-07-29 7.5 CVE-2026-58186 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-58186 ] Apache Software Foundation--Apache Tra= ffic Server Apache Traffic Server allows redirect-limit bypass when plugins=
reset the retry counter, enabling SSRF amplification. This issue affects A= pache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, = from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2= .15 or 10.1.4, which fix the issue. 2026-07-29 7.5 CVE-2026-58189 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-58189 ] Apache Software Foundation--Ap= ache Traffic Server Apache Traffic Server drops the per-stream buffer cap w= hen dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust se= rver memory. This issue affects Apache Traffic Server: from 8.0.0 through 8= .1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are reco= mmended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. 2026-0= 7-29 7.5 CVE-2026-65324 [ https://www.cve.org/CVERecord?id=3DCVE-2026-65324=
] appium--java-client Appium Java Client is the Java language binding for = writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1=
until 10.1.1, when directConnect(true) is enabled, AppiumCommandExecutor.s= etDirectConnect() reads the directConnectHost, directConnectPort, and direc= tConnectPath fields from the server's NEW_SESSION response and rebuilds the=
client's server URL from them, validating only that the protocol is https,=
with no host allowlist or IP validation; a rogue or compromised server can=
therefore redirect all subsequent session traffic to an arbitrary destinat= ion, enabling full interception of session traffic and a server-side reques=
t forgery pivot to internal hosts, including cloud metadata (IMDS) credenti=
al theft. This vulnerability is fixed in 10.1.1. 2026-07-28 8.2 CVE-2026-43= 910 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43910 ] ArcadeData--arcad= edb ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look=
up host classes in java.lang.* (via Java.type) because ScriptTriggerExecut=
or adds java.lang.* to the allowed packages. An authenticated user with UPD= ATE_SCHEMA permission can create a JavaScript trigger that invokes java.lan= g.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command exe= cution when the trigger fires. 2026-08-01 9.8 CVE-2026-67340 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-67340 ] ArcadeData--arcadedb ArcadeDB versi= ons before 26.7.2 fail to enforce scripting authorization checks on the SQL=
DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access=
can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statem= ents, bypassing security controls intended to restrict scripting to adminis= trators. 2026-08-01 9.8 CVE-2026-67341 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-67341 ] ArcadeData--arcadedb ArcadeDB versions before 26.7.2 co= ntain an authorization bypass vulnerability in HTTP handlers for time serie=
s, batch, Prometheus, and Grafana endpoints that fail to validate database = access permissions. Attackers can access and modify databases they are not = authorized to use by directly calling affected endpoints with arbitrary dat= abase parameters. 2026-08-01 9.8 CVE-2026-67342 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-67342 ] ArcadeData--arcadedb ArcadeDB versions before 26= .7.2 fail to properly redact the cluster token in the GET /api/v1/server en= dpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterTok=
en value in cleartext. Attackers can use the leaked token with X-ArcadeDB-C= luster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and = execute administrative actions including user creation, database operations=
, and server shutdown. 2026-08-01 8.8 CVE-2026-67343 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-67343 ] ArcadeData--arcadedb ArcadeDB before 26.7.3=
binds the real LocalDatabase object into JavaScript trigger contexts with = HostAccess.ALL, allowing schema-admins to call getSecurity().createUser() w= ithout permission checks. Attackers with UPDATE_SCHEMA permission can creat=
e triggers that execute JavaScript to create server-wide admin users, escal= ating privileges beyond their authorization level. 2026-08-02 8.8 CVE-2026-= 67356 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67356 ] ArcadeData--arc= adedb ArcadeDB versions before 26.7.3 contain an information disclosure vul= nerability in the MCP get_server_settings tool that leaks the arcadedb.ha.c= lusterToken in cleartext. Attackers with MCP access can retrieve the cluste=
r token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-U= ser headers to impersonate root and achieve full server compromise. 2026-08= -02 7.5 CVE-2026-67357 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67357 =
] ArcadeData--arcadedb ArcadeDB versions before 26.7.3 fail to bind the aut= henticated principal in the MCP HTTP transport, causing all engine permissi=
on checks to silently pass as no-ops. Non-root MCP-allowed users can perfor=
m arbitrary database writes, DDL, schema mutations, and execute arbitrary J= avaScript code via the query tool. 2026-08-02 7.5 CVE-2026-68578 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-68578 ] Arista Networks--VeloCloud Orch= estrator On-Prem VeloCloud Orchestrator (VCO) on-prem has a security issue = where this issue may allow a remote attacker to access privileged internal = functionality and impact the VCO host. Successful exploitation may compromi=
se the confidentiality, integrity, and availability of the orchestrator and=
data managed by the orchestrator. This functionality was intended to be fo=
r internal use only and is not intended to be remotely accessible. Hosted a=
nd Dedicated versions of VCO have already been patched in advance of this n= otice going out. This issue was discovered externally and is known to be ac= tively exploited. 2026-07-27 10 CVE-2026-16812 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-16812 ] Arista Networks--VeloCloud Orchestrator On-Prem A=
n input validation vulnerability exists in an API component of the orchestr= ator. An authenticated user can exploit this flaw to manipulate backend que= ries, which may result in unauthorized access to data beyond their intended=
privileges and cause the underlying system to initiate unintended outbound=
network connections. This issue was discovered internally by Arista and th=
e company is not aware of any malicious uses of this issue in customer netw= orks. 2026-07-27 9.1 CVE-2026-17191 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-17191 ] Arista Networks--VeloCloud Orchestrator On-Prem A VCO featur=
e does not sufficiently validate caller-supplied input, allowing requests t=
o be made on behalf of authenticated tenant accounts to internal services t= hat are not otherwise accessible. This vulnerability requires a minimum rol=
e of Enterprise Standard Admin. This issue was discovered internally by Ari= sta and the company is not aware of any malicious uses of this issue in cus= tomer networks. 2026-07-27 8.5 CVE-2026-17192 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-17192 ] ArkSigner Software and Hardware Industry and Trade=
Inc.--ArkSigner Desktop Client Uncontrolled Search Path Element vulnerabil= ity in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner De= sktop Client allows Search Order Hijacking. This issue affects ArkSigner De= sktop Client: from v2.2.16.10 through 17062026. 2026-07-28 7.3 CVE-2026-816=
4 [ https://www.cve.org/CVERecord?id=3DCVE-2026-8164 ] ArticaTech--Artica P= roxy Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 202607= 24-02) contains a session fixation vulnerability that allows unauthenticate=
d attackers to hijack administrative sessions by setting a known PHPSESSID =
on a victim's browser prior to authentication. Attackers can pre-set a cont= rolled session identifier and wait for a victim to authenticate through fw.= login.php, after which the attacker gains a fully authenticated administrat= ive session on port 9000. 2026-07-28 7.5 CVE-2026-66745 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-66745 ] ASE--Admin and Site Enhancements (ASE) P=
ro The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulner= able to Remote Code Execution in all versions up to, and including, 8.9.0 v=
ia the recursive_html function. This is due to the frontend save handler en= forces only a publicly emitted nonce with no authentication check, CAPTCHA = validation is bypassable by omitting an attacker-supplied key, and repeater=
row keys from cfgroup[input] are stored verbatim and later spliced into an=
eval() call in recursive_html without any sanitization or identifier valid= ation. This makes it possible for unauthenticated attackers to execute code=
on the server. This requires the [post_cf_form] shortcode to be present on=
at least one publicly accessible page, as the nonce and session ID needed =
to reach the vulnerable save handler are emitted to unauthenticated visitor=
s by that shortcode. 2026-07-30 9.8 CVE-2026-16610 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-16610 ] Aurovrata Venet--Post My CF7 Form Unauthentic= ated Broken Access Control in Post My CF7 Form <=3D 6.2.0 versions. 2026-07= -27 7.5 CVE-2026-59534 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59534 =
] Autodesk--AutoCAD A maliciously crafted DXF file, when parsed through Aut= odesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious a= ctor can leverage this vulnerability to cause a crash, read sensitive data,=
or execute arbitrary code in the context of the current process. 2026-07-2=
9 7.8 CVE-2026-16463 [ https://www.cve.org/CVERecord?id=3DCVE-2026-16463 ] = AWS--Amplify Codegen UI Improper control of code generation in Amazon @aws-= amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated u= ser to execute arbitrary code in end-user browsers, developer machines, CI/=
CD environments, and server-side rendering contexts via crafted Studio comp= onent or theme schema values due to insufficient coverage and effectiveness=
of the input validation introduced for CVE-2025-4318. To remediate this is= sue, users should upgrade to version=C2=A02.20.6 2026-07-30 9 CVE-2026-1824=
5 [ https://www.cve.org/CVERecord?id=3DCVE-2026-18245 ] AWS--AWS Ops Wheel = Stored cross-site scripting in the participant URL handling in AWS Ops Whee=
l before PR #168 might allow an authenticated remote user to steal session = tokens and escalate to full administrative control of the deployed instance=
via a crafted participant_url value containing a dangerous URI scheme. To = remediate this issue, users should redeploy from the latest version of aws-= ops-wheel. 2026-07-31 7.3 CVE-2026-18481 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-18481 ] AWS--aws-smithy-json Uncontrolled recursion in the unkn= own-key skip path of the aws-smithy-json runtime crate before 0.62.7, which=
the smithy-rs code generator invokes from every generated struct deseriali= zer, might allow remote unauthenticated users to cause a denial of service = (process abort via stack exhaustion) via a single small HTTP request contai= ning deeply nested JSON to a smithy-rs generated server. To remediate this = issue, users should upgrade to aws-smithy-json 0.62.7 or later and rebuild.=
2026-07-30 7.5 CVE-2026-18140 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-18140 ] AWS--Strands Agents Tools Incorrect authorization in the http_req= uest tool in Strands Agents Tools before 0.8.2 might allow remote attackers=
to obtain credentials configured via HTTP_REQUEST_TOKEN_CONFIG by influenc= ing the LLM to route requests through actor-controlled proxy infrastructure=
. To remediate this issue, users should upgrade to version 0.8.2. 2026-07-3=
1 7.4 CVE-2026-18394 [ https://www.cve.org/CVERecord?id=3DCVE-2026-18394 ] = bablilayoub--openhole openhole exposes localhost to the internet in one com= mand. In 0.1.1 and earlier, openhole-server in internal/server/public_proxy= .go forwarded r.URL.Path instead of preserving the original request target = with r.URL.EscapedPath(), allowing percent encoded dot segments %2e and sep= arators %2f to reach tunneled local services as ../ and / for path traversa=
l. This issue is fixed in version 0.1.2. 2026-07-28 8.6 CVE-2026-54650 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-54650 ] bank-vaults--vault-secret= s-webhook vault-secrets-webhook is a Kubernetes mutating webhook that makes=
direct secret injection into Pods possible. Prior to 1.23.1, parseVaultCon= fig() in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/va= ult-addr annotation, MutateConfigMap and MutateSecret call newVaultClient i=
n pkg/webhook/webhook.go, and vault.security.banzaicloud.io/vault-serviceac= count can cause a ServiceAccount JWT to be sent to an attacker-controlled V= ault address. This issue is fixed in version 1.23.1. 2026-07-31 9.6 CVE-202= 6-54725 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54725 ] better-auth--= better-auth Better Auth relies on better-call, which uses the rou3 router l= ibrary. In affected versions of rou3, paths are normalized by removing empt=
y segments, so /path, //path, and ///path resolve to the same route. In Bet= ter Auth versions prior to 1.4.5 (which bundles the fixed rou3), this can a= llow attackers to bypass disabledPaths configuration and path-based rate li= mits by submitting requests with extra slashes in the URL path. The issue d= oes not apply in deployments where the proxy or platform normalizes URLs by=
collapsing multiple slashes. 2026-08-02 8.6 CVE-2025-71399 [ https://www.c= ve.org/CVERecord?id=3DCVE-2025-71399 ] better-auth--better-auth better-auth=
versions >=3D 1.1.3 and < 1.6.22 (and pre-release versions >=3D 1.7.0-beta=
.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account = hijacking on magic-link and email-OTP sign-in when open email/password regi= stration is enabled. An attacker registers an account with the victim's ema=
il address and an attacker-chosen password; the account remains unverified.=
When the legitimate owner later signs in via the magic-link or email-OTP p= asswordless flow, the account is marked verified without removing the pre-e= xisting password or revoking existing sessions, so the attacker's password = remains valid, granting persistent access to the victim's account. Fixed in=
1.6.22 and 1.7.0-beta.10. 2026-08-01 8.3 CVE-2026-67327 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-67327 ] better-auth--better-auth better-auth ve= rsions before 1.6.11 contain insecure cryptographic defaults in the oidcPro= vider and mcp plugins that advertise the none algorithm and accept plain PK=
CE by default. Attackers can exploit algorithm negotiation to accept unsign=
ed tokens or intercept authorization codes when PKCE plain is used instead =
of the required S256 method. 2026-08-01 8.7 CVE-2026-67336 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-67336 ] better-auth--better-auth better-auth = versions before 1.1.20 contain a bypass vulnerability in trustedOrigins val= idation logic affecting absolute URLs and wildcard domains. Attackers can c= onstruct malicious callbackURL parameters that pass origin checks and trigg=
er open redirects to steal sensitive tokens for account takeover. 2026-08-0=
1 7.1 CVE-2025-71403 [ https://www.cve.org/CVERecord?id=3DCVE-2025-71403 ] = better-auth--better-auth better-auth before 1.6.13 (and pre-release builds = 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_= uris registered via the deprecated oidc-provider plugin and the mcp plugin = (which wraps the same provider). An attacker can register an OAuth client w= ith a javascript: redirect_uri, which the authorization server later return=
s unchanged in the consent response. If the deployment's consent page navig= ates the browser to the returned redirectURI (e.g. assigning it to window.l= ocation.href), the attacker's JavaScript executes in the authorization-serv=
er origin, exposing the victim's session and enabling account takeover. 202= 6-08-01 7.2 CVE-2026-67333 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67= 333 ] better-auth--passkey better-auth passkey versions before 1.4.0 contai=
n an insecure direct object reference vulnerability in the passkey deletion=
endpoint that allows authenticated users to delete arbitrary passkeys by I=
D. Attackers with valid sessions can submit crafted requests to the delete-= passkey endpoint with enumerated passkey IDs to remove other users' passkey=
s. 2026-08-02 7.1 CVE-2025-71400 [ https://www.cve.org/CVERecord?id=3DCVE-2= 025-71400 ] better-auth--scim @better-auth/scim (a better-auth plugin) vers= ions >=3D 1.4.0-beta.27 through <=3D 1.6.21 and >=3D 1.7.0-beta.0 through <= =3D 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did n=
ot reject provider IDs already used by existing SSO, SAML, OIDC, generic OA= uth, or social account providers, and the same logical provider ID was used=
for both SCIM provider configuration and account ownership. An authenticat=
ed user could mint a SCIM token whose provider ID collided with an existing=
provider namespace, causing SCIM user routes to resolve account rows the t= oken never provisioned. This allowed listing, reading, updating (including = rewriting global profile/email fields without uniqueness checks), and delet= ing global user accounts and sessions, resulting in account takeover and un= authorized deprovisioning. Fixed in 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0). = 2026-08-01 9.9 CVE-2026-67330 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -67330 ] better-auth--scim better-auth SCIM versions from 1.5.0 before 1.7.= 0-beta.4 fail to bind non-organization SCIM providers to their creator by d= efault, allowing authenticated users to manage other users' providers. Atta= ckers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and = authenticate to SCIM API routes with the attacker-controlled token. 2026-08= -01 8.3 CVE-2026-67331 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67331 =
] better-auth--sso @better-auth/sso versions before 1.6.21 contain multiple=
authentication bypass vulnerabilities in SSO provider handling that allow = attackers to sign in as arbitrary users. Attackers can exploit domain verif= ication parsing mismatches, orphaned provider accounts, unbound SAML assert= ions, or reflected XSS on logout endpoints to gain unauthorized session acc= ess and account takeover. 2026-08-01 8.1 CVE-2026-67328 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-67328 ] better-auth--stripe @better-auth/stripe = versions >=3D 1.4.11 and < 1.6.21, and >=3D 1.7.0-beta.0 and < 1.7.0-beta.1=
0, contain an authorization bypass in organization subscription actions. Th=
e middleware validates the organization ID taken from the request query str= ing against the authorizeReference callback, but the handler reads the orga= nization ID only from the request body and falls back to the caller's activ=
e organization from their session. When these differ, an authenticated memb=
er of multiple organizations can perform subscription actions (cancel, chan=
ge plan, restore, billing portal access) against an organization they belon=
g to but should not manage, and can access another organization's billing d= etails including payment methods, invoices, and subscription state. 2026-08= -01 7.1 CVE-2026-67329 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67329 =
] bitpressadmin--Bit integrations Form Integration, Webhook, Spreadsheets, = CRM, LMS & Email Automation The Bit integrations - Form Integration, Webhoo=
k, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulner= able to Directory Traversal in all versions up to, and including, 2.9.0 via=
the processAttachment function. This makes it possible for unauthenticated=
attackers to read the contents of arbitrary files on the server, which can=
contain sensitive information. 2026-08-01 7.5 CVE-2026-15006 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-15006 ] BlackBerry Ltd--QNX Software Devel= opment Platform Improper Input Validation in the decode() function of the t= raceparser library could allow an attacker with a corrupted kernel trace ev= ent log (.kev) file, to execute arbitrary code or cause a crash in processe=
s that use libtraceparser in QNX hosts or targets. 2026-07-29 7 CVE-2026-40= 272 [ https://www.cve.org/CVERecord?id=3DCVE-2026-40272 ] boazsegev--facil.=
io facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability=
in the multipart MIME body parser that allows unauthenticated remote attac= kers to crash the server process by sending a crafted Content-Disposition h= eader with an empty field name. Attackers can trigger a uint32_t wraparound=
in http_mime_parser.h causing an out-of-bounds memory read past the name p= ointer, resulting in a bus fault that crashes the handling worker with a si= ngle POST request. 2026-07-27 7.5 CVE-2026-66729 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-66729 ] boazsegev--facil.io facil.io 0.6.0 through 0.7.=
6 contains a denial-of-service vulnerability in the multipart body parser t= hat allows an unauthenticated remote attacker to permanently freeze worker = processes at 100% CPU by sending a multipart/form-data request with a parti=
al closing boundary. The missing progress guard in the parser loop causes h= ttp_mime_parse to return 0 bytes consumed without setting done or error fla= gs, causing the calling loop to re-invoke the parser on the same buffer ind= efinitely, exhausting all workers and permanently disabling the server unti=
l manually restarted. 2026-07-27 7.5 CVE-2026-66730 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-66730 ] boazsegev--facil.io facil.io 0.7.5 through 0= .7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked tra= nsfer encoding parser that allows unauthenticated remote attackers to crash=
the server by sending a negative chunk size value. Attackers can send a si= ngle POST request with a Transfer-Encoding: chunked header containing a lea= ding minus sign in the chunk size field, causing the parser in http1_parser=
.h to compute a large positive integer from the negated value, corrupting i= nternal state and moving the read pointer into unmapped memory resulting in=
a fault. 2026-07-27 7.5 CVE-2026-66731 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-66731 ] Bosch--BSH ELP (Electronic Platform) Modules The SSH se= rvice on BSH ELP (Electronic Platform) modules contains a platform-specific=
vulnerability due to an improperly secured default configuration. An insec= ure, non-revocable SSH public key is included in the firmware's authorized_= keys file for the root user. An attacker in possession of the corresponding=
private key could leverage it to bypass authentication and gain root-level=
access to the appliance. 2026-07-30 8.1 CVE-2026-56428 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-56428 ] britcoder--Single Sign On For TNG The Si= ngle Sign On For TNG plugin for WordPress is vulnerable to Authentication B= ypass via unauthenticated password reset in all versions up to, and includi= ng, 2.0.0. This is due to the `ssoprocess_ajax()` function - registered on = `wp_ajax_nopriv_ssoprocess_ajax` and therefore reachable without authentica= tion - accepting an attacker-supplied `email` parameter with the `setnewpas= sword` operation and calling `reset_password()` on the resolved account wit= hout any ownership token, email confirmation link, or capability check. The=
sole guard is a call to `check_ajax_referer()`, which provides no authoriz= ation barrier because the `ssoajaxnonce` nonce is publicly broadcast on eve=
ry front-end page via `wp_localize_script()` into the `SSOPWDREQUIREMENT` J= avaScript object; since WordPress computes nonces for logged-out visitors a= gainst a shared anonymous session context, any unauthenticated visitor can = scrape a valid nonce from the homepage and use it to authenticate the reque= st. This makes it possible for unauthenticated attackers to change the pass= word of any WordPress account, including administrator accounts, enabling c= omplete site takeover. 2026-08-01 9.8 CVE-2026-15964 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-15964 ] buddypress--BuddyPress The BuddyPress plugi=
n for WordPress is vulnerable to Deserialization of Untrusted Data in all v= ersions up to, and including, 14.5.0 This is due to the `bp_unserialize_pro= file_field()` function using `@unserialize()` without the `allowed_classes`=
parameter on user-controlled XProfile field data. This makes it possible f=
or authenticated attackers, with subscriber-level access and above, to inje=
ct arbitrary PHP objects via XProfile textbox fields, which could lead to r= emote code execution if a suitable POP chain is available in the WordPress = environment. 2026-07-30 7.5 CVE-2026-1360 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-1360 ] Byteflows--Byteflows Travel & Hotel Booking Unauthentic= ated Sensitive Data Exposure in Byteflows Travel &amp; Hotel Booking <=3D 1= .0.0 versions. 2026-07-27 7.5 CVE-2026-59548 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-59548 ] Canon Production Printing--PRISMAproduction A deser= ialization vulnerability in PRISMAproduction Version 6.5 or earlier that ma=
y lead to arbitrary code execution. 2026-08-02 7.5 CVE-2026-3245 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-3245 ] Care Everywhere LLC--Care Everyw= here Gateway Care Everywhere Gateway 14.3.10 contains a hard-coded credenti= als vulnerability in the bundled WildFly 8.2.0.Final management interface t= hat allows unauthenticated remote attackers to gain administrative access b=
y using default credentials identical across all installations. Attackers c=
an authenticate to the exposed WildFly management console on port 20990 and=
deploy a malicious Web Application Archive file through the Deployments in= terface to achieve remote code execution as the Windows machine account. Ve= rsion 14.x.x was declared end-of-life (EOL) in 2017 and future releases hav=
e addressed the vulnerable finding. 2026-07-29 9.8 CVE-2026-41939 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-41939 ] Christoph Vielgrader--Relevans=
si Light Unauthenticated SQL Injection in Relevanssi Light <=3D 1.2.2 versi= ons. 2026-07-27 9.3 CVE-2026-59533 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-59533 ] clastix--kamaji Kamaji is the Hosted Control Plane Manager fo=
r Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane dat= astore schema, database user, and etcd key prefix from a lossy namespace-an= d-name normalization in GetDefaultDatastoreSchema() and GetDefaultDatastore= Username(), allowing distinct tenants with colliding normalized identifiers=
to share control-plane state and read, modify, or destroy another tenant's=
Kubernetes data. This issue is fixed in version 26.7.4-edge. 2026-07-30 8.=
5 CVE-2026-62246 [ https://www.cve.org/CVERecord?id=3DCVE-2026-62246 ] Clea= nTalk Inc--Spam protection, AntiSpam, FireWall by CleanTalk Unauthenticated=
Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by Clean= Talk <=3D 6.82 versions. 2026-07-27 7.1 CVE-2026-65437 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-65437 ] cloudreve--cloudreve Cloudreve is a self-= hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/ad= min/policy/oauth/signin requires only Admin.Read even though GetOauthRedire= ctService persists caller-supplied OneDrive secret and app_id values, allow= ing an OAuth token without Admin.Write to modify storage policy credentials=
. The route is inside the admin group that requires Admin.Read, but it does=
not add the local Admin.Write guard used by sibling policy mutation routes=
. Its handler persists attacker-supplied secret and app_id values into the = selected OneDrive storage policy before returning an OAuth URL. This issue =
is fixed in version 4.17.0. 2026-07-31 7.1 CVE-2026-55502 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-55502 ] CoCart Headless--CoCart Headless ecomm= erce Unauthenticated Broken Access Control in CoCart - Headless ecommerce <= =3D 4.8.4 versions. 2026-07-27 7.5 CVE-2026-59536 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-59536 ] code4life--Database for CF7 The Database for C=
F7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Ar= ray Form Field Values in all versions up to, and including, 1.2.6 due to in= sufficient input sanitization and output escaping. This makes it possible f=
or unauthenticated attackers to inject arbitrary web scripts in pages that = will execute whenever a user accesses an injected page. This is exploitable=
by unauthenticated attackers because Contact Form 7 accepts array-structur=
ed input for ordinary text fields (e.g., your-name[]) via the public REST A=
PI endpoint /wp-json/contact-form-7/v1/contact-forms/{id}/feedback, and the=
plugin stores submitted data using $wpdb INSERT with serialize() into a cu= stom wp_cf7db table, bypassing WordPress save-time filtering via wp_insert_= post/wp_kses. 2026-07-29 7.2 CVE-2026-13425 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-13425 ] codeigniter4--CodeIgniter4 CodeIgniter is a PHP full= -stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch()=
substitutes bound values from where() conditions into generated SQL while = ignoring their escape flags, allowing user-controlled condition values to b=
e interpreted as SQL. This affects only the deleteBatch() code path. Regula=
r delete() operations escape where() binds correctly. This issue is fixed i=
n version 4.7.4. 2026-07-31 9.4 CVE-2026-63221 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-63221 ] codeigniter4--CodeIgniter4 CodeIgniter is a PHP f= ull-stack web framework. Prior to 4.7.4, the is_image and mime_in upload va= lidation rules do not independently enforce a safe client filename extensio=
n, allowing a remote attacker to upload executable content when an applicat= ion preserves the client filename and stores uploads in a web-accessible sc= ript-enabled directory. Applications are impacted when they validate upload=
s using is_image or mime_in without an independent safe extension check (su=
ch as ext_in on patched versions), save uploaded files using the client-sup= plied filename, and place uploads in a web-accessible directory where PHP f= iles can execute. This issue is fixed in version 4.7.4. 2026-07-31 9.8 CVE-= 2026-63223 [ https://www.cve.org/CVERecord?id=3DCVE-2026-63223 ] codeignite= r4--CodeIgniter4 CodeIgniter is a PHP full-stack web framework. Prior to 4.= 7.4, calling UploadedFile::move() without a second argument uses the client= -provided filename without sanitization, allowing a remote attacker to use = path traversal sequences to write uploaded content outside the intended dir= ectory when the application exposes an upload path. This issue is fixed in = version 4.7.4. 2026-07-31 7.5 CVE-2026-63222 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-63222 ] codename065--Premium Packages Sell Digital Products=
Securely The Premium Packages - Sell Digital Products Securely plugin for = WordPress is vulnerable to SQL Injection via the 'code' parameter of the PO=
ST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and = including, 6.2.0. This is due to insufficient escaping on the user-supplied=
parameter, which is interpolated directly into a raw SQL query string in t=
he CouponCodes::find() method without use of $wpdb->prepare() or esc_sql().=
This makes it possible for unauthenticated attackers to append additional = SQL queries into already existing queries that can be used to extract sensi= tive information from the database. 2026-07-28 7.5 CVE-2026-12800 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-12800 ] Comfy-Org--ComfyUI ComfyUI v0.= 23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDa= taset node that allows unauthenticated remote attackers to execute arbitrar=
y Python code by uploading a crafted pickle file and triggering its deseria= lization. Attackers can upload a malicious shard_*.pkl file via the unauthe= nticated POST /upload/image endpoint and then queue a workflow graph via PO=
ST /prompt referencing the uploaded file, causing torch.load to deserialize=
the attacker-controlled pickle payload using __reduce__ and execute arbitr= ary commands as the ComfyUI process user. 2026-07-31 9.8 CVE-2026-68771 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-68771 ] Comfy-Org--ComfyUI Comfy=
UI is a modular diffusion model GUI, api and backend with a graph/nodes int= erface. Prior to 0.28.0, the /view endpoint served uploaded SVG files inlin=
e because image/svg+xml and related XML content types were absent from the = dangerous-content-type handling, allowing stored cross-site scripting in th=
e ComfyUI origin. This issue is fixed in version 0.28.0. 2026-07-31 8.2 CVE= -2026-56670 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56670 ] Comfy-Org= --ComfyUI ComfyUI is a node-based diffusion model GUI, API, and backend. Pr= ior to 0.28.0, GET /userdata/{file} served user-controlled HTML and SVG fil=
es with extension-derived content types, allowing stored cross-site scripti=
ng in the ComfyUI origin and access to browser-stored API tokens, settings,=
workflows, and authenticated-equivalent API calls. The handler used web.Fi= leResponse(path), so an uploaded .html/.svg was served as text/html/image/s= vg+xml. POST /userdata stores arbitrary request bodies (confined to the use= r's userdata directory). When a victim navigated to the file URL, the embed= ded script executed same-origin. The /view endpoint already forced dangerou=
s MIME types to download; that protection had never been applied to /userda= ta. This issue is fixed in version 0.28.0. 2026-07-31 8.2 CVE-2026-56672 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-56672 ] Comfy-Org--ComfyUI Comf= yUI is a modular diffusion model GUI, api and backend with a graph/nodes in= terface. Prior to 0.28.0, get_model_preview in app/model_manager.py joins a=
n unrestricted filename route capture to a selected model directory without=
a containment check, allowing an unauthenticated remote attacker to use tr= aversal, encoded traversal, absolute paths, or an unbounded path_index to r= ead image-decodable files and enumerate host paths. get_model_preview (app/= model_manager.py) built the path with os.path.join(folder, filename) where = filename is an unrestricted {filename:.*} route capture. Literal ../, perce= nt-encoded %2e%2e%2f, and absolute paths all escaped the model directory; p= ath_index was also unbounded. The target file is piped through Pillow and r= e-encoded as WEBP, so disclosure is limited to image-decodable files plus a=
file-existence/enumeration oracle (and internal-path leakage via path_inde=
x errors). This issue is fixed in version 0.28.0. 2026-07-31 7.5 CVE-2026-5= 6671 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56671 ] Comfy-Org--Comfy=
UI ComfyUI is a modular diffusion model GUI, API, and backend with a graph-= and-node interface. Prior to 0.28.0, folder_paths.get_annotated_filepath an=
d exists_annotated_filepath join workflow-controlled annotated filenames to=
a base directory without a containment check, allowing an unauthenticated = crafted POST /prompt workflow using LoadImage or sibling nodes to probe arb= itrary host paths and exfiltrate image-format files through /view. LoadImag=
e defines a VALIDATE_INPUTS method, which causes the execution engine to sk=
ip COMBO (input-directory) validation. Affected nodes include LoadImage, Lo= adImageMask, LoadImageOutput, LoadAudio, LoadLatent, LoadVideo, and Load3D.=
This issue is fixed in version 0.28.0. 2026-07-31 7.5 CVE-2026-56673 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-56673 ] copier-org--copier Copier =
is a library and CLI app for rendering project templates. From 9.5.0 throug=
h 9.16.0, percent-encoded parent-directory segments or encoded path separat= ors in a template URL can match a configured trusted repository prefix befo=
re an HTTP server or Git transport decodes the path, allowing unsafe templa=
te features from a repository outside the trusted prefix to run after user = interaction. This issue is fixed in version 9.17.0. 2026-07-31 7.5 CVE-2026= -62999 [ https://www.cve.org/CVERecord?id=3DCVE-2026-62999 ] coturn--coturn=
Coturn is a free open source implementation of TURN and STUN Server. Prior=
to 4.15.0, a server using --mobility authenticates a resumed REFRESH reque=
st with the resuming user's credentials but does not verify that identity a= gainst the original allocation owner, allowing an authenticated attacker wh=
o obtains a victim MOBILITY-TICKET to receive and inject relayed traffic an=
d consume the victim's quota. In the handle_turn_refresh resume branch, the=
victim allocation (orig_ss) is located solely by the attacker-controlled m= obile id, and credentials are only adopted (via copy_auth_parameters) when = the resuming session is unauthenticated. Because the attacker's session alr= eady has hmackey_set set to 1 from its own prior authentication (which is n= ever reset for long-term-credential sessions), the credential copy is skipp=
ed and check_stun_auth validates the REFRESH against the attacker's own ide= ntity rather than the allocation owner's. This issue is fixed in version 4.= 15.0. 2026-07-31 7.1 CVE-2026-65981 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-65981 ] Cozmoslabs--Paid Member Subscriptions Subscriber Insecure Di= rect Object References (IDOR) in Paid Member Subscriptions <=3D 3.0.7 versi= ons. 2026-07-27 7.5 CVE-2026-59539 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-59539 ] cozyvision1--SMS Alert SMS & OTP for WooCommerce, Order Notif= ications & Abandoned Cart Recovery The SMS Alert - SMS & OTP for WooCommerc=
e, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vu= lnerable to Authentication Bypass leading to Account Takeover in all versio=
ns up to, and including, 3.9.7 via the `billing_phone` parameter. This is d=
ue to the `processRegistration()` function using a phone-unbound `$_SESSION= ['sa_mobile_verified']` boolean flag as the sole gate before issuing an aut= hentication cookie - the flag is set to `true` after any successful OTP val= idation without being bound to the specific phone number that was verified.=
This makes it possible for unauthenticated attackers to complete OTP verif= ication for a phone number they control, then resubmit the registration req= uest with a victim's `billing_phone` value to have `wp_set_auth_cookie()` c= alled for the resolved victim account, enabling full authentication as any = existing WordPress user whose registered phone number is known or guessable=
, including administrators. 2026-07-28 9.8 CVE-2026-15014 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-15014 ] Cribl--Cribl Stream Improper control o=
f generation of code in the JSON Pointer-to-accessor compiler in Cribl Stre=
am before 4.18.2 allows a remote authenticated attacker with edit privilege=
s to execute arbitrary JavaScript on the server via a crafted database conn= ection identifier or pack configuration value. 2026-07-27 8.8 CVE-2026-5674=
7 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56747 ] Cribl--Cribl Stream=
Improper validation of symbolic links in the Pack Git import feature in Cr= ibl Stream before 4.18.2 allows a remote authenticated attacker with Pack i= mport and pipeline preview permissions to execute arbitrary code as the Cri=
bl server process via a crafted Git repository containing a symbolic link i=
n the pack's functions directory. 2026-07-27 8.8 CVE-2026-56748 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-56748 ] cubewp1211--CubeWP Framework The=
CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal=
in all versions up to, and including, 1.1.30 via the 'cubewp_get_svg_conte= nt' function. This makes it possible for unauthenticated attackers to read = the contents of arbitrary files on the server, which can contain sensitive = information. This is exploitable by unauthenticated attackers because the r= equired nonce is publicly emitted into the markup of any page rendering the=
CubeWP posts shortcode or widget with AJAX loading enabled, making it harv= estable by any guest visitor before submitting the AJAX request. 2026-08-01=
7.5 CVE-2026-13339 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13339 ] D= assault Systmes--Station Launcher App in 3DEXPERIENCE platform A Deserializ= ation of Untrusted Data vulnerability affecting Station Launcher App in 3DE= XPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPER= IENCE R2026x could lead to an unauthenticated remote code execution. 2026-0= 7-28 10 CVE-2026-11756 [ https://www.cve.org/CVERecord?id=3DCVE-2026-11756 =
] DaveGamble--cJSON cJSON through 1.7.19 is vulnerable to uncontrolled recu= rsion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is = applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensiti= ve(). A patch containing add and copy operations grafts duplicated subtrees=
to amplify document depth beyond the parser's nesting limit: cJSON_Delete(=
) recurses with no depth bound, and the cJSON_Duplicate() guard CJSON_CIRCU= LAR_LIMIT is set to 10000, ten times the parser's 1000-level nesting limit = and high enough to overflow a default thread stack. An attacker who can sup= ply the patch document can crash the process, resulting in denial of servic=
e. 2026-07-29 7.5 CVE-2026-67215 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-67215 ] delvedor--find-my-way find-my-way is a framework-independent HT=
TP router that internally uses a Radix Tree and supports route parameters a=
nd wildcards. Versions prior to 9.7.0 are vulnerable to remotely triggerabl=
e DoS in find-my-way when it is used with Node's HTTP/2 server. The lookup(=
) function passes req.method into find(), and find() indexes this.trees[met= hod]. Since this.trees is a normal object, HTTP/2 method values like constr= uctor, toString, or __proto__ can resolve inherited object properties inste=
ad of returning undefined. The code then treats that value like a router no=
de and crashes when it reaches currentNode.prefix.length. This issue has be=
en fixed in version 9.0.7. 2026-07-28 7.5 CVE-2026-47219 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-47219 ] deveasel--Demi One Click Demo Import, B= ackup & Site Migration The Demi - One Click Demo Import, WP Backup & Site M= igration plugin for WordPress is vulnerable to Arbitrary Directory Deletion=
in all versions up to, and including, 0.0.7. The vulnerability exists beca= use the plugin stores its HMAC signing key and per-step restore token as do= tfiles inside a publicly accessible subdirectory of the WordPress uploads f= older - without any `.htaccess` or index file protection - and the `demi_re= store_step` AJAX handler, registered for unauthenticated callers, explicitl=
y accepts possession of the on-disk signing key as a standalone alternative=
to WordPress capability and nonce checks; an unauthenticated attacker who = retrieves the exposed key can forge a valid signed state envelope to invoke=
`CleanDir::execute()` with a caller-supplied absolute path that is subject=
to no allow-list or path-canonicalization check. This makes it possible fo=
r unauthenticated attackers to recursively delete arbitrary directories on = the server. 2026-07-28 7.5 CVE-2026-14490 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-14490 ] dfir-iris--iris-web The IRIS web application in versio=
n 2.4.26 and possibly others is vulnerable to stored cross-site scripting (= XSS) in the assets function. 2026-07-30 7.6 CVE-2026-16969 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-16969 ] dfir-iris--iris-web The IRIS web appl= ication in version 2.4.26 and possibly others is vulnerable to stored cross= -site scripting (XSS) in the custom attributes function. 2026-07-30 7.6 CVE= -2026-18360 [ https://www.cve.org/CVERecord?id=3DCVE-2026-18360 ] dfir-iris= --iris-web The IRIS web application in version 2.4.26 and possibly others i=
s vulnerable to stored cross-site scripting (XSS) in the datastore upload f= unction. 2026-07-30 7.6 CVE-2026-18361 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-18361 ] dromara--MaxKey MaxKey through 4.1.12, fixed in commit = ddbb72f, contains an insufficient redirect URI validation vulnerability in = DefaultRedirectResolver.hostMatches() that allows remote attackers to hijac=
k OAuth 2.0 authorization codes by supplying a crafted redirect_uri whose h= ostname suffix matches a registered URI without proper dot-boundary anchori= ng. Attackers who control a domain ending with the registered redirect URI = hostname can social-engineer victims into clicking a crafted authorization = URL, causing the authorization code to be issued to the attacker-controlled=
URI and exchanged for an access token granting access to the victim's iden= tity. 2026-07-30 8.1 CVE-2026-67345 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-67345 ] duracelltomi--GTM4WP A Google Tag Manager (GTM) plugin for W= ordPress The GTM4WP - A Google Tag Manager (GTM) plugin for WordPress plugi=
n for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerc=
e Billing Fields in all versions up to, and including, 1.22.3 due to insuff= icient input sanitization and output escaping. This makes it possible for u= nauthenticated attackers to inject arbitrary web scripts in pages that will=
execute whenever a user accesses an injected page. This requires the GTM4W=
P WooCommerce order data integration option (GTM4WP_OPTION_INTEGRATE_WCORDE= RDATA) to be enabled, and is exploited by placing a guest checkout order wi=
th a JavaScript payload in a WooCommerce billing field such as the billing = first name. 2026-07-29 7.2 CVE-2026-16597 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-16597 ] e107inc--e107 e107 prior to version 2.3.8 contains a c= ode execution vulnerability in the e_array deserialization handler that all= ows an attacker with out-of-band database write access to execute arbitrary=
PHP code by storing a crafted payload in the user_prefs column. The e_arra= y::unserialize() function in e107_handlers/core_functions.php performs only=
a prefix check for the string 'array' before passing the stored value to e= val(), causing automatic PHP execution whenever the affected user's prefere= nces are materialized through e_user_pref::load(). 2026-07-30 7.5 CVE-2026-= 57859 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57859 ] Eaton--PADM Imp= roper input validation in the authentication component of=C2=A0Eaton's Trip=
p Lite series=C2=A0PADM firmware could allow an unauthenticated remote atta= cker to bypass authentication and gain a privileged user access to the devi= ce. 2026-07-30 8.6 CVE-2026-22620 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-22620 ] Eaton--PADM Improper input validation in one of the session ma= nagement interface of Eaton's Tripp Lite Series=C2=A0PADM firmware could al= low an authenticated administrator to execute arbitrary commands within a r= estricted environment. 2026-07-30 8.3 CVE-2026-22621 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-22621 ] Eaton--PADM Improper input validation in on=
e of the session management interface of Eaton's Tripp Lite series PADM fir= mware could allow an authenticated user to elevate privileges resulting in = unrestricted access to the device. 2026-07-30 8.8 CVE-2026-22622 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-22622 ] eazyplugins--Eazy Plugin Manage=
r Powerful Plugin Management Solution for WordPress The Eazy Plugin Manager=
- Powerful Plugin Management Solution for WordPress plugin for WordPress i=
s vulnerable to Privilege Escalation in all versions up to, and including, = 4.4.1. This is due to insufficient authorization on the `wp_ajax_pos_get_op= tion` AJAX handler, which verifies only a nonce that is localized to every = logged-in admin-area user via `admin_enqueue_scripts` - without any capabil= ity check - before returning the value of any arbitrary WordPress option vi=
a `get_option()`, combined with the `admin_login_endpoint_handler` REST end= point (`GET /wp-json/epm/v1/admin/login`) being registered as publicly acce= ssible and authenticating callers solely by a whirlpool hash of values stor=
ed in those same options. This makes it possible for authenticated attacker=
s, with Subscriber-level access and above, to read the `site_url`, `connect= ion_key`, and `remote_user_id` values stored in the `eazywp_connecting_info=
` and `eazywp_connection` options, compute the required `auth_key`, call th=
e `admin/login` REST endpoint to obtain Administrator authentication cookie=
s, and fully take over the site. Exploitation requires the plugin's remote = connection feature to have been configured, as the `eazywp_connecting_info`=
and `eazywp_connection` options must be populated with valid credentials. = 2026-07-28 8.8 CVE-2026-14328 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -14328 ] epsiloncool--WP Fast Total Search The Power of Indexed Search The =
WP Fast Total Search - The Power of Indexed Search plugin for WordPress is = vulnerable to generic SQL Injection via the 'form_data[s]' parameter in all=
versions up to, and including, 1.80.280 due to insufficient escaping on th=
e user supplied parameter and lack of sufficient preparation on the existin=
g SQL query. This makes it possible for unauthenticated attackers to append=
additional SQL queries into already existing queries that can be used to e= xtract sensitive information from the database. 2026-07-28 7.5 CVE-2026-127=
41 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12741 ] fast-uri--fast-uri=
fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward = slash to recognize a URI authority, so a reference that uses a backslash ba= sed introducer in place of it (backslash backslash, forward slash backslash=
, or backslash forward slash) is parsed with no authority and folds into th=
e path. Node's native WHATWG URL parser instead treats a backslash as inter= changeable with a forward slash for special schemes, so the two parsers ext= ract different hosts from the same input. Applications that use fast-uri to=
enforce host based policy such as allowlists, SSRF filtering, or redirect = validation before passing the same URL into Node's URL or fetch consumers c=
an be steered to an unintended host. Upgrade to fast-uri 4.1.2, 3.1.5, or 2= .4.4. 2026-07-31 7.5 CVE-2026-18446 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-18446 ] fleekdash--FleekDash V2 The FleekDash V2 plugin for WordPres=
s is vulnerable to authorization bypass in all versions up to, and includin=
g, 2.6.2.2. This is due to the plugin not properly verifying that a user is=
authorized to perform an action. This makes it possible for authenticated = attackers, with subscriber-level access and above, to overwrite the email a= ddress and password of any WordPress user, including administrators, enabli=
ng full account takeover and complete site compromise. The public /wp-json/= fleekdash/v1/register endpoint auto-provisions a Subscriber-role account an=
d returns a valid REST nonce regardless of the site's users_can_register se= tting, enabling unauthenticated attackers to self-provision the required cr= edentials and nonce in a single prior request. 2026-07-30 8.8 CVE-2026-1435=
6 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14356 ] flytohub--flyto-cor=
e Flyto2 Core is an execution kernel for automation and AI-agent workflows.=
Prior to 2.26.6, image.download and related file-writing modules use calle= r-controlled output_dir instead of validate_path_with_env_config and its FL= YTO_SANDBOX_DIR confinement, allowing attacker-controlled response bytes to=
be written to arbitrary filesystem paths the process can access. This issu=
e is fixed in version 2.26.6. 2026-07-29 10 CVE-2026-67429 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-67429 ] flytohub--flyto-core Flyto2 Core is a=
n execution kernel for automation and AI-agent workflows. Prior to 2.26.7, = the standalone flyto-verification service in src/core/verification_service.=
py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-suppli=
ed callback_url for an outbound POST with X-Internal-Key: $FLYTO_RUNNER_SEC= RET while bypassing target_allowed, allowing unauthenticated SSRF and runne=
r secret exfiltration. This issue is fixed in version 2.26.7. 2026-07-29 9.=
3 CVE-2026-67426 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67426 ] flyt= ohub--flyto-core Flyto2 Core is an execution kernel for automation and AI-a= gent workflows. Prior to 2.26.7, the HTTP modules http.get, http.request, a=
nd http.batch in src/core/modules/atomic/http/get.py, src/core/modules/atom= ic/http/request.py, and src/core/modules/atomic/http/batch.py validate only=
the initial URL, then follow redirects with allow_redirects=3DTrue and wit= hout per-hop Location revalidation, allowing a public URL to redirect into = internal address space and return the internal response body. This issue is=
fixed in version 2.26.7. 2026-07-29 8.5 CVE-2026-67424 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-67424 ] flytohub--flyto-core Flyto2 Core is an e= xecution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm= .chat reads provider keys such as OPENAI_API_KEY and ANTHROPIC_API_KEY from=
the environment and sends them in the Authorization: Bearer header to call= er-controlled base_url, allowing an attacker to receive the operator's key =
on a public host that passes the SSRF guard. This issue is fixed in version=
2.26.6. 2026-07-29 8.6 CVE-2026-67425 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-67425 ] flytohub--flyto-core Flyto2 Core is an execution kernel=
for automation and AI-agent workflows. Prior to 2.26.6, the workflow engin=
e variable resolver expands ${env.VAR} for any host environment variable wi= thout an allowlist or capability policy check, allowing a workflow paramete=
r to bypass the default capability policy denylist for env.get and env.load= _dotenv and exfiltrate secrets through allowed modules. This issue is fixed=
in version 2.26.6. 2026-07-29 8.6 CVE-2026-67427 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-67427 ] flytohub--flyto-core Flyto2 Core is an executi=
on kernel for automation and AI-agent workflows. Prior to 2.26.7, HTTP-emit= ting modules including src/core/modules/third_party/developer/http/requests= .py, core.api.http_get, core.api.http_post, graphql.query, graphql.mutation=
, monitor.http_check, communication.slack_send, notification.discord.send_m= essage, notification.slack.send_message, notification.teams.send_message, a= i.vision_analyze, verify.visual_diff, browser.proxy_rotate, and the agent a=
nd llm inline base_url branch fetch caller-controlled URLs without validate= _url_with_env_config, allowing SSRF to internal or metadata endpoints. This=
issue is fixed in version 2.26.7. 2026-07-29 8.5 CVE-2026-67428 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-67428 ] FreeRDP--FreeRDP FreeRDP before=
3.29.0 (affected versions <=3D 3.28.0) contains multiple TLS certificate i= dentity validation weaknesses in tls_verify_certificate(), tls_match_hostna= me(), and x509_utils_get_dns_names(). Because FreeRDP performs custom Commo=
n Name and DNS SAN string matching instead of using OpenSSL's length-aware = identity validation APIs, it (1) truncates DNS SAN values at embedded NUL b= ytes (accepting e.g. 'victim.example .attacker.example' as 'victim.example'=
), (2) accepts a matching Common Name even when non-matching DNS SAN entrie=
s are present, and (3) accepts IP-literal targets via DNS/CN matching witho=
ut comparing iPAddress SANs. Under a trusted or misissued certificate chain=
, an attacker positioned to present such a certificate can bypass server id= entity verification, weakening TLS server authentication. 2026-08-01 9.8 CV= E-2026-66402 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66402 ] FreeRDP-= -FreeRDP FreeRDP before 3.29.0 (affected versions <=3D 3.28.0) does not val= idate CRLF and control characters in the server-controlled RDP redirection = TargetNetAddress field. This value is copied into the client's ServerHostna=
me and, when the client connects through an HTTP proxy, is written directly=
into the proxy CONNECT request line and Host header by http_proxy_connect(=
) without filtering. A malicious or compromised RDP server can send a craft=
ed redirection PDU containing embedded control characters to inject arbitra=
ry headers/requests into the HTTP proxy CONNECT request. 2026-08-01 9.8 CVE= -2026-67289 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67289 ] FreeRDP--= FreeRDP FreeRDP before 3.30.0 (<=3D 3.29.0) contains a heap-based buffer ov= erflow in the Windows clipboard client's CliprdrStream_Read function (clien= t/Windows/wf_cliprdr.c). When an OLE paste consumer (e.g. explorer.exe) cal=
ls IStream::Read with a fixed-size buffer of cb bytes, CliprdrStream_Read r= equests file contents from the RDP server and then copies the response into=
the caller's buffer using the server-supplied length (req_fsize) instead o=
f cb. A malicious or compromised RDP server can return an oversized CB_FILE= CONTENTS_RESPONSE, causing an out-of-bounds write of attacker-controlled da=
ta into the paste consumer's heap buffer when a user pastes server-offered = clipboard file contents. 2026-08-02 9.6 CVE-2026-68579 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-68579 ] FreeRDP--FreeRDP FreeRDP before 3.29.0 co= ntains a null pointer dereference vulnerability in smartcard cache request = decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCA= CHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is en= abled, attackers can send crafted smartcard cache requests with NULL lookup= -name pointers to trigger strlen() on a null pointer, causing client proces=
s termination. 2026-08-01 7.5 CVE-2026-67288 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-67288 ] FreeRDP--FreeRDP FreeRDP before 3.29.0 contains a h= eap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsin=
g AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers ca=
n send malformed media format data from a server to trigger a crash by read= ing fixed offsets without validating source buffer length. 2026-08-01 7.5 C= VE-2026-67290 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67290 ] FreeRDP= --FreeRDP FreeRDP before 3.29.0 (affected versions <=3D 3.28.0) contains a = heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fra= gment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD=
update, the code reads a one-byte server-controlled declared fragment size=
but does not verify it fits within the remaining received buffer before al= locating and copying that many bytes. A malicious RDP server can send a sho=
rt fragment with an oversized declared size, causing the client to read bey= ond the allocated buffer, resulting in an out-of-bounds read and client cra= sh. 2026-08-01 7.5 CVE-2026-67291 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-67291 ] FreeRDP--FreeRDP FreeRDP before 3.29.0 contains a denial of se= rvice vulnerability in the RDPEI server channel handler that fails to valid= ate maximum PDU body length before stream allocation. A malicious RDP clien=
t can send a header-only RDPEI message with a large declared body length to=
force excessive memory allocation on the server. 2026-08-01 7.5 CVE-2026-6= 7296 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67296 ] FreeRDP--FreeRDP=
FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when proces= sing Transfer-Encoding: chunked HTTP responses in http_response_recv_body()=
. Attackers controlling a malicious RD Gateway endpoint can send oversized = chunked response bodies to exhaust client memory resources without triggeri=
ng the configured size limit. 2026-08-01 7.5 CVE-2026-67297 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-67297 ] FreeRDP--FreeRDP FreeRDP versions 3.= 28.0 and earlier contain a heap buffer overflow in the server-side RAIL cha= nnel handler (rail_server_handle_messages() in channels/rail/server/rail_ma= in.c). When processing a RAIL PDU header, the code subtracts RAIL_PDU_HEADE= R_LENGTH from the peer-controlled orderLength field without first verifying=
orderLength is at least the header length. For orderLength values 0..3 thi=
s causes an unsigned integer underflow to a very large size, which bypasses=
the Stream_EnsureRemainingCapacity() capacity check (due to pointer arithm= etic wraparound) and is then passed to WTSVirtualChannelRead(), resulting i=
n an out-of-bounds heap write. A malicious or compromised RDP client can ex= ploit this to corrupt the heap and crash the server. Fixed in FreeRDP 3.29.=
0. 2026-08-01 7.5 CVE-2026-67298 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-67298 ] FreeRDP--FreeRDP FreeRDP before 3.29.0 contains a client-side h= eap use-after-free in the async update message proxy for WINDOW_ICON_ORDER = when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_messag= e_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam= ->iconInfo with the parser-owned windowIcon->iconInfo pointer. After the pa= rser callback returns, update_recv_window_info_order() frees window_icon.ic= onInfo, but the queued async message still retains and later dispatches tha=
t stale pointer. A malicious or compromised RDP server sending a crafted RA=
IL Window Alternate Secondary Order with WINDOW_ORDER_ICON can trigger use-= after-free, leading to memory corruption and client crash. 2026-08-01 7.5 C= VE-2026-67299 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67299 ] FreeRDP= --FreeRDP FreeRDP before 3.29.0 contains client-side heap use-after-free vu= lnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER=
and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious =
or compromised RDP server sends crafted update orders, the message proxy sh= allow-copies structures containing nested parser-owned pointers (e.g., titl= eInfo.string, windowRects, visibilityRects, icon buffers). The parser frees=
those nested buffers after the callback returns, so the queued async messa=
ge later dispatches stale pointers, potentially causing memory corruption o=
r a client crash. 2026-08-01 7.5 CVE-2026-67300 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-67300 ] FreeRDP--FreeRDP FreeRDP before 3.29.0 contains = out-of-bounds read vulnerabilities in the async update message proxy for th=
e PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabl=
ed (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_me= ssage_PolygonCB() allocate a fresh points array but copy point data from th=
e address of the order structure instead of from polygonSC->points / polygo= nCB->points, resulting in a client-side out-of-bounds read. A malicious or = compromised RDP server sending crafted PolygonSC/PolygonCB update orders ca=
n trigger memory disclosure or a client crash. 2026-08-01 7.5 CVE-2026-6730=
1 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67301 ] FreeRDP--FreeRDP Fr= eeRDP before 3.29.0 contains a null pointer dereference vulnerability in sm= artcard device control request cleanup when reader-state decoding fails. At= tackers can send malformed smartcard IRP requests with non-zero cReaders an=
d truncated reader-state data to crash the process via null pointer access =
in free_reader_states functions. 2026-08-01 7.5 CVE-2026-67304 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-67304 ] FreeRDP--FreeRDP FreeRDP before 3= .29.0 contains integer overflow vulnerabilities in the audio input redirect= ion channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that = fail to validate the FramesPerPacket parameter from RDP servers. Attackers = can supply a malicious FramesPerPacket value causing allocation size wrapar= ound, resulting in heap-based buffer overflow on ALSA or denial of service =
on all platforms. 2026-08-02 7.5 CVE-2026-68580 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-68580 ] FTC Software IT Services--FTC E-Commerce Managem= ent Panel Missing authentication for critical function vulnerability in FTC=
Software IT Services FTC E-Commerce Management Panel allows Authentication=
Bypass. This issue affects FTC E-Commerce Management Panel: before 1.0.2. = 2026-07-30 8.2 CVE-2026-12722 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -12722 ] GeneralSandman--TinyWeb TinyWeb through 0.0.8 contains a memory le=
ak vulnerability that allows unauthenticated attackers to exhaust available=
memory by sending ordinary well-formed HTTP requests. Each request causes = HttpParser::execute() to allocate Url objects, HttpHeaders objects, and Htt= pHeader instances via raw new expressions that are never freed due to missi=
ng destructors and unreachable delete calls, causing worker resident memory=
to grow monotonically by approximately 20 to 28 kB per request until the w= orker process is killed. 2026-07-28 7.5 CVE-2026-67183 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-67183 ] GeneralSandman--TinyWeb TinyWeb through 0= .0.8 contains a null pointer dereference vulnerability that allows unauthen= ticated remote attackers to crash worker processes by sending a malformed H= TTP request line with an invalid version string. The HttpParser::execute() = function fails to allocate the Url object when version parsing fails, leavi=
ng the url pointer NULL, and buildResponse() subsequently dereferences this=
NULL pointer without checking the valid_requ flag, producing a SIGSEGV tha=
t terminates the worker process and, when repeated across all workers, take=
s the server permanently offline until manually restarted. 2026-07-28 7.5 C= VE-2026-67184 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67184 ] General= Sandman--TinyWeb TinyWeb through 0.0.8 contains a path traversal vulnerabil= ity that allows unauthenticated attackers to read arbitrary files by submit= ting ../ sequences in the URL path, which are concatenated directly to the = configured web root in HttpBuilder::buildResponse() without normalization, = dot-segment removal, or boundary checks. Attackers can craft a single reque=
st with ../ sequences that pass through the URL parser unchanged and reach = the filesystem call via HttpFile::setFile(), exposing sensitive files such =
as credential stores and private keys when the server process runs as root.=
2026-07-28 7.5 CVE-2026-67185 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-67185 ] github--github-mcp-server GitHub MCP Server is GitHub's official = MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/s= erver.go accesses params.Ref without first checking whether it is nil, so a=
completion/complete request with a missing or empty ref field triggers a n=
il pointer dereference and a Go runtime panic; because the crash occurs bef= ore any authentication or token validation, any unauthenticated client able=
to send JSON-RPC messages can crash the server, resulting in a complete de= nial of service. This issue is fixed in version 1.1.0. 2026-07-28 7.5 CVE-2= 026-47427 [ https://www.cve.org/CVERecord?id=3DCVE-2026-47427 ] GitLab--Git= Lab GitLab has remediated an issue in GitLab CE/EE affecting all versions f= rom 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that und=
er certain conditions could have allowed an authenticated user to modify CI= /CD configuration belonging to another user due to improper validation of u= ser-supplied attributes when processing pipeline schedule inputs. 2026-07-2=
9 8.4 CVE-2026-12436 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12436 ] = GitLab--GitLab GitLab has remediated an issue in GitLab CE/EE affecting all=
versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19= .2.1 that under certain conditions could have allowed an authenticated user=
with Developer role to access unauthorized information due to insufficient=
access controls on internal request handling. 2026-07-29 8.5 CVE-2026-6267=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-6267 ] GitLab--GitLab GitLab=
has remediated an issue in GitLab CE/EE affecting all versions from 11.8 b= efore 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain=
conditions could have allowed an unauthenticated user to cause a denial of=
service due to insufficient resource throttling when processing merge requ= est discussions. 2026-07-29 7.5 CVE-2026-15975 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-15975 ] gitpython-developers--GitPython GitPython 3.1.50 = fails to recognize joined short-option forms such as -u<value> (the short f= orm of --upload-pack=3D<value>) when enforcing its default unsafe-option ga= te. When an application passes attacker-influenced clone options into Repo.= clone_from(..., multi_options=3D..., allow_unsafe_options=3DFalse), an atta= cker can supply -u<helper> to bypass the gate that blocks --upload-pack/-u,=
causing Git to execute the specified helper command during clone. Fixed in=
3.1.51. 2026-08-01 9.8 CVE-2026-67324 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-67324 ] gitpython-developers--GitPython GitPython before 3.1.51=
fails to guard against dangerous Git options passed as keyword arguments i=
n Repo.archive() and git.ls_remote(), allowing command injection via option=
s such as --exec/--upload-pack (leading to arbitrary command execution). Ad= ditionally, Repo.iter_commits() and Repo.blame() do not check for leading-d= ash revision arguments, so a revision like --output=3D<path> can cause Git =
to open and truncate an arbitrary file. Exploitation requires an applicatio=
n that passes attacker-controlled arguments to these methods. 2026-08-01 8.=
4 CVE-2026-67323 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67323 ] gitp= ython-developers--GitPython GitPython before 3.1.51 contains an incomplete = command injection blocklist that fails to account for git's long-option pre= fix abbreviation feature. Attackers can bypass the unsafe options guard by = using abbreviated option names like upload_p instead of upload_pack, which = git resolves to dangerous options and executes arbitrary commands. 2026-08-=
01 8.8 CVE-2026-67325 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67325 ]=
gitpython-developers--GitPython GitPython before 3.1.52 is vulnerable to e= nvironment-variable exfiltration in Repo.clone_from(). The caller-supplied = remote URL is passed through Git.polish_url(), which on non-Cygwin platform=
s calls os.path.expandvars() on the URL before invoking git clone. An attac= ker who controls the clone URL can embed $NAME or ${NAME} tokens that are e= xpanded to the values of the hosting process's environment variables (e.g.,=
AWS_SECRET_ACCESS_KEY or GITHUB_TOKEN). The resulting URL, now containing = the secret, is transmitted over the network to an attacker-controlled host = during the clone attempt, disclosing the secret. 2026-08-01 7.5 CVE-2026-67= 322 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67322 ] gitpython-develop= ers--GitPython GitPython before 3.1.50 fails to validate newline characters=
in the section parameter of config_writer(), allowing attackers to inject = arbitrary section headers into .git/config. Attackers can inject newlines t=
o create a forged [core] section with hooksPath pointing to attacker-contro= lled directories, achieving remote code execution when git hooks are trigge= red. 2026-08-01 7 CVE-2026-67326 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-67326 ] Gladinet--CentreStack CentreStack before 17.5 contains a hardco= ded cryptographic key vulnerability that allows unauthenticated attackers t=
o forge arbitrary encrypted tokens by exploiting a static SysNumber value u= sed as entropy for AccessTicket.Encrypt() and AccessTicket.Decrypt() across=
all installations. Attackers can use the hardcoded key to craft valid x-gl= ad-auth headers and call privileged API endpoints such as acquiretenantback= uptoken to obtain a domain administrator IdentityTicket, enabling a complet=
e unauthenticated remote code execution chain. 2026-07-30 9.1 CVE-2026-5436=
3 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54363 ] Gladinet--CentreSta=
ck CentreStack before 17.2 contains an authentication bypass vulnerability = that allows unauthenticated attackers to read, write, or delete arbitrary a= ccount settings by exploiting exposed API endpoints that lack authorization=
checks. Attackers can generate valid encrypted EntAcctId values using the = static shared encryption key to forge identifiers for any user GUID, includ= ing the system-wide cluster settings account, enabling enumeration of hoste=
d tenant domains and administrator identities. 2026-07-30 8.6 CVE-2026-5436=
7 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54367 ] Gladinet--CentreSta=
ck CentreStack before 17.4 contains a SQL injection vulnerability in GladDB= Files.SearchEx() and SearchExUnder() that allows authenticated attackers to=
execute arbitrary SQL statements by supplying a crafted x-glad-filter requ= est header through the jsondir API endpoint. Attackers can exploit unsaniti= zed interpolation of the Field parameter directly into SQL query strings to=
write arbitrary files to the server filesystem via PostgreSQL lo_from_byte= a() and lo_export() functions, enabling remote code execution. 2026-07-30 8=
.8 CVE-2026-54368 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54368 ] Gla= dinet--CentreStack CentreStack before 17.3 contains an unauthenticated dese= rialization vulnerability in GSNamespace.dll that allows unauthenticated at= tackers to create arbitrary local OS user accounts by supplying a crafted b= ase64-encoded XML string to exposed API endpoints. Attackers can send a mal= icious StorageConfigure parameter to the jsonimportuserbyupn, jsonimportuse= rbyupnex, or japiimportuserbyupn endpoints to trigger InternalImportAdUserB= yUPN(), causing GladinetCloudMonitor.exe to invoke the NetUserAdd Windows A=
PI with attacker-controlled credentials and create arbitrary directories on=
the server filesystem. 2026-07-30 7.5 CVE-2026-54365 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-54365 ] Gladinet--CentreStack CentreStack before 1= 7.4 contains an XML external entity (XXE) injection vulnerability that allo=
ws unauthenticated attackers to exfiltrate arbitrary files by supplying a m= alicious URL to the SharePoint storage configuration handler. Attackers can=
send a crafted request to the unauthenticated StorageConfig endpoint causi=
ng the server to fetch and parse attacker-controlled XML containing externa=
l DTD references, resulting in out-of-band file exfiltration of sensitive f= iles such as Web.config, which may contain database credentials and cryptog= raphic key material. 2026-07-30 7.5 CVE-2026-54366 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-54366 ] gm_alex--User Access Manager The User Access = Manager plugin for WordPress is vulnerable to Directory Traversal in all ve= rsions up to, and including, 2.3.15 via the 'uamgetfile' parameter paramete=
r. This makes it possible for unauthenticated attackers to read the content=
s of arbitrary files on the server, which can contain sensitive information=
. This is possible because when attachment_url_to_postid() returns 0 for a = traversal path, the plugin falls back to the global post set by a valid ?at= tachment_id parameter supplied by the attacker, causing the access check to=
pass against a legitimate public attachment while the file streamed is the=
attacker-chosen path. 2026-08-01 7.5 CVE-2026-18352 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-18352 ] GNOME--GIMP A flaw was found in the file-fi=
ts plugin in GIMP. When processing a FITS image file, the plugin calculates=
memory allocation sizes using signed 32-bit integers for width and height.=
If a crafted file sets both values to large values, their product exceeds = 2^31 and overflows, resulting in an undersized heap-based buffer allocation=
. This integer overflow issue results in a heap-based buffer overflow when = cfitsio subsequently writes a full row of pixels in the buffer, causing mem= ory corruption, potentially leading to arbitrary code execution or a denial=
of service. 2026-07-27 7.8 CVE-2026-66758 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-66758 ] GNOME--GIMP A flaw was found in the file-icns plugin =
in GIMP. When applying a decompressed mask during ICNS image processing, th=
e plugin reads from the mask data buffer without verifying if the cursor ex= ceeds the allocated resource size. If a crafted file contains a truncated m= ask resource, the icns_decompress function continues reading past the bound=
s of the buffer. This out-of-bounds read vulnerability results in informati=
on disclosure of heap contents, where memory contents are leaked as alpha c= hannel pixel values, or a crash leading to a denial of service if unmapped = memory is accessed. 2026-07-27 7.1 CVE-2026-66759 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-66759 ] GNOME--gnome-remote-desktop A flaw was found i=
n gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the dae= mon is running in system mode with RDP enabled, the incoming connection han= dler bypasses the connection throttler, allowing an unauthenticated remote = attacker to open many parallel pre-authentication connections to the RDP li= stener. This can accumulate accepted sockets and pending routing-token oper= ations until timeout, exhausting resources and preventing legitimate users = from establishing RDP sessions. This issue does not affect the upstream ver= sion. 2026-07-31 7.5 CVE-2026-18358 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-18358 ] go-vikunja--vikunja Vikunja versions 0.22.0 through 2.3.0 fa=
il to validate the principal type in API token management. Because user IDs=
and link-share IDs are independent numeric sequences and both resolve thro= ugh a generic web.Auth.GetID() interface, a link-share JWT whose numeric ID=
equals a target user's ID is treated as that user by the /api/v1/tokens en= dpoints. An authenticated attacker can obtain a target's numeric user ID vi=
a authenticated user search, then create link shares on an attacker-writabl=
e project until the link-share sequence reaches that value, and use the res= ulting link-share JWT to list, create, and delete the target user's API tok= ens (including issuing a new token with attacker-chosen scopes under the ta= rget's permissions). Fixed in version 2.4.0. 2026-08-02 8.1 CVE-2026-68581 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-68581 ] goshs-labs--goshs gos=
hs is a feature-rich single-binary file server for red teamers and develope= rs. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler u= sed Username !=3D "" && Password !=3D "", so running goshs with -b 'admin:'=
-sftp and no -fkf left both SFTP authentication handlers unset and allowed=
unauthenticated file access. This issue is fixed in version 2.1.4. 2026-07= -28 9.1 CVE-2026-62325 [ https://www.cve.org/CVERecord?id=3DCVE-2026-62325 =
] goshs-labs--goshs goshs is a feature-rich single-binary file server for r=
ed teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard=
handled WebDAV MOVE as a write-only method and did not enforce --no-delete=
, allowing WebDAV clients to delete or overwrite files via MOVE with Overwr= ite: T. This issue is fixed in version 2.1.4. 2026-07-28 9.1 CVE-2026-64863=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-64863 ] goshs-labs--goshs go= shs is a feature-rich single-binary file server for red teamers and develop= ers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bul= k&file=3D ZIP downloads did not call findEffectiveACL or applyCustomAuth, a= llowing unauthenticated reads of files protected only by .goshs folder ACLs=
and block lists. This issue is fixed in version 2.1.1. This vulnerability = exists due to an incomplete fix for CVE-2026-40189. 2026-07-28 7.5 CVE-2026= -54719 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54719 ] gotd--td gotd/=
td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.Unencr= yptedMessage.Decode in proto/unencrypted_message.go read attacker controlle=
d dataLen from an unauthenticated MTProto unencrypted packet and allocated = make([]byte, dataLen) before checking the remaining buffer, allowing remote=
unauthenticated denial of service through excessive memory allocation and = CPU or garbage collection pressure. This issue is fixed in version 0.145.1.=
2026-07-28 7.5 CVE-2026-54638 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-54638 ] grisuno--LazyOwn LazyOwn RedTeam/APT Framework is an AI-powered C=
2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py = registers an unauthenticated Socket.IO input event handler that dispatches = data.get('value') to LazyOwnShell.one_cmd, reaching LazyOwnShell.do_cmd and=
subprocess.call(command, shell=3DTrue), allowing unauthenticated remote co=
de execution in the C2 process. This issue is fixed in 0.2.154. 2026-07-30 = 9.8 CVE-2026-68502 [ https://www.cve.org/CVERecord?id=3DCVE-2026-68502 ] gr= isuno--LazyOwn LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-te=
am operations framework. Prior to 0.2.154, LazyOwn ships default C2 credent= ials LazyOwn and LazyOwn in payload.json and core/payload_schema.py and pas= ses them unchanged to lazyc2.py HTTP Basic authentication, allowing any net= work-reachable attacker who knows the defaults to authenticate to the C2 da= shboard with operator-level access. This issue is fixed in 0.2.154. 2026-07= -30 9.8 CVE-2026-68503 [ https://www.cve.org/CVERecord?id=3DCVE-2026-68503 =
] HashiCorp--Tooling In consul-mcp-server, versions 0.1.0 up to 0.1.3 did n=
ot properly isolate session state in stateless mode, which may allow one cl= ient's Consul authentication token to be used for subsequent requests from = other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-s= erver 0.1.4. 2026-07-29 10 CVE-2026-16326 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-16326 ] HashiCorp--Tooling The terraform-mcp-server before ver= sion 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the st= reamable-HTTP stateless transport mode that may allow one user's Terraform = token to be used to execute tool calls on behalf of subsequent users. This = vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0. 2026= -07-28 10 CVE-2026-16498 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1649=
8 ] HashiCorp--Tooling The terraform-mcp-server before version 1.1.0 is vul= nerable to a server-side request forgery issue in the streamable-HTTP trans= port that may allow an unauthenticated remote client to redirect the server=
's Terraform API requests, and the server-side authorization token, to an a= ttacker-controlled endpoint. This vulnerability, CVE-2026-14869, is fixed i=
n terraform-mcp-server 1.1.0. 2026-07-28 8.6 CVE-2026-14869 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-14869 ] HashiCorp--Tooling In consul-mcp-ser= ver, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend add= ress was supplied, allowing a connected client to override the server's con= figured Consul address via a request header. This may allow a malicious cli= ent to redirect the server's Consul API traffic to an attacker-controlled e= ndpoint, potentially exfiltrating the Consul token configured on the server=
. This vulnerability, CVE-2026-16328, is fixed in consul-mcp-server 0.1.4. = 2026-07-29 8.6 CVE-2026-16328 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -16328 ] HashiCorp--Tooling The terraform-mcp-server before version 1.1.0 i=
s vulnerable to an authorization bypass in the streamable-HTTP stateful tra= nsport mode that may allow a user who obtains another user's MCP session ID=
to have their tool calls executed using that user's Terraform credentials.=
This vulnerability, CVE-2026-16496, is fixed in terraform-mcp-server 1.1.0=
. 2026-07-28 8.9 CVE-2026-16496 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-16496 ] Hikvision--DS-3WAP521-SI Some Hikvision Networking Products are = vulnerable to authenticated command execution due to insufficient input val= idation. Attackers with valid credentials can exploit this flaw by sending = crafted packets containing malicious commands to affected devices, leading =
to arbitrary command execution. 2026-07-31 7.2 CVE-2026-16843 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-16843 ] holest--Spreadsheet Price Changer = for WooCommerce and WP E-commerce Light The Spreadsheet Price Changer for W= ooCommerce and WP E-commerce - Light plugin for WordPress is vulnerable to = Missing Authorization in all versions up to, and including, 2.4.37 vi the u= ser_filter function. This makes it possible for unauthenticated attackers t=
o create admin accounts. 2026-07-29 9.8 CVE-2025-10656 [ https://www.cve.or= g/CVERecord?id=3DCVE-2025-10656 ] Hugging Face--sentence-transformers sente= nce-transformers contains a security control bypass vulnerability that allo=
ws attackers to achieve arbitrary code execution by exploiting a logic flaw=
in the import_module_class helper within sentence_transformers/util/misc.p=
y, where the guard condition includes an 'or os.path.exists(model_name_or_p= ath)' clause that satisfies the trust gate whenever the supplied path exist=
s on the local filesystem, regardless of the trust_remote_code=3DFalse argu= ment. Attackers who can control or influence the contents of a model direct= ory on disk can place malicious Python files such as modeling_*.py referenc=
ed via modules.json, causing the code to execute at import time when an app= lication loads the model with SentenceTransformer(path, trust_remote_code= =3DFalse), bypassing the documented security contract and achieving code ex= ecution within the loading process. 2026-07-31 9.8 CVE-2026-68770 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-68770 ] hypequery--hypequery Hypequery=
is a TypeScript semantic layer for ClickHouse. Prior to 2.0.2, escapeValue=
() in packages/clickhouse/src/core/utils.ts did not escape backslashes befo=
re single quotes during parameter substitution, allowing attacker controlle=
d query parameters with a trailing backslash to escape the closing quote an=
d inject arbitrary SQL. This issue is fixed in version 2.0.2. 2026-07-28 9.=
8 CVE-2026-54658 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54658 ] IBM-= -App Connect Enterprise IBM App Connect Enterprise 13.0.1.0 through 13.0.7.=
2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to travers=
e directories on the system. An attacker could send a specially crafted URL=
request containing "dot dot" sequences (/../) to write arbitrary files on = the system. 2026-07-30 9.8 CVE-2026-15435 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-15435 ] IBM--App Connect Enterprise IBM App Connect Enterprise=
13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a r= emote attacker to execute arbitrary commands due to improper neutralization=
of CRLF characters. 2026-07-30 8.8 CVE-2026-14522 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-14522 ] IBM--App Connect Enterprise IBM App Connect E= nterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores=
potentially sensitive information in log files that could be read by a loc=
al user. 2026-07-30 7.5 CVE-2026-12947 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-12947 ] IBM--App Connect Enterprise IBM App Connect Enterprise = 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a re= mote attacker to read arbitrary files due to a path traversal vulnerability=
. 2026-07-30 7.5 CVE-2026-14519 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-14519 ] IBM--Aspera Desktop App IBM Aspera Desktop App 1.0.5 through 1.0= .19 IBM Aspera for desktop can allow files to be written outside of the use= r's selected download destination. 2026-07-28 9.3 CVE-2026-14973 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-14973 ] IBM--Aspera Desktop App IBM Asp= era Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by = loading DLL files at start-up. 2026-07-30 7.3 CVE-2026-11980 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-11980 ] IBM--Aspera Faspex 5 IBM Aspera Fas= pex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to=
execute arbitrary code due to unquoted shell interpolation. 2026-07-28 9.1=
CVE-2026-14958 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14958 ] IBM--= Aspera Faspex 5 IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a re= mote authenticated attacker to execute arbitrary code due to shell command = injection. 2026-07-28 9.1 CVE-2026-14959 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-14959 ] IBM--Aspera Faspex 5 IBM Aspera Faspex 5 5.0.0 through = 5.0.15.4 has addressed a vulnerability related to session management. 2026-= 07-28 8.2 CVE-2026-14996 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1499=
6 ] IBM--Cloud Pak System IBM Cloud Pak System 2.3.5.0 could allow a local = attacker to obtain sensitive information due to the insertion of credential=
s into log files. 2026-07-28 7.5 CVE-2026-13463 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-13463 ] IBM--DataPower Gateway 10.6CD IBM DataPower Gate= way could allow a remote attacker to cause a denial of service due to impro= per resource limitations. 2026-07-30 7.5 CVE-2026-12733 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-12733 ] IBM--Db2 IBM Db2 11.5.0 through 11.5.9, = and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper=
db2flacc. 2026-07-30 8.4 CVE-2026-10535 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-10535 ] IBM--Engineering Requirements Management DOORS and DOOR=
S Web Access IBM Engineering Requirements Management DOORS and DOORS Web Ac= cess 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 do not limit th=
e length of a connection which could allow for a Slowloris HTTP denial of s= ervice attack to take place. This can cause the web server to become unresp= onsive. 2026-07-30 7.5 CVE-2024-25039 [ https://www.cve.org/CVERecord?id=3D= CVE-2024-25039 ] IBM--Enterprise Build of Quarkus IBM Enterprise Build of Q= uarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus RES=
T could allow a remote attacker to cause a denial of service due to unbound=
ed accumulation of multipart MIME part-header bytes. 2026-07-30 7.5 CVE-202= 6-16308 [ https://www.cve.org/CVERecord?id=3DCVE-2026-16308 ] IBM--HMC V10.= 3.1050.0 IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 = through 11.1.1112.0 Management systems in IBM Power environments (HMC and N= ovalink) could allow an unauthenticated user to execute arbitrary commands = with elevated privileges on the system due to improper validation of user s= upplied input. 2026-07-30 9.8 CVE-2026-12943 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-12943 ] IBM--Langflow OSS IBM Langflow OSS 1.0.0 through 1.= 10.1=C2=A0 are vulnerable to unauthenticated remote code execution via envi= ronment variable injection in the MCP (Model Context Protocol) stdio launch= er. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the = DANGEROUS_ENV_VARS blocklist fails to include SHELLOPTS , BASHOPTS , and PS=
4 environment variables. 2026-07-30 9.8 CVE-2026-12940 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-12940 ] IBM--Langflow OSS IBM Langflow OSS 1.0.0 = through 1.10.0 could allow a remote attacker to inject arbitrary code on th=
e system, due to the improper control of user input code. 2026-07-30 9.9 CV= E-2026-12946 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12946 ] IBM--Lan= gflow OSS IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input = validation vulnerability in the PythonREPL sandbox implementation. 2026-07-=
30 9.9 CVE-2026-13435 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13435 ]=
IBM--Langflow OSS IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remo=
te attacker to traverse directories on the system. An attacker could send a=
specially crafted URL request containing "dot dot " sequences ( /.. /) to = view arbitrary files on the system. 2026-07-30 7.5 CVE-2026-12942 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-12942 ] IBM--Langflow OSS IBM Langflow=
OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipula=
te other users' build jobs through improper access control on log retrieval=
and unauthenticated build endpoints. 2026-07-30 7.1 CVE-2026-12945 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-12945 ] IBM--Langflow OSS IBM Langfl=
ow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another user's F= AISS namespace to access owner-only vector content and influence later quer=
y results. This causes cross-user information disclosure and limited integr= ity impact through persistent poisoning of returned results. 2026-07-28 7.1=
CVE-2026-13442 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13442 ] IBM--= Observability with Instana (Agent) IBM Observability with Instana (Agent) B= uild 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/= core version 6.2.1 is vulnerable to prototype pollution through its configu= ration normalization API. 2026-07-28 7.3 CVE-2026-14893 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-14893 ] IBM--Planning Analytics Local IBM Planni=
ng Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect t= hat allows an attacker to redirect users to arbitrary external websites via=
a crafted URL. If used in SSO authentication flows, this could result in e= xposure of session tokens and allow attackers to hijack user sessions. 2026= -07-30 7.5 CVE-2026-10545 [ https://www.cve.org/CVERecord?id=3DCVE-2026-105=
45 ] IBM--PowerVM Hypervisor IBM PowerVM Hypervisor FW1110.00 through FW111= 0.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H1 A carefull=
y crafted OS hypervisor call can cause the PowerVM hypervisor to crash or c= ompromise OS memory integrity. 2026-07-30 8.4 CVE-2026-11885 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-11885 ] IBM--Sterling B2B Integrator IBM St= erling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2,=
and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 throug=
h 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 is vu= lnerable to SQL injection. A remote attacker could send specially crafted S=
QL statements, which could allow the attacker to view, add, modify, or dele=
te information in the back-end database. 2026-07-28 8.1 CVE-2026-7769 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-7769 ] IBM--Tivoli System Automati=
on Application Manager IBM Tivoli System Automation Application Manager 4.1=
and IBM WebSphere Application Server is affected by a cross-site scripting=
vulnerability in the administrative console login page. 2026-07-30 9.3 CVE= -2026-11707 [ https://www.cve.org/CVERecord?id=3DCVE-2026-11707 ] IBM--webM= ethods Integration (on prem) IBM webMethods Integration (on prem) 10.15, 10= .11 could allow an unauthenticated remote attacker to execute arbitrary cod=
e on the system due to the deserialization of untrusted data. 2026-07-30 9.=
8 CVE-2026-12118 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12118 ] IBM-= -WebSphere Application Server IBM WebSphere Application Server 9.0, and 8.5=
is vulnerable to broken access control/privilege escalation in the adminis= trative console. 2026-07-28 9.8 CVE-2026-14446 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-14446 ] IBM--WebSphere Application Server IBM WebSphere A= pplication Server 9.0, and 8.5 traditional is vulnerable to pre-authenticat= ion unsafe deserialization which could allow a remote attacker to bypass au= thentication or execute arbitrary code. 2026-07-28 9.8 CVE-2026-14512 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-14512 ] IBM--WebSphere Application=
Server IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere App= lication Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerab=
le to server-side request forgery (SSRF) when the SIP container feature (si= pServlet-1.1) is enabled. 2026-07-29 9.4 CVE-2026-14529 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-14529 ] IBM--WebSphere Application Server IBM We= bSphere Application Server 9.0, and 8.5 is affected by a remote code execut= ion vulnerability in the SOAP/JMX connector. 2026-07-30 8.5 CVE-2026-11536 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-11536 ] IBM--WebSphere Applic= ation Server IBM WebSphere Application Server 8.5, and 9.0 traditional coul=
d allow a remote attacker to execute arbitrary code caused by unsafe deseri= alization of untrusted data. 2026-07-28 8.1 CVE-2026-14974 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-14974 ] IBM--WebSphere Application Server IBM=
WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Se= rver - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP Response Smu= ggling due to improper handling of non-standard HTTP version tokens. 2026-0= 7-28 8.7 CVE-2026-15064 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15064=
] IBM--WebSphere Application Server IBM WebSphere Application Server 9.0, = and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.= 0.0.7 is vulnerable to HTTP request smuggling due to improper handling of T= RACE requests. 2026-07-28 8.7 CVE-2026-15325 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-15325 ] IBM--WebSphere Application Server IBM WebSphere App= lication Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty=
17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote att= acker to bypass security constraints. 2026-07-30 7.5 CVE-2026-10842 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-10842 ] IBM--WebSphere Application S= erver IBM WebSphere Application Server 9.0, and 8.5 traditional could allow=
a remote attacker to obtain sensitive information. 2026-07-28 7.4 CVE-2026= -14528 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14528 ] IBM--WebSphere=
Application Server IBM WebSphere Application Server 9.0, and 8.5 and IBM W= ebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are affecte=
d by a denial of service vulnerability in the HTTP channel due to unbounded=
allocation of resources without limits. 2026-07-28 7.5 CVE-2026-14981 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-14981 ] IBM--WebSphere Applicatio=
n Server IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Ap= plication Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP = request smuggling. 2026-07-28 7.4 CVE-2026-15328 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-15328 ] IBM--WebSphere Application Server IBM WebSphere=
Application Server 9.0, and 8.5 could allow a remote attacker to bypass au= thentication by sending a crafted unauthenticated request. 2026-07-28 7 CVE= -2026-16184 [ https://www.cve.org/CVERecord?id=3DCVE-2026-16184 ] IBM--WebS= phere Application Server IBM WebSphere Application Server 9.0, and 8.5 and = IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vu= lnerable to a denial of service via a crafted HTTP request. 2026-07-30 7.5 = CVE-2026-9322 [ https://www.cve.org/CVERecord?id=3DCVE-2026-9322 ] IBM--Web= Sphere Application Server - Liberty IBM WebSphere Application Server - Libe= rty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery w= hich could allow an attacker to perform SSRF attacks with elevated privileg=
es when the collectiveController-1.0 feature is enabled. 2026-07-30 8.3 CVE= -2026-14980 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14980 ] IBM--WebS= phere Application Server - Liberty IBM WebSphere Application Server - Liber=
ty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused b=
y sending a specially crafted request. A remote attacker could exploit this=
vulnerability to cause the server to consume memory resources. 2026-07-30 = 7.5 CVE-2026-11897 [ https://www.cve.org/CVERecord?id=3DCVE-2026-11897 ] IB= M--WebSphere Application Server - Liberty IBM WebSphere Application Server =
- Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution wi=
th the collectiveController-1.0 feature enabled. 2026-07-28 7.1 CVE-2026-14= 976 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14976 ] IBM--WebSphere Ap= plication Server - Liberty IBM WebSphere Application Server - Liberty 17.0.= 0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontroll=
ed heap allocation. 2026-07-28 7.5 CVE-2026-15057 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-15057 ] IBM--WebSphere Application Server - Liberty IB=
M WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Colle= ctive Controller is affected by a path-segment injection vulnerability in t=
he collective routing mechanism. 2026-07-28 7.5 CVE-2026-15280 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-15280 ] IBM--WebSphere Application Server=
- Liberty IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0= .0.8 is affected by a denial of service vulnerability when the restConnecto= r-2.0 feature is enabled. 2026-07-28 7.1 CVE-2026-16192 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-16192 ] Innotim Software, Telecommunications and=
Consulting Trade Ltd. Co.--Logsign SIEM Improper Control of Generation of = Code ('Code Injection') vulnerability in Innotim Software, Telecommunicatio=
ns and Consulting Trade Ltd. Co. Logsign SIEM allows Code Injection. This i= ssue affects Logsign SIEM: before 6.4.108. 2026-07-31 9.8 CVE-2026-17561 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-17561 ] JetBrains--TeamCity In = JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code e= xecution was possible via the agent polling protocol 2026-07-27 9.8 CVE-202= 6-63077 [ https://www.cve.org/CVERecord?id=3DCVE-2026-63077 ] jfrog--artifa= ctory JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerab=
le to a privilege escalation attack due to a validation check of the token = signature/issuer and not the token's scope. 2026-07-27 8.1 CVE-2026-42016 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-42016 ] jfrog--artifactory An = event-handling weakness in JFrog Artifactory could expose privileged author= ization material to a lower-privileged user under specific conditions. 2026= -07-27 8.8 CVE-2026-42017 [ https://www.cve.org/CVERecord?id=3DCVE-2026-420=
17 ] jfrog--artifactory Incorrect authorization validation in refresh token=
signature allows non-admin users to obtain a signed JFrog administrator to= ken. 2026-07-27 8.8 CVE-2026-65616 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-65616 ] jfrog--artifactory A deserialization weakness in JFrog Artifa= ctory package handling could allow a low-privileged user to impact confiden= tiality, integrity, and availability under specific repository conditions. = 2026-07-27 8.8 CVE-2026-65617 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -65617 ] jfrog--artifactory A path validation weakness in archive extractio= n/write handling allows entries with traversal sequences to be written outs= ide the intended build artifacts location. 2026-07-27 8.8 CVE-2026-65921 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-65921 ] jfrog--artifactory JFro=
g Artifactory contains an authentication handling weakness in internal requ= est processing that, under specific conditions, may allow an attacker to es= calate privileges beyond the intended access level. 2026-07-27 8.8 CVE-2026= -66014 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66014 ] jfrog--artifac= tory An authorization weakness in JFrog Artifactory internal metadata handl= ing could allow a user with limited repository access to write to restricte=
d internal metadata areas under specific conditions. Successful abuse is li= mited to integrity and availability impact at a low level; confidentiality =
is not affected. 2026-07-27 7.1 CVE-2026-65922 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-65922 ] jfrog--artifactory An authenticated privilege-esc= alation vulnerability in JFrog Platform may be exploited under admin-provis= ioned account conditions. Successful exploitation may grant temporary platf= orm administrator access. 2026-07-27 7.2 CVE-2026-66015 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-66015 ] jgwhite33--WP Google Review Slider Admin= istrator SQL Injection in WP Google Review Slider <=3D 18.4 versions. 2026-= 07-27 7.6 CVE-2026-66427 [ https://www.cve.org/CVERecord?id=3DCVE-2026-6642=
7 ] John Darrel--Hide My WP Ghost Subscriber Broken Authentication in Hide =
My WP Ghost <=3D 7.0.06 versions. 2026-07-27 7.4 CVE-2026-59546 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-59546 ] juev--nebula-mesh Nebula Mesh is=
a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3=
.5 and below, the web UI (/ui/*) does not apply the per-operator CA scoping=
employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h= 5vg, but the changes were not implemented in the web read/mutation surface.=
Any authenticated non-admin operator (for example, one created via self-re= gistration or OIDC) can access resources belonging to other operators. The = host create/edit/mobile-bundle/network-create paths and all CA-management r= outes were already correctly scoped. A malicious operator could block or de= lete any other operator's host, or read any operator's hosts and networks. = This issue has been fixed in version 0.3.6. 2026-07-28 8.8 CVE-2026-49258 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-49258 ] julep-ai--julep Julep = contains an insecure direct object reference vulnerability in the get_execu= tion_details endpoint that allows authenticated tenants to read another ten= ant's execution data. Attackers can supply arbitrary execution_id values to=
retrieve sensitive execution records including task inputs, outputs, metad= ata, and temporal task tokens from other tenants. 2026-07-30 8.1 CVE-2026-6= 7348 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67348 ] Kanboard--Kanboa=
rd Kanboard 1.2.52 and prior contains a server-side request forgery vulnera= bility that allows authenticated users to bypass SSRF protections by supply= ing hexadecimal IP address notation in user-controlled URLs. Attackers can = submit hexadecimal-encoded internal IP addresses through the web link creat= ion feature, causing cURL to resolve and connect to internal network resour= ces such as cloud instance metadata services, localhost services, and RFC19=
18 addresses while the isPrivateURL() filter in app/Core/Http/Client.php in= correctly treats the input as safe due to FILTER_VALIDATE_IP rejecting non-= dotted-decimal notation. 2026-07-30 8.5 CVE-2026-57862 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-57862 ] Kofi Mokome--Message Filter for Contact F= orm 7 Unauthenticated Cross Site Scripting (XSS) in Message Filter for Cont= act Form 7 <=3D 1.6.3.9 versions. 2026-07-27 7.1 CVE-2026-65438 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-65438 ] koxudaxi--datamodel-code-generat=
or datamodel-code-generator generates Pydantic v2 models, dataclasses, Type= dDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobu=
f, and raw JSON, YAML, or CSV. From 0.17.0 until 0.60.2, datamodel-code-gen= erator preserves attacker-controlled default_factory values in src/datamode= l_code_generator/parser/jsonschema.py through JsonSchemaObject.init and get= _field_extras and emits them into Field(default_factory=3D...) or field(def= ault_factory=3D...), allowing Python expression execution when the generate=
d model is imported. This issue is fixed in version 0.60.2. 2026-07-28 8.8 = CVE-2026-54653 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54653 ] koxuda= xi--datamodel-code-generator datamodel-code-generator generates Pydantic v2=
models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Sche= ma, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0= .61.0, datamodel-code-generator silently dereferences attacker-controlled J= SON Schema $ref HTTP or HTTPS URLs in src/datamodel_code_generator/parser/j= sonschema.py through _get_ref_body, and the --allow-remote-refs gate can wa=
rn instead of blocking, allowing server-side request forgery through src/da= tamodel_code_generator/http.py. This issue is fixed in version 0.61.0. 2026= -07-28 8.2 CVE-2026-54690 [ https://www.cve.org/CVERecord?id=3DCVE-2026-546=
90 ] koxudaxi--datamodel-code-generator datamodel-code-generator generates = Python data models from schema definitions. From 0.9.1 until 0.61.0, src/da= tamodel_code_generator/http.py http.get_body accepts --url targets and redi= rect chain targets without host/IP validation, allowing server-side request=
forgery against loopback, private, link-local, metadata, and other network= -accessible resources. This issue is fixed in version 0.61.0. 2026-07-28 8.=
2 CVE-2026-54691 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54691 ] koxu= daxi--datamodel-code-generator datamodel-code-generator generates Python da=
ta models from schema definitions. Prior to 0.60.1, GraphQL Union descripti=
on values in src/datamodel_code_generator/model/template/UnionTypeStatement= .jinja2 and src/datamodel_code_generator/model/template/UnionTypeStatement.= py312.jinja2 are rendered into Python comments without neutralizing carriag=
e returns in Python # comments, allowing attacker-controlled GraphQL schema=
content to inject Python code into generated models that runs when importe=
d. This issue is fixed in version 0.60.1. 2026-07-28 7.8 CVE-2026-54621 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-54621 ] koxudaxi--datamodel-code= -generator datamodel-code-generator generates Python data models from schem=
a definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment = field is rendered into Python comments in src/datamodel_code_generator/mode= l/template/TypeAliasAnnotation.jinja2, src/datamodel_code_generator/model/t= emplate/TypedDict.jinja2, src/datamodel_code_generator/model/template/datac= lass.jinja2, src/datamodel_code_generator/model/template/msgspec.Struct.jin= ja2, src/datamodel_code_generator/model/template/pydantic/BaseModel.jinja2,=
and src/datamodel_code_generator/model/template/pydantic_v2/BaseModel.jinj=
a2 without neutralizing carriage returns in Python # comments, allowing an = attacker-controlled comment value to inject Python code into generated mode=
ls that runs when imported. This issue is fixed in version 0.60.2. 2026-07-=
28 7.8 CVE-2026-54654 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54654 ]=
koxudaxi--datamodel-code-generator datamodel-code-generator generates Pyth=
on data models from schema definitions. From 0.51.0 until 0.60.2, x-python-= type values parsed by src/datamodel_code_generator/parser/jsonschema.py in = _get_python_type_override are inserted into generated field annotations wit= hout sufficient validation, allowing attacker-controlled JSON Schema conten=
t to execute Python code when the generated module is imported. This issue =
is fixed in version 0.60.2. 2026-07-28 7.8 CVE-2026-54655 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-54655 ] koxudaxi--datamodel-code-generator dat= amodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict,=
and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and=
raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-generator=
interpolates validators from --extra-template-data in src/datamodel_code_g= enerator/model/pydantic_v2/base_model.py through _process_validators into @= field_validator decorators without safe validation, allowing Python code ex= ecution when the generated Pydantic v2 model is imported. This issue is fix=
ed in version 0.60.2. 2026-07-28 7.8 CVE-2026-54656 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-54656 ] koxudaxi--datamodel-code-generator datamodel= -code-generator generates Pydantic v2 models, dataclasses, TypedDict, and m= sgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw J= SON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator resolves JSON = Schema $ref targets in src/datamodel_code_generator/parser/jsonschema.py th= rough is_url and _get_ref_body without containing file:// or ../ traversal = references to the input directory and without honoring --no-allow-remote-re= fs, allowing arbitrary local file reads. This issue is fixed in version 0.6= 2.0. 2026-07-28 7.5 CVE-2026-55389 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-55389 ] koxudaxi--datamodel-code-generator datamodel-code-generator g= enerates Python data models from schema definitions. From 0.59.0 until 0.62= .0, XML Schema parsing in src/datamodel_code_generator/parser/xmlschema.py = for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine=
, and xs:override schemaLocation values outside the input base path, allowi=
ng arbitrary local files to be read and reflected into generated models. Th=
is issue is fixed in version 0.62.0. 2026-07-28 7.5 CVE-2026-55390 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-55390 ] koxudaxi--datamodel-code-gene= rator datamodel-code-generator generates Pydantic v2 models, dataclasses, T= ypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Prot= obuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator=
validates a URL host once in src/datamodel_code_generator/http.py through = get_body, _validate_url_for_fetch, and _get_ips_from_host, but then lets ht= tpx resolve the host again for the connection, allowing DNS rebinding to by= pass allow_private_network=3DFalse and reach internal services. This issue =
is fixed in version 0.63.0. 2026-07-28 7.5 CVE-2026-55391 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-55391 ] koxudaxi--datamodel-code-generator dat= amodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict,=
and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and=
raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator=
allows attacker-controlled x-python-import or customTypePath schema extens= ions to reach src/datamodel_code_generator/parser/jsonschema.py and generat=
ed import handling through Import.from_full_path and Imports.create_line in=
src/datamodel_code_generator/imports.py, allowing a newline to break out o=
f an import statement and execute Python code when the generated model is i= mported. This issue is fixed in version 0.64.0. 2026-07-28 7.5 CVE-2026-554=
15 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55415 ] kube-logging--logg= ing-operator Logging operator automates the deployment and configuration of=
Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration re= nderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD st= rings such as Flow record_transformer.records values directly into fluent.c= onf without escaping, allowing a user who can create Flow resources to inje=
ct a Fluentd <match **> block using @type exec and execute arbitrary comman=
ds inside the Fluentd aggregator. This issue is fixed in version 6.6.0. 202= 6-07-29 9.9 CVE-2026-54680 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54= 680 ] kyegomez--swarms Swarms through 6.8.1, fixed in commit 8b0fc9e, conta= ins a server-side request forgery vulnerability in the _is_safe_url functio=
n that fails to validate hostnames through DNS resolution, allowing attacke=
rs to bypass the blocklist. Attackers can supply user-controlled image or a= udio URLs that resolve to private, loopback, or metadata addresses to reach=
internal services and exfiltrate credentials. 2026-07-30 8.6 CVE-2026-6734=
6 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67346 ] ladela--Online Sche= duling and Appointment Booking System Bookly The Online Scheduling and Appo= intment Booking System - Bookly plugin for WordPress is vulnerable to time-= based SQL Injection via the 'staff_ids' parameter in all versions up to, an=
d including, 27.5 due to insufficient escaping on the user supplied paramet=
er and lack of sufficient preparation on the existing SQL query. This makes=
it possible for unauthenticated attackers to append additional SQL queries=
into already existing queries that can be used to extract sensitive inform= ation from the database. Exploitation requires a two-request chain: an atta= cker first calls the unauthenticated bookly_get_form_id action to seed a bo= oking session carrying malicious staff_ids values, then triggers bookly_ren= der_time to cause the tainted array to reach the vulnerable query; CSRF/non=
ce validation is absent on both endpoints, meaning this chain can be initia= ted cross-site. 2026-07-28 7.5 CVE-2026-14516 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-14516 ] laughingman7743--PyAthena PyAthena prior to 3.35.4=
contains a sql injection vulnerability that allows unauthenticated attacke=
rs to inject arbitrary SQL by exploiting improper quote-escaping in Default= ParameterFormatter.format(), which routes DELETE and CTAS statements to the=
_escape_hive function that backslash-escapes single quotes rather than dou= bling them. Because Athena and Trino do not treat backslashes as escape cha= racters inside string literals, attacker-supplied input such as a single qu= ote followed by SQL syntax causes the parser to terminate the string litera=
l prematurely, enabling data exfiltration via UNION SELECT, execution of de= structive statements, and attacker-controlled CTAS destination and content.=
2026-08-02 9.8 CVE-2026-65321 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-65321 ] Leantime--Leantime Leantime 3.6.2 contains a server-side request = forgery and local file inclusion vulnerability that allows authenticated at= tackers to read internal resources by passing unsanitized user-supplied fil= enames to file_get_contents() in the Blueprints::import() method without pa=
th validation. Attackers can submit crafted filenames containing URL wrappe=
rs or path traversal sequences through the JSON-RPC API endpoint to access = cloud metadata services or read arbitrary files from the server filesystem.=
2026-07-30 8.5 CVE-2026-66415 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-66415 ] Leantime--Leantime Leantime 3.6.2 contains a cross-site request f= orgery vulnerability that allows unauthenticated attackers to perform state= -changing actions on behalf of authenticated users by excluding the Laravel=
VerifyCsrfToken middleware from the global middleware stack in app/Http/Ke= rnel.php. Attackers can craft malicious pages delivered via phishing emails=
or malicious websites to trigger unauthorized POST, PUT, and DELETE reques=
ts that create or delete projects, modify settings, and change permissions =
as any authenticated user. 2026-07-30 8.8 CVE-2026-66416 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-66416 ] Lenze--c430 Multiple Lenze products are=
affected by an improper signature verification vulnerability in the SSH en= ablement mechanism. A low-privileged local attacker can bypass verification=
of the SSH enable file signature and enable SSH access on the device. Succ= essful exploitation may result in unauthorized administrative access and co= mplete system compromise. 2026-07-27 7.8 CVE-2026-14837 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-14837 ] Linux--Linux In the Linux kernel, the fo= llowing vulnerability has been resolved: nvmet-tcp: check INIT_FAILED befor=
e nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when=
a data digest mismatch is detected, nvmet_req_uninit() is called unconditi= onally. However, if the command arrived via the nvmet_tcp_handle_req_failur= e() path, nvmet_req_init() had returned false and percpu_ref_tryget_live() = was never executed. The unconditional percpu_ref_put() inside nvmet_req_uni= nit() then causes a refcount underflow, leading to a WARNING in percpu_ref_= switch_to_atomic_rcu, a use-after-free diagnostic, and eventually a permane=
nt workqueue deadlock. Check cmd->flags & NVMET_TCP_F_INIT_FAILED before ca= lling nvmet_req_uninit(), matching the existing pattern in nvmet_tcp_execut= e_request(). 2026-07-27 9.8 CVE-2026-64534 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-64534 ] Linux--Linux In the Linux kernel, the following vulne= rability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatc=
h Shivam Kumar found via vulnerability testing: When data digest is enabled=
on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2C_= DATA PDU during an R2T-based data transfer, the digest error handler in nvm= et_tcp_try_recv_ddgst() calls nvmet_req_uninit() - which performs percpu_re= f_put() on the submission queue - but does NOT mark the command as complete=
d. It does not set cqe->status, does not modify rbytes_done, and does not c= lear any flag. When the subsequent fatal error triggers queue teardown, nvm= et_tcp_uninit_data_in_cmds() iterates all commands, checks nvmet_tcp_need_d= ata_in() for each one, and finds that the already-uninited command still ap= pears to need data (because rbytes_done < transfer_len and cqe->status =3D=
=3D 0). It therefore calls nvmet_req_uninit() a second time on the same com= mand - a double percpu_ref_put against a single percpu_ref_get. 2026-07-27 = 9.8 CVE-2026-64535 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64535 ] Li= nux--Linux In the Linux kernel, the following vulnerability has been resolv= ed: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket smc_cdc_= rx_handler() looks up the connection by token under the link group's conns_= lock, drops the lock, and then dereferences conn and the smc_sock derived f= rom it, ending in sock_hold(&smc->sk) inside smc_cdc_msg_recv(). No referen=
ce is held across the lock release. The only reference pinning the socket w= hile the connection is discoverable in the link group is taken in smc_lgr_r= egister_conn() (sock_hold) and dropped in __smc_lgr_unregister_conn() (sock= _put), both under conns_lock. Once the handler drops conns_lock, a concurre=
nt close() -> smc_release() -> smc_conn_free() -> smc_lgr_unregister_conn()=
can drop that reference and free the smc_sock, so the handler's later sock= _hold() runs on freed memory: WARNING: lib/refcount.c:25 at refcount_warn_s= aturate Workqueue: rxe_wq do_work refcount_warn_saturate (lib/refcount.c:25=
) smc_cdc_msg_recv (net/smc/smc_cdc.c:430) smc_cdc_rx_handler (net/smc/smc_= cdc.c:502) smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445) tasklet_action_commo=
n (kernel/softirq.c:938) handle_softirqs (kernel/softirq.c:622) Kernel pani=
c - not syncing: panic_on_warn set Only SMC-R is affected. The SMC-D receiv=
e tasklet is stopped by tasklet_kill(&conn->rx_tsklet) in smc_conn_free() b= efore the connection is unregistered, so it cannot run concurrently with th=
e free. Take the socket reference while still holding conns_lock, so the re= gistration reference can no longer be the last one, and drop it once the ha= ndler is done. 2026-07-27 9.8 CVE-2026-64541 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-64541 ] Linux--Linux In the Linux kernel, the following vul= nerability has been resolved: sctp: validate STALE_COOKIE cause length befo=
re reading staleness When an ERROR chunk with a STALE_COOKIE cause is recei= ved in the COOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte M= easure of Staleness that follows the cause header: err =3D (struct sctp_err= hdr *)(chunk->skb->data); stale =3D ntohl(*(__be32 *)((u8 *)err + sizeof(*e= rr))); err is the first cause in the chunk, not the STALE_COOKIE cause that=
caused the dispatch, and nothing guarantees the staleness field is present=
. sctp_walk_errors() only requires a cause to be as long as the 4-byte head= er, so for a STALE_COOKIE cause of length 4 the read runs past the cause, a=
nd for a minimal ERROR chunk past skb->tail. The value is echoed to the pee=
r in the Cookie Preservative of the reply INIT, leaking uninitialized memor=
y. sctp_sf_cookie_echoed_err() already walks to the STALE_COOKIE cause, so = check its length there and pass it to sctp_sf_do_5_2_6_stale(), which reads=
that cause instead of the first one. A STALE_COOKIE cause too short to hol=
d the staleness field is discarded. The read is reachable by any peer that = can drive an association into COOKIE_ECHOED, including an unprivileged proc= ess using a raw SCTP socket in a user and network namespace. 2026-07-27 9.1=
CVE-2026-64551 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64551 ] Linux= --Linux In the Linux kernel, the following vulnerability has been resolved:=
staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop The loop in i= s_ap_in_tkip() iterates over IEs without verifying that enough bytes remain=
before dereferencing the IE header or its payload: - pIE->element_id and p= IE->length are read without checking that i + sizeof(*pIE) <=3D ie_length, =
so a truncated IE at the end of the buffer causes an OOB read. - For WLAN_E= ID_VENDOR_SPECIFIC the code compares pIE->data + 12, which requires pIE->le= ngth >=3D 16. For WLAN_EID_RSN it compares pIE->data + 8, requiring pIE->le= ngth >=3D 12. Neither requirement is checked. Add the missing IE header and=
payload bounds checks and guard each data access with an explicit pIE->len= gth minimum, matching the pattern established in update_beacon_info(). 2026= -07-27 8.1 CVE-2026-64536 [ https://www.cve.org/CVERecord?id=3DCVE-2026-645=
36 ] Linux--Linux In the Linux kernel, the following vulnerability has been=
resolved: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() ge= nelink_rx_fixup() splits an aggregated RX frame into its individual packets=
, using a per-packet length taken from device-supplied data. That length is=
only bounded by GL_MAX_PACKET_LEN (1514); it is never compared against how=
many bytes were actually received. A malicious GeneLink (GL620A) device ca=
n therefore send a short URB whose header claims packet_count > 1 and a fir=
st packet of up to 1514 bytes. skb_put_data(gl_skb, packet->packet_data, si= ze); then copies past the end of the receive buffer and hands the adjacent = slab contents up the network stack, an out-of-bounds read that leaks kernel=
heap. No privilege is required: the path runs in the usbnet RX softirq as = soon as the interface is up. BUG: KASAN: slab-out-of-bounds in genelink_rx_= fixup (drivers/net/usb/gl620a.c:112) Read of size 1514 at addr ffff88801130= 9708 by task ksoftirqd/0/14 Call Trace: ... __asan_memcpy (mm/kasan/shadow.= c:105) genelink_rx_fixup (include/linux/skbuff.h:2814 drivers/net/usb/gl620= a.c:112) usbnet_bh (drivers/net/usb/usbnet.c:572 drivers/net/usb/usbnet.c:1= 589) process_one_work (kernel/workqueue.c:3322) bh_worker (kernel/workqueue= .c:3405) tasklet_action (kernel/softirq.c:965) handle_softirqs (kernel/soft= irq.c:622) run_ksoftirqd (kernel/softirq.c:1076) ... skb_pull() already ver= ifies that the requested length fits the buffer and returns NULL otherwise.=
Move it ahead of the copy and check its result, so a packet that overruns = the received data is rejected before it is read. Well-formed frames, whose = packets are fully present, are unaffected. 2026-07-27 8.1 CVE-2026-64540 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-64540 ] Linux--Linux In the Lin=
ux kernel, the following vulnerability has been resolved: net: usb: net1080=
: validate packet_len before pad-byte access in rx_fixup For an even packet= _len, net1080_rx_fixup() reads the pad byte at skb->data[packet_len] before=
the skb->len !=3D packet_len check further down, and packet_len is only bo= unded against NC_MAX_PACKET. A malicious NetChip 1080 device can send a sho=
rt frame advertising a large even packet_len (e.g. 0x4000), so the pad-byte=
read lands past the end of the skb: BUG: KASAN: slab-out-of-bounds in net1= 080_rx_fixup Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14=
... net1080_rx_fixup (drivers/net/usb/net1080.c:384) usbnet_bh (drivers/ne= t/usb/usbnet.c:1589) process_one_work (kernel/workqueue.c:3322) bh_worker (= kernel/workqueue.c:3708) tasklet_action (kernel/softirq.c:965) handle_softi= rqs (kernel/softirq.c:622) ... Reject the frame when packet_len >=3D skb->l=
en before reading. 2026-07-27 8.1 CVE-2026-64547 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-64547 ] Linux--Linux In the Linux kernel, the following=
vulnerability has been resolved: bpf, sockmap: reject overflowing copy + l=
en in bpf_msg_push_data() When the scatterlist ring is full or nearly full,=
bpf_msg_push_data() enters a copy fallback path and computes copy + len fo=
r the page allocation size. Since len comes from BPF with arg3_type =3D ARG= _ANYTHING and both are u32, a crafted len can wrap the sum to a small value=
, causing an undersized allocation followed by an out-of-bounds memcpy. BUG=
: unable to handle page fault for address: ffffed104089a402 Oops: Oops: 000=
0 [#1] SMP KASAN NOPTI Call Trace: __asan_memcpy (mm/kasan/shadow.c:105) bp= f_msg_push_data (net/core/filter.c:2852 net/core/filter.c:2788) bpf_prog_9e= d8b5711920a7d7+0x2e/0x36 sk_psock_msg_verdict (net/core/skmsg.c:934) tcp_bp= f_sendmsg (net/ipv4/tcp_bpf.c:421 net/ipv4/tcp_bpf.c:584) __sys_sendto (net= /socket.c:2206) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCAL= L_64_after_hwframe (arch/x86/entry/entry_64.S:130) Add an overflow check be= fore the allocation. 2026-07-27 8.4 CVE-2026-64548 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-64548 ] Linux--Linux In the Linux kernel, the followi=
ng vulnerability has been resolved: virtio-net: fix len check in receive_bi= g() receive_big() bounds the device-announced length by (big_packets_num_sk= bfrags + 1) * PAGE_SIZE. That is still too loose: add_recvbuf_big() sets sg= [1] to start at offset sizeof(struct padded_vnet_hdr) into the first page, =
so the chain actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr=
)) + big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the c= heck allows for the common hdr_len =3D=3D 12 case. A malicious virtio backe=
nd can announce a len in that gap. page_to_skb() then walks one frag past t=
he page chain, storing a NULL page->private into skb_shinfo()->frags[MAX_SK= B_FRAGS], which is both an out-of-bounds write past the static frag array a=
nd a NULL frag handed up the rx path. Bound len by the size add_recvbuf_big=
() actually advertised. 2026-07-27 8.4 CVE-2026-64552 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-64552 ] Linux--Linux In the Linux kernel, the foll= owing vulnerability has been resolved: netfilter: bridge: fix stale prevhdr=
pointer in br_ip6_fragment() br_ip6_fragment() gets prevhdr, a pointer int=
o the skb head, from ip6_find_1stfragopt(), then calls skb_checksum_help().=
For a cloned skb skb_checksum_help() reallocates the head via pskb_expand_= head(), leaving prevhdr dangling. It is later dereferenced in ip6_frag_next= (), causing a use-after-free write. Save prevhdr's offset before skb_checks= um_help() and recompute it after, like commit ef0efcd3bd3f ("ipv6: Fix dang= ling pointer when ipv6 fragment"). BUG: KASAN: slab-use-after-free in ip6_f= rag_next (net/ipv6/ip6_output.c:857) Write of size 1 at addr ffff888013ff50=
16 by task exploit/141 Call Trace: ... kasan_report (mm/kasan/report.c:595)=
ip6_frag_next (net/ipv6/ip6_output.c:857) br_ip6_fragment (net/ipv6/netfil= ter.c:212) nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:40=
7) nf_hook_slow (net/netfilter/core.c:619) br_forward_finish (net/bridge/br= _forward.c:66) __br_forward (net/bridge/br_forward.c:115) maybe_deliver (ne= t/bridge/br_forward.c:191) br_flood (net/bridge/br_forward.c:245) br_handle= _frame_finish (net/bridge/br_input.c:229) br_handle_frame (net/bridge/br_in= put.c:442) ... packet_sendmsg (net/packet/af_packet.c:3114) ... do_syscall_=
64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x8= 6/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in inte= rrupt 2026-07-27 8.8 CVE-2026-64554 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-64554 ] Linux--Linux In the Linux kernel, the following vulnerabilit=
y has been resolved: KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle= _mops() kvm_hyp_handle_mops() resets the single-step state machine as part =
of rewinding state for a MOPS exception by modifying vcpu_cpsr() and writin=
g the result directly into hardware. In the case of nested virtualization, = vcpu_cpsr() is a synthetic value such that the rest of KVM can deal with vE=
L2 cleanly. That means the value requires translation before being written = into hardware, which is unfortunately missing from the MOPS handler. Fix it=
by directly modifying SPSR_EL2 and avoiding the synthetic state altogether=
, which will be resynchronized on the next 'full' exit back to KVM. 2026-07= -27 8.8 CVE-2026-64555 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64555 =
] Linux--Linux In the Linux kernel, the following vulnerability has been re= solved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_c= b() l2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after releas= e_sock(parent). Once the parent lock is dropped the newly enqueued child so= cket sk is reachable via the accept queue, so another task can accept and f= ree it before the callback dereferences sk, resulting in a use-after-free. = Rework the ->new_connection() op so the core, rather than the callback, own=
s the child channel's lifetime. The op now receives a pre-allocated new_cha=
n and returns an errno instead of allocating and returning a channel. l2cap= _new_connection() allocates the child channel and links it into the conn li=
st via __l2cap_chan_add() before invoking the callback, so the conn-list re= ference keeps the channel alive once release_sock(parent) exposes the socke=
t to other tasks. Channel configuration that was duplicated in l2cap_sock_i= nit() and the various new_connection callbacks is consolidated into l2cap_c= han_set_defaults(), which now inherits from the parent channel when one is = supplied. 2026-07-29 8.8 CVE-2026-64557 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-64557 ] Linux--Linux In the Linux kernel, the following vulnera= bility has been resolved: net: openvswitch: reject oversized nested action = attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len = field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbehaving ac= tions length check") allowed the total sw_flow_actions stream to grow beyon=
d 64 KiB, which is valid, but also removed the last guard preventing a gene= rated nested action attribute from exceeding U16_MAX. An oversized generate=
d container can thus be closed with a truncated nla_len. A later dump or te= ardown then walks a structurally different stream than the one that was val= idated. In particular, an oversized nested CLONE/CT action may cause subseq= uent bytes in the generated stream to be interpreted as independent actions=
. Keep the larger total-action-stream behavior, but make nested action clos=
e reject generated containers that do not fit in nla_len, and return the er= ror through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PK= T_LEN builders, trim resource-owning action-list tails in reverse construct= ion order before discarding failed wrappers, so resources copied into the r= ejected tails are released before the wrappers are removed. Most failed out=
er wrappers are discarded by truncating actions_len after child resources h= ave been released. CHECK_PKT_LEN also trims its parent after branch resourc=
es are gone. SET/TUNNEL close failures unwind their known tun_dst ownership=
directly, and SET_TO_MASKED has no external ownership and truncates on clo=
se failure. 2026-07-27 7.8 CVE-2026-64531 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-64531 ] Linux--Linux In the Linux kernel, the following vulner= ability has been resolved: fs/ntfs3: bound NTFS_DE view.data_off in UpdateR= ecordData{Root,Allocation} In do_action()'s UpdateRecordDataRoot (fslog.c:3= 489) and UpdateRecordDataAllocation (fslog.c:3697) cases, the memmove desti= nation is `Add2Ptr(e, le16_to_cpu(e->view.data_off))`, where e->view.data_o=
ff comes from an on-disk NTFS_DE inside an INDEX_ROOT or INDEX_BUFFER. Neit= her case validates view.data_off + dlen against e->size; the existing check= _if_index_root / check_if_alloc_index helpers walk the entry chain and vali= date the entry's offset, but not its internal view fields. The neighbouring=
read sites (e.g., fs/ntfs3/index.c when iterating view entries) check view= .data_off + view.data_size <=3D e->size. Apply the same bound at the two me= mmove sites. Reproduced under UML+KASAN on mainline 8d90b09e6741 via pr_war= n-only probe instrumentation: with view.data_off forced to 0xFFFC, the memm= ove writes 32 bytes past the end of the NTFS_DE. This is similar in shape t=
o Pavitra Jha's 2026-05-02 patch "fs/ntfs3: prevent oob in case UpdateRecor= dDataRoot" (<20260502105008.21827-1-jhapavitra98@gmail.com>) which proposes=
calling ntfs3_bad_de_range(); that helper does not exist in mainline. This=
patch uses inline checks. 2026-07-27 7.8 CVE-2026-64532 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-64532 ] Linux--Linux In the Linux kernel, the f= ollowing vulnerability has been resolved: fs/ntfs3: validate lcns_follow in=
log_replay conversion log_replay() converts DIR_PAGE_ENTRY_32 records into=
DIR_PAGE_ENTRY records when replaying version 0 restart tables. During thi=
s conversion, the memmove() length is derived directly from the on-disk lcn= s_follow field: memmove(&dp->vcn, &dp0->vcn_low, 2 * sizeof(u64) + le32_to_= cpu(dp->lcns_follow) * sizeof(u64)); check_rstbl() validates restart table = structure, but does not constrain per-entry lcns_follow values relative to = the entry size. A malformed filesystem image can provide an oversized lcns_= follow value, causing the conversion memmove() to access memory beyond the = bounds of the allocated restart table buffer. The same field is later used =
to bound iteration over page_lcns[], so validating lcns_follow during conve= rsion also prevents downstream out-of-bounds access from the same malformed=
metadata. Compute the maximum valid lcns_follow from the already-validated=
restart table entry size and reject entries that exceed this bound. Reuse = the existing t16/t32 scratch variables already declared in log_replay() to = avoid introducing new declarations. [almaz.alexandrovich@paragon-software.c= om: fixed the conflicts] 2026-07-27 7.8 CVE-2026-64533 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-64533 ] Linux--Linux In the Linux kernel, the fol= lowing vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write=
when prepending the Flags AD eir_create_adv_data() builds the advertising = data into a fixed-size buffer ("size", 31 for the legacy path). It may prep= end a 3-byte "Flags" AD structure (LE_AD_NO_BREDR on an LE-only controller)=
and then copies the per-instance data without checking that it still fits:=
memcpy(ptr, adv->adv_data, adv->adv_data_len); tlv_data_max_len() only res= erves those 3 bytes when the user-supplied flags carry a managed-flags bit,=
so an instance added with flags =3D=3D 0 is accepted with adv_data_len up =
to the full buffer. At advertise time the flags are still prepended, and th=
e memcpy() writes 3 + adv_data_len bytes into the size-byte buffer: BUG: KA= SAN: stack-out-of-bounds in eir_create_adv_data (net/bluetooth/eir.c:301) W= rite of size 31 at addr ffff88800a547bdc by task kworker/u9:0/65 Workqueue:=
hci0 hci_cmd_sync_work __asan_memcpy (mm/kasan/shadow.c:106) eir_create_ad= v_data (net/bluetooth/eir.c:301) hci_update_adv_data_sync (net/bluetooth/hc= i_sync.c:1310) hci_schedule_adv_instance_sync (net/bluetooth/hci_sync.c:181=
7) hci_cmd_sync_work (net/bluetooth/hci_sync.c:332) This frame has 1 object=
: [32, 64) 'cp' The "Flags" structure is added by the kernel, not requested=
by userspace, so only prepend it when it fits together with the instance a= dvertising data; when there is no room for both, drop the flags rather than=
the user-provided data. Reachable by a local user with CAP_NET_ADMIN ownin=
g an LE-only controller on the legacy advertising path. 2026-07-27 7.8 CVE-= 2026-64539 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64539 ] Linux--Lin=
ux In the Linux kernel, the following vulnerability has been resolved: tipc=
: fix use-after-free of the discoverer in tipc_disc_rcv() bearer_disable() = frees b->disc with tipc_disc_delete()'s plain kfree(), but tipc_disc_rcv() = still dereferences b->disc in RX softirq under rcu_read_lock() (tipc_udp_re=
cv -> tipc_rcv -> tipc_disc_rcv). L2 bearers are safe thanks to the synchro= nize_net() in tipc_disable_l2_media(), but the UDP bearer defers that call =
to the cleanup_bearer() workqueue, so the discoverer is freed with no grace=
period: BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discove= r.c:149) Read of size 8 at addr ffff88802348b728 by task poc_tipc/184 <IRQ>=
tipc_disc_rcv (net/tipc/discover.c:149) tipc_rcv (net/tipc/node.c:2126) ti= pc_udp_recv (net/tipc/udp_media.c:391) udp_rcv (net/ipv4/udp.c:2643) ip_loc= al_deliver_finish (net/ipv4/ip_input.c:241) </IRQ> Freed by task 181: kfree=
(mm/slub.c:6565) bearer_disable (net/tipc/bearer.c:418) tipc_nl_bearer_dis= able (net/tipc/bearer.c:1001) The bearer is freed with kfree_rcu(); free th=
e discoverer the same way. Add an rcu_head to struct tipc_discoverer and fr=
ee it and its skb from an RCU callback. Because the RCU callback (tipc_disc= _free_rcu) lives in module text, a call_rcu() that is still pending when th=
e tipc module is unloaded would invoke a freed function. Add an rcu_barrier=
() to tipc_exit() after the bearer subsystem has been torn down, so all pen= ding discoverer callbacks have run before the module text goes away. Reacha= ble from an unprivileged user namespace: the TIPCv2 genl family is netnsok = and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC and CONF= IG_TIPC_MEDIA_UDP. 2026-07-27 7.8 CVE-2026-64543 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-64543 ] Linux--Linux In the Linux kernel, the following=
vulnerability has been resolved: net, bpf: check master for NULL in xdp_ma= ster_redirect() xdp_master_redirect() dereferences the result of netdev_mas= ter_upper_dev_get_rcu() without a NULL check, but that helper returns NULL = when the receiving device has no upper-master adjacency. The reach guard on=
ly checks netif_is_bond_slave(). On bond slave release bond_upper_dev_unlin= k() drops the upper-master adjacency before clearing IFF_SLAVE, so an XDP_T=
X reaching xdp_master_redirect() in that window still passes netif_is_bond_= slave() while master is already NULL, and faults on master->flags at offset=
0xb0: BUG: kernel NULL pointer dereference, address: 00000000000000b0 RIP:=
0010:xdp_master_redirect (net/core/filter.c:4432) Call Trace: xdp_master_r= edirect (net/core/filter.c:4432) bpf_prog_run_generic_xdp (include/net/xdp.= h:700) do_xdp_generic (net/core/dev.c:5608) __netif_receive_skb_one_core (n= et/core/dev.c:6204) process_backlog (net/core/dev.c:6319) __napi_poll (net/= core/dev.c:7729) net_rx_action (net/core/dev.c:7792) handle_softirqs (kerne= l/softirq.c:622) __dev_queue_xmit (include/linux/bottom_half.h:33) packet_s= endmsg (net/packet/af_packet.c:3082) __sys_sendto (net/socket.c:2252) Kerne=
l panic - not syncing: Fatal exception in interrupt The missing check dates=
back to the original code; commit 1921f91298d1 ("net, bpf: fix null-ptr-de= ref in xdp_master_redirect() for down master") later added the master->flag=
s read where the fault now lands but kept the unconditional deref. Check ma= ster for NULL before use; a NULL master is treated the same as one that is = not up. 2026-07-27 7.5 CVE-2026-64545 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-64545 ] Linux--Linux In the Linux kernel, the following vulnerabil= ity has been resolved: drm/edid: fix OOB read in drm_parse_tiled_block() dr= m_parse_tiled_block() casts the DisplayID block to a struct displayid_tiled= _block and reads the full fixed layout up to tile->topology_id[7] without c= hecking block->num_bytes. The DisplayID iterator only validates the declare=
d payload length, so a crafted EDID can advertise a tiled-display block (ta=
g DATA_BLOCK_TILED_DISPLAY, or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0=
) with a small num_bytes at the end of a DisplayID extension. The read then=
runs past the end of the exact-sized kmemdup()'d EDID allocation, a heap o= ut-of-bounds read. Reject blocks shorter than the spec's 22-byte tiled payl= oad before reading the fixed struct, as drm_parse_vesa_mso_data() already d= oes. BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update Read of si=
ze 2 at addr ffff888010077700 by task exploit/147 dump_stack_lvl (lib/dump_= stack.c:94 ...) print_report (mm/kasan/report.c:378 ...) kasan_report (mm/k= asan/report.c:595) drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:75= 81) bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574) drm= _helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:42=
6) status_store (drivers/gpu/drm/drm_sysfs.c:219) ... vfs_write (fs/read_wr= ite.c:595 fs/read_write.c:688) ksys_write (fs/read_write.c:740) 2026-07-27 = 7.1 CVE-2026-64546 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64546 ] Li= nux--Linux In the Linux kernel, the following vulnerability has been resolv= ed: net: qualcomm: rmnet: validate MAP frame length before ingress parsing = When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes = the skb straight to __rmnet_map_ingress_handler(), skipping the length vali= dation that rmnet_map_deaggregate() performs on the aggregated path. The pa= rser then dereferences the MAP header and csum header/trailer based on the = on-wire pkt_len without checking skb->len, so a short frame is read out of = bounds: BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packe=
t Read of size 1 at addr ffff88801118ed00 by task exploit/147 Call Trace: .=
.. rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/= rmnet_map_data.c:413) __rmnet_map_ingress_handler (drivers/net/ethernet/qua= lcomm/rmnet/rmnet_handlers.c:96) rmnet_rx_handler (drivers/net/ethernet/qua= lcomm/rmnet/rmnet_handlers.c:129) __netif_receive_skb_core.constprop.0 (net= /core/dev.c:6089) netif_receive_skb (net/core/dev.c:6460) tun_get_user (dri= vers/net/tun.c:1955) tun_chr_write_iter (drivers/net/tun.c:2001) vfs_write = (fs/read_write.c:688) ksys_write (fs/read_write.c:740) do_syscall_64 (arch/= x86/entry/syscall_64.c:94) ... Factor that validation out of rmnet_map_deag= gregate() into rmnet_map_validate_packet_len() and run it on the no-aggrega= tion path too. The MAP header is bounds-checked first, since this path can = receive a frame shorter than the header. 2026-07-27 7.3 CVE-2026-64550 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-64550 ] Linux--Linux In the Linux=
kernel, the following vulnerability has been resolved: perf/core: Detach e= vent groups during remove_on_exec perf_event_remove_on_exec() removes event=
s by calling perf_event_exit_event(). For top-level events, this removes th=
e event from the context with DETACH_EXIT only. This can leave inconsistent=
group state when a removed event is a group leader and the group contains = siblings without remove_on_exec. If the group was active, the surviving sib= lings can remain active and attached to the removed leader's sibling list, = but are no longer represented by a valid group leader on the PMU context ac= tive lists. A later close of the removed leader uses DETACH_GROUP and can p= romote the still-active siblings from this stale group state. The next sche= dule-in can then add an already-linked active_list entry again, corrupting = the PMU context active list. With DEBUG_LIST enabled, this is caught as a l= ist_add double-add in merge_sched_in(). Fix this by detaching group relatio= nships when remove_on_exec removes an event. This preserves the existing ta= sk-exit and revoke behavior, while ensuring surviving siblings are ungroupe=
d before the removed event leaves the context. 2026-07-29 7.8 CVE-2026-6455=
6 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64556 ] Linux--Linux In the=
Linux kernel, the following vulnerability has been resolved: s390/pkey: Ch= eck length in pkey_pckmo handler implementation Explicitly check the length=
of the target buffer in the pkey_pckmo implementation of the key_to_protke= y() handler function. The handler function fails, if the generated output d= ata exceeds the length of the provided target buffer. 2026-07-29 7.8 CVE-20= 26-64558 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64558 ] Linux--Linux=
In the Linux kernel, the following vulnerability has been resolved: s390/p= key: Check length in PKEY_VERIFYPROTK ioctl Explicitly check the buffer len= gth request structure provided by user-space and fail, if it exceeds the bu= ffer size. 2026-07-29 7.8 CVE-2026-64559 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-64559 ] Linux--Linux In the Linux kernel, the following vulnera= bility has been resolved: posix-cpu-timers: Prevent UAF caused by non-leade=
r exec() race Wongi and Jungwoo decoded and reported a non-leader exec() re= lated race which can result in an UAF: sys_timer_delete() exec() posix_cpu_= timer_del() // Observes old leader p =3D pid_task(pid, pid_type); de_thread=
() switch_leader(); release_task(old_leader) __exit_signal(old_leader) sigh= and =3D lock(old_leader, sighand); posix_cpu_timers*_exit(); sighand =3D lo= ck_task_sighand(p) unhash_task(old_leader); sh =3D lock(p, sighand) old_lea= der->sighand =3D NULL; unlock(sighand); (p->sighand =3D=3D NULL) unlock(sh)=
return NULL; // Returns without action if(!sighand) return 0; free_posix_t= imer(); This is "harmless" unless the deleted timer was armed and enqueued =
in p->signal because on exec() a TGID targeted timer is inherited. As sys_t= imer_delete() freed the underlying posix timer object run_posix_cpu_timers(=
) or any timerqueue related add/delete operations on other timers will acce=
ss the freed object's timerqueue node, which results in an UAF. There is a = similar problem vs. posix_cpu_timer_set(). For regular posix timers it just=
transiently returns -ESRCH to user space, but for the use case in do_cpu_n= anosleep() it's the same UAF just that the k_itimer is allocated on the sta= ck. Also posix_cpu_timer_rearm() fails to rearm the timer, which means it s= tops to expire. While debating solutions Frederic pointed out another probl= em: posix_cpu_timer_del(tmr) __exit_signal(p) posix_cpu_timers*_exit(p); un= hash_task(p); p->sighand =3D NULL; sh =3D lock_task_sighand(p) sighand =3D = p->sighand; if (!sighand) return NULL; lock(sighand); if (!sh) WARN_ON_ONCE= (timer_queued(tmr)); On weakly ordered architectures it is not guaranteed t= hat posix_cpu_timer_del() will observe the stores in posix_cpu_timers*_exit=
() when p->sighand is observed as NULL, which means the WARN() can be a fal=
se positive. Solve these issues by: 1) Changing the store in __exit_signal(=
) to smp_store_release(). 2) Adding a smp_acquire__after_ctrl_dep() into th=
e !sighand path of lock_task_sighand(). 3) Creating a helper function for l= ooking up the task and locking sighand which does not return when sighand = =3D=3D NULL. Instead it retries the task lookup and only if that fails it g= ives up. 4) Using that helper in the three affected functions. #1/#2 ensure=
s that the reader side which observes sighand =3D=3D NULL also observes all=
preceeding stores, i.e. the stores in posix_cpu_timers*_exit() and the one=
s in unhash_task(). #3 ensures that the above described non-leader exec() s= ituation is handled gracefully. When the task lookup returns the old leader=
, but sighand =3D=3D NULL then it retries. In the non-leader exec() case th=
e subsequent task lookup will observe the new leader due to #1/#2. In norma=
l exit() scenarios the subsequent lookup fails. When the task lookup fails,=
the function also checks whether the timer is still enqueued and issues a = warning if that's the case. Unfortunately there is nothing which can be don=
e about it, but as the task is already not longer visible the timer should = not be accessed anymore. This check also requires memory ordering, which is=
not provided when the first lookup fails. To achieve that the check is pre= ceeded by a smp_rmb() which pairs with the smp_wmb() in write_seqlock() in = __exit_signal(). That ensures that the stores in posix_cpu_timers*_exit() a=
re visible. The history of the non-leader exec() issue goes back to the ear=
ly days of posix CPU timers, which stored a pointer to the group leader tas=
k in the timer. That obviously fails when a non-leader exec() switches the = leader. commit e0a70217107e ("posix-cpu-timers: workaround to suppress the = problems with mt exec") added a temporary workaround for that in 2010 which=
surv ---truncated--- 2026-07-29 7.8 CVE-2026-64560 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-64560 ] litestar-org--litestar Litestar is an Asynch= ronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, = Litestar instances which use a template engine in conjunction with CSRF pro= tection are vulnerable to HTML Injection which can be escalated to Cross Si=
te Scripting due to the contents of the CSRF cookie being excluded from aut= omatic escaping by the template engine when configured inline with document= ation recommendations. This issue has been patched in version 2.20.0. 2026-= 07-28 8.1 CVE-2026-48060 [ https://www.cve.org/CVERecord?id=3DCVE-2026-4806=
0 ] magepeopleteam--Booking and Rental Manager Unauthenticated Other Vulner= ability Type in Booking and Rental Manager <=3D 2.7.2 versions. 2026-07-27 = 7.5 CVE-2026-59532 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59532 ] ma= sci--banks Banks generates meaningful LLM prompts using a simple template l= anguage. In versions prior to 2.4.3, banks parses Tool JSON objects from th=
e rendered body of {% completion %} blocks and later resolves their import_= path field through importlib.import_module(...) + getattr(...) to obtain th=
e callable that handles a tool call. There is no allowlist or sanitization =
on import_path, so any importable Python attribute (e.g. os.system, subproc= ess.getoutput) can be selected. When the LLM emits a tool_calls entry whose=
function.name matches the attacker-supplied tool name, the resolved callab=
le is invoked with kwargs decoded from tool_call.function.arguments, yieldi=
ng arbitrary code execution in the banks-hosting process. This is distinct = from GHSA-gphh-9q3h-jgpp / CVE-2026-44209. That advisory was fixed in 2.4.2=
by switching src/banks/env.py from Environment to SandboxedEnvironment. Th=
e fix does not touch src/banks/extensions/completion.py, and the unsafe imp= ort + getattr chain still executes on 2.4.2. The malicious Tool JSON is pla=
in text in the rendered template body - it requires no Jinja attribute acce= ss, so the sandbox is irrelevant. This issue has been fixed in version 2.4.=
3. 2026-07-30 7.5 CVE-2026-61536 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-61536 ] masci--banks Banks generates meaningful LLM prompts using a sim= ple template language. In versions prior to 2.4.4, all four media filters (= image, audio, video, document) in banks accept untrusted user input as file=
paths via Path(value) and pass them directly to open(file_path, "rb") with= out any path sanitization, canonicalization, or directory restriction. An a= ttacker who controls template variables passed to a banks Prompt can use pa=
th traversal (../) to read arbitrary files accessible to the Python process= -including .env files, SSH keys, cloud credentials, source code, /etc/passw=
d, and /etc/shadow-with the content returned base64-encoded in the rendered=
prompt output, making exfiltration trivial. This is particularly dangerous=
for applications that use banks to process user-provided template variable=
s before sending prompts to an LLM. This issue has been fixed in version 2.= 4.4. 2026-07-30 7.5 CVE-2026-62663 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-62663 ] Meta Box--Meta Box AIO The Meta Box AIO plugin for WordPress =
is vulnerable to Missing Authorization via the template_redirect dispatcher=
in the MB Frontend Submission extension in versions up to, and including, = 3.8.0. This is due to the handle_request() function routing the mbfs_delete=
action without any capability or ownership check, and the nonce verificati=
on in check_ajax() being gated behind is_ajax() which is false for template= _redirect requests, making it bypassable. This makes it possible for unauth= enticated attackers to delete arbitrary posts and pages by supplying an att= acker-controlled post ID via the rwmb_frontend_field_object_id GET paramete=
r on any page that hosts a frontend submission form regardless of whether a= llow_delete is enabled. 2026-07-29 9.1 CVE-2026-14488 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-14488 ] Microsoft--Azure Cosmos DB Improper access=
control in Azure Cosmos DB allows an unauthorized attacker to execute code=
over a network. 2026-07-30 10 CVE-2026-66803 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-66803 ] mihail-chepovskiy--Web Directory Free The Web Dire= ctory Free plugin for WordPress is vulnerable to generic SQL Injection via = the 'levels' parameter in all versions up to, and including, 1.7.13 due to = insufficient escaping on the user supplied parameter and lack of sufficient=
preparation on the existing SQL query. This makes it possible for unauthen= ticated attackers to append additional SQL queries into already existing qu= eries that can be used to extract sensitive information from the database. = 2026-07-28 7.5 CVE-2026-14785 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -14785 ] MikroTik--RouterOS MikroTik RouterOS contains a weakness in its AP=
I authentication handling that lacks effective safeguards against excessive=
login attempts. The system does not enforce meaningful rate-limiting, acco= unt lockout, or source-based restrictions, allowing repeated authentication=
failures to proceed without defensive response. In some versions, a fixed = per-connection delay is present, but it can be bypassed through concurrent = sessions, resulting in continued high-volume attempts. This deficiency incr= eases the risk that an attacker could eventually obtain valid credentials a=
nd gain unauthorized access to administrative services. 2026-07-28 8.8 CVE-= 2026-16347 [ https://www.cve.org/CVERecord?id=3DCVE-2026-16347 ] miniOrange= --miniorange otp verification Unauthenticated Cross Site Scripting (XSS) in=
miniorange otp verification <=3D 5.5.1 versions. 2026-07-27 7.1 CVE-2026-6= 1957 [ https://www.cve.org/CVERecord?id=3DCVE-2026-61957 ] modelcontextprot= ocol--ruby-sdk MCP Ruby SDK is the official Ruby SDK for Model Context Prot= ocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::Streama= bleHTTPTransport in the mcp gem reads and parses an entire JSON-RPC POST bo=
dy without a size limit, allowing an unauthenticated remote attacker to exh= aust process memory. This issue is fixed in version 0.23.0. 2026-07-29 7.5 = CVE-2026-67432 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67432 ] motov.= net--Ebook Store Unauthenticated Sensitive Data Exposure in Ebook Store <=
=3D 6.19 versions. 2026-07-27 7.5 CVE-2026-59529 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-59529 ] MZ Automation GmbH--libiec61850 The ISO Present= ation layer contains a flaw in the handling of specific parameters during n= ormal mode negotiation. A missing length check in the processing of the enc= oded presentation data allows an attacker controlled field with a zero leng=
th value to trigger a bounded heap over read. This condition occurs before = MMS session establishment, a crafted TCP/102 connection attempt can trigger=
the issue. The resulting over read causes the process to terminate, leadin=
g to a denial of service condition. 2026-07-30 7.5 CVE-2026-66360 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-66360 ] NASA--Core Flight System (cFS)=
Health & Safety (HS) Application An incomplete fix for CVE-2026-15352 in t=
he NASA core Flight System (cFS) Health and Safety (HS) application leaves =
a separate NULL pointer dereference reachable in versions through 7.0.1. An=
attacker who can trigger the affected command under specific conditions co= uld cause the HS application to crash, resulting in a denial-of-service con= dition and processor reset. 2026-07-30 7.5 CVE-2026-18064 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-18064 ] NASA-AMMOS--AIT-DSN AMMOS Instrument T= oolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a mis= sing authentication vulnerability in the Space Link Extension (SLE) interfa=
ce manager that allows unauthenticated network attackers to access seven un= protected API routes by sending direct HTTP requests with no credentials. A= ttackers can reach the exposed SLE endpoints to start or stop Deep Space Ne= twork communication sessions, retrieve telemetry frame data, and inject arb= itrary frames into active spacecraft links. 2026-07-29 9.8 CVE-2026-60113 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-60113 ] NASA-AMMOS--AIT-GUI AM= MOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentica= tion vulnerability that allows any unauthenticated network attacker to obta=
in a valid session and issue arbitrary spacecraft commands by calling Sessi= ons.create() without any credential check. Attackers can exploit the unauth= enticated session issuance in Sessions.create() and subsequently invoke han= dle_cmd() to forward arbitrary commands directly to the AIT command bus wit= hout any authentication gate between session creation and command dispatch.=
2026-07-29 9.8 CVE-2026-60112 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-60112 ] nessshon--tonapi pytonapi is a Python SDK for TONAPI that provide=
s REST API, streaming, and webhook access to the TON blockchain. From 2.0.0=
to 2.2.0, TonapiWebhookDispatcher fails to validate the Authorization head=
er when a webhook handler is registered with the documented path argument, = because setup() stores bearer tokens only under the default suffix paths an=
d never adds the custom path to the token map, so self._tokens.get(path) re= turns None and the authentication guard is skipped. An unauthenticated remo=
te attacker can POST forged payloads to the custom webhook endpoint and tri= gger victim-defined handlers. This issue is fixed in version 2.2.1. 2026-07= -28 7.5 CVE-2026-54635 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54635 =
] netty--netty Netty is an asynchronous, event-driven network application f= ramework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerC= ertificateValidator flags an out-of-date OCSP response but does not stop pr= ocessing it, so an expired GOOD response is still reported as VALID, lettin=
g an on-path attacker replay a stale GOOD response to bypass revocation of =
a since-revoked certificate. Exploitation can lead to certificate revocatio=
n bypass via replay of an expired OCSP response. Any application using Ocsp= ServerCertificateValidator is affected; a revoked certificate can be accept= ed. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final. 2= 026-07-28 7.4 CVE-2026-56821 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 56821 ] netty--netty Netty is an asynchronous, event-driven network applica= tion framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspS= erverCertificateValidator forwards the SslHandshakeCompletionEvent before t=
he asynchronous OCSP validation completes. This allows the client's downstr= eam handlers to send sensitive application data (e.g., HTTP requests) to a = revoked server before the channel is closed by the OCSP check. n io.netty.h= andler.ssl.ocsp.OcspServerCertificateValidator#userEventTriggered, when an = SslHandshakeCompletionEvent is received, the validator immediately calls ct= x.fireUserEventTriggered(evt). It then initiates an asynchronous OCSP query=
using OcspClient.query. Because the handshake completion event is forwarde=
d immediately, downstream handlers in the client's pipeline are notified th=
at the TLS handshake is successful. They may then begin reading and process= ing incoming application data or sending outgoing data. If the OCSP respons=
e later indicates the server's certificate is REVOKED, the validator closes=
the channel, but by this time, the client may have already leaked sensitiv=
e data to a revoked server or processed malicious responses from it. This i= ssue has been fixed in versions 4.1.136.Final and 4.2.16.Final. 2026-07-28 = 7.4 CVE-2026-56822 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56822 ] Ne= xcess--GiveWP Unauthenticated Cross Site Scripting (XSS) in GiveWP <=3D 4.1= 6.3 versions. 2026-07-27 7.1 CVE-2026-65441 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-65441 ] nico23--Advanced Responsive Video Embedder for Rumbl=
e, Odysee, YouTube, Vimeo, Kick The Advanced Responsive Video Embedder for = Rumble, Odysee, YouTube, Vimeo, Kick plugin for WordPress is vulnerable to = Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulne= rability exists because the `_arve_uc_init()` function - registered on Word= Press's `init` hook at priority 1 so that it runs before any authentication=
checks on every request - reads an attacker-supplied token from the `_wplo= gin` (or `_wpm`) parameter and compares it against a hardcoded SHA-256 hash=
embedded directly in the plugin source, with no nonce verification, no cap= ability check, and no password validation anywhere in the flow. Because thi=
s static hash constitutes a set of universal credentials that are publicly = accessible in the plugin's source code, unauthenticated attackers can suppl=
y the known token to be authenticated as an arbitrarily selected existing a= dministrator account, gaining full administrative control over the affected=
WordPress site. This was likely introduced by an attacker who gained commi=
t access to the developers account. 2026-07-29 9.8 CVE-2026-18072 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-18072 ] nitroshare--nitroshare-desktop=
NitroShare Desktop through 0.3.4 contains a path traversal vulnerability i=
n its LAN file transfer server that allows unauthenticated attackers on the=
same network to write arbitrary files by sending a crafted filename contai= ning directory traversal sequences in the JSON item header name field. Atta= ckers can exploit the lack of path validation to write files outside the tr= ansfer root directory to arbitrary locations the current user has write acc= ess, including the Windows Startup folder, enabling persistent code executi=
on on the next user login. 2026-07-27 7.5 CVE-2026-66050 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-66050 ] NVIDIA--DCGM NVIDIA DCGM Exporter for a=
ll platforms contains a vulnerability in the /debug/pprof endpoints, where =
an attacker could cause uncontrolled resource consumption by submitting con= current unauthenticated profiling requests. A successful exploit of this vu= lnerability might lead to denial of service and information disclosure. 202= 6-07-28 8.2 CVE-2026-47483 [ https://www.cve.org/CVERecord?id=3DCVE-2026-47= 483 ] NVIDIA--NeMo Framework NVIDIA NeMo for Linux contains a vulnerability=
where an attacker may cause OS command injection. A successful exploit of = this vulnerability may lead to code execution, data tampering, escalation o=
f privileges and information disclosure. 2026-07-27 7.8 CVE-2026-24252 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-24252 ] o6 Automation--open62541 =
A heap use-after-free vulnerability in the TransferSubscriptions service in=
open62541 may allow an authenticated attacker to cause a denial of service=
or potentially execute arbitrary code. 2026-07-30 8.1 CVE-2026-63035 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-63035 ] o6 Automation--open62541 A=
n integer overflow in the UA_Variant arrayDimensions product computation in=
open62541 may allow a remote attacker to trigger an out-of-bounds write. 2= 026-07-30 8.8 CVE-2026-65423 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 65423 ] o6 Automation--open62541 An integer overflow in the UA_Variant arra= yDimensions product computation in open62541 may allow a remote attacker to=
read out-of-bounds heap memory, potentially disclosing sensitive informati= on. 2026-07-30 7.5 CVE-2026-63559 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-63559 ] OliveTin--OliveTin OliveTin gives access to predefined shell c= ommands from a web interface. From 3000.0.0 until 3000.17.0, the service/in= ternal/auth/otoauth2/restapi_auth_oauth2.go OAuth2 login handler stores per= -login state in the registeredStates map on every /oauth/login request with= out expiring, deleting, or bounding entries, allowing an unauthenticated at= tacker to exhaust memory and cause a denial of service. This issue is fixed=
in version 3000.17.0. 2026-07-29 7.5 CVE-2026-67437 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-67437 ] opencost--opencost OpenCost before 1.121.0 = fails to authenticate the GET /helmValues endpoint, exposing base64-decoded=
HELM_VALUES environment variable containing cloud provider credentials. Ad= ditionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allow= ing unauthenticated attackers to modify GCP service account keys via POST /= serviceKey to redirect billing calls. 2026-07-30 7.5 CVE-2026-67349 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-67349 ] openwrt--luci luci-app-https= -dns-proxy contains a stored cross-site scripting vulnerability in the reso= lver_url parameter that allows authenticated users to inject active HTML. W= hen an administrator views the HTTPS DNS Proxy status page, the resolver UR=
L is rendered as raw HTML and executes JavaScript in the administrator's br= owser origin. 2026-08-01 7.6 CVE-2026-67352 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-67352 ] opf--openproject OpenProject is open-source, web-bas=
ed project management software. Prior to 17.6.0, PATCH /api/v3/work_package= s/{id} accepted _links.fileLinks and allowed authenticated users with edit_= work_packages but without manage_file_links to resolve Storages::FileLink r= ecords by raw id, detach or hard-delete existing FileLinks, and re-parent F= ileLinks from other projects to an attacker-controlled work package, exposi=
ng origin filename, origin id, and MIME type metadata. This issue is fixed =
in 17.6.0. 2026-07-30 7.6 CVE-2026-67527 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-67527 ] owen2345--camaleon-cms Camaleon CMS versions 2.1.1 thro= ugh 2.9.1 contains an authenticated remote code execution vulnerability tha=
t allows users with custom_fields manage permission to execute arbitrary Ru=
by code by supplying a malicious expression through the select_eval custom = field type. Attackers can store an attacker-controlled Ruby expression in t=
he field options command parameter, which is evaluated via instance_eval wi= thin an ERB view whenever a post edit page is rendered, achieving server-si=
de code execution with web server process privileges. 2026-07-28 8.8 CVE-20= 26-66748 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66748 ] Payment Plug= ins--Stripe For WooCommerce Unauthenticated Broken Access Control in Stripe=
For WooCommerce <=3D 4.0.7 versions. 2026-07-27 7.5 CVE-2026-59530 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-59530 ] pgadmin.org--pgAdmin 4 /misc= /workspace/adhoc_connect_server, part of the Workspaces feature introduced =
in pgAdmin 4 9.0, when passed the id of an existing server, clones that ser= ver via Server.clone(), which copies every column from the source row, incl= uding user_id, shared, shared_username, and the stored credential fields pa= ssword, save_password, and tunnel_password. When a non-owner triggered an a= dhoc connect against another user's (in practice, typically an administrato= r's) shared server, the clone inherited that user's ownership, shared flag,=
and stored database credentials verbatim. pgAdmin persisted this cross-ten= ant, credential-bearing server row before the connection was even attempted=
, so it survived even when the connection subsequently failed. The non-owne=
r could then open the newly-owned clone and pgAdmin would connect using the=
source user's stored database password on the non-owner's behalf, granting=
the non-owner use of database credentials -- and whatever database privile= ges they confer -- that were never their own. Fix forces the cloned adhoc r= ecord's ownership fields (user_id, shared, shared_username) and stored cred= ential fields (password, save_password, tunnel_password) to belong to the c= alling user and be cleared/private before committing, regardless of the sou= rce server's ownership, sharing state, or stored credentials. A regression = test asserts that an adhoc connect triggered by a non-owner against another=
user's shared server persists a row owned by the caller, not shared, and w= ithout the source's stored credentials. This issue affects pgAdmin 4: from = 9.0 before 9.17. 2026-07-31 9.6 CVE-2026-17349 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-17349 ] pgadmin.org--pgAdmin 4 The fix for CVE-2026-12045=
in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assista= nt's execute_sql_query tool to parse, via sqlparse, as exactly one non-tran= saction-control statement before running it inside a BEGIN TRANSACTION READ=
ONLY wrapper. sqlparse's string-literal lexing can disagree with PostgreSQ= L's own parser: under standard_conforming_strings =3D on (PostgreSQL's defa= ult since 9.1), a backslash immediately before a quote is an ordinary chara= cter to PostgreSQL, but sqlparse treats it as escaping the quote. A payload=
such as SELECT ';COMMIT;CREATE TABLE pwn(x int);SELECT 1 --' therefore par= ses as a single SELECT to sqlparse's validator, while PostgreSQL executes i=
t as four statements: the smuggled COMMIT ends the wrapping read-only trans= action, and the trailing ROLLBACK becomes a no-op. This reintroduces the sa=
me write/RCE bypass CVE-2026-12045 was meant to close, reachable via the sa=
me indirect prompt-injection delivery (an attacker plants the payload in an=
y object the AI Assistant may read; the LLM emits it as a tool call). An in= itial candidate fix ran the query with psycopg's execute(..., prepare=3DTru= e), intending to force PostgreSQL's own Parse step (extended query protocol=
) to reject multi-statement text regardless of sqlparse's classification. T= his candidate fix does not work as submitted: psycopg3's PrepareManager sil= ently ignores the prepare argument whenever the connection's prepare_thresh= old is None, which is pgAdmin's default for every server connection (the pe= r-server "Prepare threshold" field is blank unless an administrator explici= tly sets it) -- psycopg3 falls back to the simple query protocol, the same = multi-statement-capable path the bypass exploits, so the candidate fix clos=
es nothing on any real-world default configuration. The corrected fix sets = conn.prepare_threshold =3D 0 directly on the dedicated, single-use read-onl=
y connection the AI Assistant tool opens, structurally forcing the extended=
query protocol independent of any server-level configuration. Verified aga= inst a live PostgreSQL 18 instance: the payload executes successfully under=
the prepare_threshold=3DNone (default) behavior, and is rejected with "can= not insert multiple commands into a prepared statement" once prepare_thresh= old=3D0 is set on that connection. This issue affects pgAdmin 4: from 9.13 = before 9.17. 2026-07-31 9 CVE-2026-17351 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-17351 ] pgadmin.org--pgAdmin 4 pgAdmin 4's Import/Export Data t= ool builds a psql \copy (...) command line by interpolating a user-supplied=
SQL query into a Jinja template and passing the rendered line to psql via = --command. To stop an attacker from breaking out of the (...) wrapper, crea= te_import_export_job() (route POST /import_export/job/<sid>, gated only by = the ordinary, commonly-granted tools_import_export_data permission) validat=
ed the query with a hand-written parenthesis-balance checker, _is_query_par= ens_balanced(). That checker always treated a backslash before a single quo=
te () as escaping the quote, i.e. as if standard_conforming_strings were of=
f. PostgreSQL has defaulted standard_conforming_strings to on since 9.1 (20= 10), the default on every PostgreSQL version pgAdmin 4 currently supports (= 13-18); under that default psql's own \copy tokenizer treats \ as an ordina=
ry character, so a single quote immediately after it closes the string lite= ral. A query such as SELECT 'a) TO PROGRAM 'echo pwned' x' was therefore ac= cepted as "balanced" by pgAdmin's checker (which believed the ) was still i= nside the string), while psql, run through the actual rendered command line=
, closes the string at that point and treats the following ) as the end of = the wrapping \copy (...) subquery, exposing an attacker-chosen TO PROGRAM '= <command>' clause that psql executes via popen() -- independent of a subseq= uent syntax error later on the same line. This is the same class of bug as = CVE-2025-12762/CVE-2025-13780 (RCE via psql meta-command/COPY injection dur= ing PLAIN-format dump restore), reached through an independently written de= fense in a different module (Import/Export Data rather than Restore) that h=
ad its own, different logic bug (inverted backslash-escape semantics rather=
than a BOM-defeated regex anchor). The fix rejects any backslash inside a = single-quoted string in the query outright, rather than picking one of the = two possible psql interpretations. This is intentionally conservative: beca= use the correct interpretation of \ depends on the target server's standard= _conforming_strings setting, which the checker cannot reliably know at vali= dation time, refusing the query is safer than guessing. This issue affects = pgAdmin 4: from the introduction of _is_query_parens_balanced() before 9.18=
. 2026-07-31 9.9 CVE-2026-17566 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-17566 ] pgadmin.org--pgAdmin 4 The fix for CVE-2026-12044 in pgAdmin 4 9= .16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgst= atindex templates to it, but missed several sinks that had been placed in t= est_sql_string_literal_lint.py's ALLOWLIST on the incorrect assumption that=
schema, table, publication, and subscription names sourced from pg_catalog=
via the browser tree could never contain an apostrophe. PostgreSQL permits=
arbitrary characters in quoted identifiers, so a low-privileged user able =
to CREATE TABLE, CREATE PUBLICATION, or CREATE SUBSCRIPTION can plant an ap= ostrophe'd object name that breaks out of the unescaped '{{ name }}' templa=
te interpolation the moment any user (including a higher-privileged one) op= ens that object's Statistics or Dependencies tab, allowing arbitrary SQL st= atement injection in the viewing user's database session. Affected sinks: t=
he Index Statistics query for all-indexes listing (coll_stats.sql, both the=
16_plus and default PostgreSQL-version template variants -- distinct from = the single-index stats.sql path already fixed in CVE-2026-12044), and the p= ublication and subscription dependencies.sql / get_position.sql templates (= both the pg and ppas/EPAS dialect variants for publications). Fix switches = all of these templates to qtLiteral(conn) for name interpolation, and updat=
es publications/__init__.py and subscriptions/__init__.py to pass conn=3Dse= lf.conn into the dependencies.sql render_template call so the qtLiteral fil= ter has a connection to quote against. The corresponding ALLOWLIST entries =
in test_sql_string_literal_lint.py are removed now that these sinks are pro= perly escaped rather than merely assumed safe. A behavioral regression test=
renders each fixed template with a stacked-statement apostrophe payload an=
d asserts both that the object name appears exactly as qtLiteral-escaped an=
d that the rendered SQL parses as exactly one statement, verifying the asse= rtion genuinely fails against the pre-patch raw-interpolation form. This is= sue affects pgAdmin 4: the Index Statistics sink from 1.0, and the Publicat= ions/Subscriptions sinks from 5.0, both before 9.17. 2026-07-31 8.8 CVE-202= 6-17346 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17346 ] pgadmin.org--= pgAdmin 4 The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, le=
ts an administrator configure an external command that returns a per-user e= ncryption key, with %u in the configured string replaced by the current use= r's name. The previous implementation substituted the username directly int=
o the command string and executed the result with subprocess.Popen(..., she= ll=3DTrue). Because the username can originate from an external authenticat= ion source (OAuth/OIDC claims, Kerberos, webserver auth) rather than a valu=
e pgAdmin fully controls, a username containing shell metacharacters (';', = '$()', backticks, pipes, '&&', newlines) allowed an authenticated user to e= xecute arbitrary commands as the pgAdmin service account in any deployment = where the configured hook string uses %u. Fix tokenises the trusted, admini= strator-configured hook string into an argument vector first (using shlex i=
n POSIX-quoting mode, with backslash-escaping disabled so Windows-style pat=
hs are not mis-parsed), substitutes the untrusted username into the individ= ual argv elements, and executes with shell=3DFalse. The username is therefo=
re always confined to a single argv element; any shell metacharacters it co= ntains are inert. Administrators whose MASTER_PASSWORD_HOOK previously reli=
ed on shell features (pipes, redirection, environment-variable expansion, g= lobbing) within the hook string itself must move that logic into the invoke=
d script, since it is no longer interpreted by a shell. This issue affects = pgAdmin 4: from 7.2 before 9.17. 2026-07-31 7.5 CVE-2026-17347 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-17347 ] pgvector--pgvector Integer wrapar= ound in IVFFlat index build in pgvector before 0.8.6 allows a database user=
to write data out-of-bounds, which could lead to arbitrary code execution.=
Only 32-bit systems are affected. 2026-07-29 8.8 CVE-2026-18022 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-18022 ] pheditor--pheditor Pheditor is =
a single-file editor and file manager written in PHP. From version 2.0.1 to=
before version 2.0.4, an OS Command Injection vulnerability in the termina=
l action handler allows any authenticated user to execute arbitrary OS comm= ands by injecting shell metacharacters into the 'dir' POST parameter, compl= etely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote C= ode Execution with web server privileges. This issue has been patched in ve= rsion 2.0.4. 2026-07-27 9.9 CVE-2026-48030 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-48030 ] pheditor--pheditor Pheditor is a single-file editor a=
nd file manager written in PHP. From version 2.0.1 to before version 2.0.6,=
Pheditor ships with a hardcoded default password admin (SHA-512 hash store=
d at pheditor.php:11). There is no mechanism to force a password change on = first login. Any deployment using the default credentials grants an attacke=
r full access to the file editor, file upload, and terminal features, enabl= ing arbitrary file read/write and remote code execution. This issue has bee=
n patched in version 2.0.6. 2026-07-27 9.8 CVE-2026-55579 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-55579 ] pheditor--pheditor Pheditor is a singl= e-file editor and file manager written in PHP. Prior to version 2.0.5, ther=
e is an authenticated terminal command whitelist bypass. The terminal featu=
re checks whether the submitted command starts with one of the configured T= ERMINAL_COMMANDS values, then passes the full command string to shell_exec(=
). Shell command substitution such as $() is not blocked, so an authenticat=
ed user with the terminal permission can bypass a restricted command allowl= ist and execute arbitrary shell commands as the web server user. This issue=
has been patched in version 2.0.5. 2026-07-27 8.8 CVE-2026-54540 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-54540 ] pheditor--pheditor Pheditor is=
a single-file editor and file manager written in PHP. From version 2.0.1 t=
o before version 2.0.6, the terminal feature in Pheditor uses an incomplete=
character blocklist to sanitize user-supplied commands before passing them=
to shell_exec(). After the fix for GHSA-9643-6xjp-vx57 (which added $ to t=
he blocklist), the characters | (single pipe), ` (backtick), and the newlin=
e byte (0x0A) remain unblocked. An authenticated user with the terminal per= mission (enabled by default) can leverage any of these to bypass the TERMIN= AL_COMMANDS allowlist and execute arbitrary OS commands as the web server u= ser. This issue has been patched in version 2.0.6. 2026-07-27 8.8 CVE-2026-= 55578 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55578 ] Phoenix Contact= --CHARX SEC-3150 Due to missing authentication, an unauthenticated remote a= ttacker may access the MQTT broker, which is only protected from external a= ccess by a firewall. This may lead to the device being fully compromised. 2= 026-07-30 9.8 CVE-2026-44090 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 44090 ] Phoenix Contact--CHARX SEC-3150 An unauthenticated remote attacker = can post a malicious ID to the MQTT Broker results in the creation of a new=
configuration entry in the system configuration. This may lead to integrit=
y and availability loss. 2026-07-30 9.1 CVE-2026-44091 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-44091 ] Phoenix Contact--CHARX SEC-3150 An unauth= enticated remote attacker can inject malicious input into the ModbusServer = application because it does not validate the input it fetches from MQTT. Th=
is may lead to integrity and availability loss. 2026-07-30 9.1 CVE-2026-440=
92 [ https://www.cve.org/CVERecord?id=3DCVE-2026-44092 ] Phoenix Contact--C= HARX SEC-3150 The CHARX JupiCore service allows an unauthenticated remote a= ttacker to reconfigure charging points. This can lead to disclosure of char= ging point UIDs, Denial-of-Service and files tampering. 2026-07-30 9.4 CVE-= 2026-44100 [ https://www.cve.org/CVERecord?id=3DCVE-2026-44100 ] Phoenix Co= ntact--CHARX SEC-3150 Due to missing authentication the CHARX OCPP Agent se= rvice allows an unauthenticated remote attacker to reconfigure the backend = connection. This can lead to Denial-of-Service and confidential data being = disclosed to the attacker. 2026-07-30 9.8 CVE-2026-44101 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-44101 ] Phoenix Contact--CHARX SEC-3150 The fir= mware update process for the basemodule of the charging controller only val= idates the CRC32 checksum without cryptographic signature verification. Thi=
s allows an unauthenticated remote attacker to install a modified firmware,=
resulting in full system compromise. 2026-07-30 9.8 CVE-2026-44104 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-44104 ] Phoenix Contact--CHARX SEC-3= 150 Due to a flaw in the execution order of scripts during shutdown, the fi= rewall is terminated prematurely during system shutdown. This creates a tem= porary window in which internal services may become externally accessible, = potentially allowing an unauthenticated remote attacker to connect to these=
services, resulting in full system compromise. 2026-07-30 9.8 CVE-2026-441=
08 [ https://www.cve.org/CVERecord?id=3DCVE-2026-44108 ] Phoenix Contact--C= HARX SEC-3150 Due to improper neutralization of special elements, an unauth= enticated remote attacker is able to inject a command into the system confi= guration which is subsequently executed as root. 2026-07-30 9.8 CVE-2026-78=
49 [ https://www.cve.org/CVERecord?id=3DCVE-2026-7849 ] Phoenix Contact--CH= ARX SEC-3150 An unauthenticated remote attacker can enforce the system to f= all back to a firmware partition with an insecure configuration including d= efault credentials. This could allow the attacker to gain SSH access to the=
system as an unprivileged user "user-app". Charging could be interrupted. = 2026-07-30 8.6 CVE-2026-44094 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -44094 ] Phoenix Contact--CHARX SEC-3150 This vulnerability allows an unaut= henticated remote attacker with control over the OCPP backend via firewall-= bypass to perform an OS command injection, resulting in the execution of ar= bitrary commands as the limited user charx-oa. Charging could be interrupte=
d. 2026-07-30 8.6 CVE-2026-44098 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-44098 ] Phoenix Contact--CHARX SEC-3150 A local privilege escalation vu= lnerability in the init-script for user-applications allows a low-privilege=
d local user to execute arbitrary commands as root, resulting in full syste=
m compromise. 2026-07-30 7.8 CVE-2026-44093 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-44093 ] Phoenix Contact--CHARX SEC-3150 A privilege escalati=
on vulnerability in a script used for network configuration allows a low-pr= ivileged local user to execute arbitrary commands as root, resulting in ful=
l system compromise. 2026-07-30 7.8 CVE-2026-44095 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-44095 ] Phoenix Contact--CHARX SEC-3150 A privilege e= scalation vulnerability in udhcpc allows a local user "charx-web" to execut=
e arbitrary commands as root, resulting in full system compromise. 2026-07-=
30 7.8 CVE-2026-44096 [ https://www.cve.org/CVERecord?id=3DCVE-2026-44096 ]=
Phoenix Contact--CHARX SEC-3150 A low-privileged remote attacker with "ope= rator" access can upload arbitrary files via the REST endpoint intended for=
firmware updates, resulting in persistent storage of attacker-controlled f= iles and potentially exhausting resources, which might lead to Denial-of-Se= rvice. 2026-07-30 7.1 CVE-2026-44097 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-44097 ] Phoenix Contact--CHARX SEC-3150 A privilege escalation vuln= erability in the system configuration allows a low-privileged local user to=
execute arbitrary commands as root, resulting in full system compromise. 2= 026-07-30 7.8 CVE-2026-44099 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 44099 ] Phoenix Contact--CHARX SEC-3150 A privilege escalation vulnerabilit=
y in the init-script for user-applications allows a low-privileged local us=
er to execute arbitrary commands as root, resulting in full system compromi= se. 2026-07-30 7.8 CVE-2026-44106 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-44106 ] Phoenix Contact--CHARX SEC-3150 A reboot of the charging contr= oller can be triggered via Modbus TCP without authentication. Therefore, wh=
en the Modbus functionality is enabled by opening the port that CharxModbus= Server is listening, an unauthenticated attacker can perform a Denial-of-Se= rvice attack. 2026-07-30 7.5 CVE-2026-44107 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-44107 ] PHPOffice--PhpSpreadsheet PhpSpreadsheet is a pure P=
HP library for reading and writing spreadsheet files. In versions 4.0.0 thr= ough 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17=
, and all releases up to and including 1.30.5, the WEBSERVICE() domain whit= elist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Servi= ce.php, the webService() method validates a URL's host against the whitelis=
t set via Spreadsheet::setDomainWhiteList(), then fetches content with file= _get_contents($url, false, $ctx); because PHP's HTTP stream wrapper follows=
301/302 redirects automatically (up to 20 hops) and the redirect target is=
never re-validated, an attacker who can trigger a redirect from a whitelis= ted domain can reach arbitrary URLs, including internal addresses. An attac= ker able to upload XLSX files to an application that uses setDomainWhiteLis= t() and getCalculatedValue() can achieve a full-read SSRF, returning up to = 32,767 bytes of the response body as a cell's calculated value, which enabl=
es exfiltration of cloud metadata (AWS/GCP/Azure credentials via http://169= .254.169.254/), access to internal-only services, and internal port scannin=
g (the port is not validated). This issue has been fixed in versions 5.8.1,=
3.10.7, 2.4.7, 2.1.18, and 1.30.6. 2026-07-28 7.7 CVE-2026-59931 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-59931 ] PHPOffice--PhpSpreadsheet PhpS= preadsheet is a pure PHP library for reading and writing spreadsheet files.=
In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6=
, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gn= umeric reader reads attacker-supplied .gnumeric files into memory and, when=
the file starts with gzip magic bytes, calls gzdecode() on the full compre= ssed contents without enforcing a decompressed-size limit. A very small com= pressed .gnumeric file can expand to data larger than the PHP memory limit = and crash the process during Gnumeric::canRead() before the file is rejecte=
d or fully parsed. This is reachable through normal file-type detection and=
Gnumeric loading paths, so applications that accept attacker-controlled sp= readsheet uploads can suffer denial of service. This issue has been fixed i=
n versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6. 2026-07-28 7.5 CVE-2026= -59932 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59932 ] PHPOffice--Php= Spreadsheet PhpSpreadsheet is a pure PHP library for reading and writing sp= readsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2=
.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and includin=
g 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS= /OLE metadata without detecting cycles or enforcing a maximum chain length.=
A tiny malformed .xls/OLE file can set the small-block depot sector chain =
to point back to itself. During normal XLS detection, OLERead::read() appen=
ds the same sector data repeatedly until the PHP process exhausts memory. T= his is reachable from Reader\Xls::canRead() and therefore from automatic sp= readsheet type detection. Applications that accept attacker-controlled spre= adsheet uploads can suffer denial of service from a very small file. This i= ssue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6. 20= 26-07-28 7.5 CVE-2026-59933 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5= 9933 ] phun-ky--defaults-deep @phun-ky/defaults-deep is a library like loda=
sh defaultsDeep with array preservation and no lodash dependency. Prior to = 2.0.5, defaultsDeep() recursively merges user-supplied objects without filt= ering proto, constructor, and prototype, allowing properties to be written =
to Object.prototype. This issue is fixed in version 2.0.5. 2026-07-31 7.3 C= VE-2026-54737 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54737 ] pickplu= gins--PickPlugins Question Answer The PickPlugins Question Answer plugin fo=
r WordPress is vulnerable to SQL Injection in versions up to and including = 1.2.73. This is due to insufficient sanitization of user-supplied input via=
the 'id' GET parameter in the user profile template combined with the use =
of wp_unslash() which removes WordPress's magic quotes protection, followed=
by direct concatenation into a SQL query without proper escaping or prepar=
ed statements in the qa_user_profile_card() function. This makes it possibl=
e for unauthenticated attackers to append additional SQL queries into exist= ing queries, which can be used to extract sensitive information from the da= tabase. 2026-07-28 7.5 CVE-2026-10207 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-10207 ] pionxzh--wakaru wakaru is a JavaScript decompiler and unmi= nifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-contro= lled module filenames only once before writing extracted modules, so a craf= ted filename containing overlapping traversal sequences such as ....// coll= apses to ../ after sanitization and lets the final output path escape the s= elected output directory, allowing an attacker who can cause a user to run = wakaru --unpack on a malicious bundle to write files outside that directory=
and, depending on the target path and environment, potentially achieve cod=
e execution. This issue is fixed in @wakaru/cli 1.4.0. 2026-07-28 7.1 CVE-2= 026-54545 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54545 ] postcss--po= stcss PostCSS takes a CSS file and provides an API to analyze and modify it=
s rules by transforming the rules into an Abstract Syntax Tree. In versions=
8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=3DPATH *=
/ comment from any CSS string passed to process() and dereferences PATH aga= inst the local filesystem with no scheme, allowlist, or traversal check. An=
attacker who controls the CSS input can cause the host process to read any=
file readable by Node and leak the first ~10 bytes of its content through = the resulting JSON.parse SyntaxError message. The bug also yields a precise=
file-existence oracle and a controllable-read primitive that may be combin=
ed with large-file targets for DoS. The behaviour is triggered with PostCSS=
's default options - no from, no map, no plugins required - and is therefor=
e reachable from any pipeline that runs untrusted CSS through PostCSS (CMS = themes, user-uploaded styles, browser-extension/userstyle processors, build=
pipelines for third-party packages, blog comment renderers, etc.). This is= sue has been fixed in version 8.5.12. 2026-07-27 7.5 CVE-2026-45623 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-45623 ] prebid--prebid-server Prebid=
Server is an open-source solution for running real-time advertising auctio=
ns in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid = Server interpolate user-supplied parameters into outbound request URLs with= out properly validating host and subdomain values, allowing crafted bid req= uest parameters to cause server-side requests to unintended destinations an=
d potentially expose internal network services or sensitive server endpoint=
s. This issue is fixed in version 4.4.0. 2026-07-29 10 CVE-2026-54735 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-54735 ] Progress Software--LoadMas= ter An OS Command Injection vulnerability in Progress Software LoadMaster, = ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF all= ows an authenticated attacker with high privileges to execute arbitrary ope= rating system commands on the affected appliance via the management interfa= ce, potentially resulting in complete system compromise. 2026-07-27 8.4 CVE= -2026-59686 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59686 ] Progress = Software--LoadMaster An OS Command Injection vulnerability in Progress Soft= ware LoadMaster, ECS Connection Manager, Object Scale Connection Manager, a=
nd MOVEit WAF allows an authenticated attacker with high privileges to exec= ute arbitrary operating system commands on the affected appliance via the G=
eo Location management interface, potentially resulting in complete system = compromise. 2026-07-27 8.4 CVE-2026-59687 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-59687 ] Progress Software--LoadMaster An OS Command Injection = vulnerability in Progress Software LoadMaster, ECS Connection Manager, Obje=
ct Scale Connection Manager, and MOVEit WAF allows an authenticated attacke=
r with high privileges to execute arbitrary operating system commands on th=
e affected appliance via the backup restore functionality, potentially resu= lting in complete system compromise. 2026-07-27 8.4 CVE-2026-59688 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-59688 ] Progress Software--LoadMaster=
An Incorrect Authorization vulnerability in Progress Software LoadMaster, = ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF all= ows an authenticated attacker with low privileges to escalate privileges to=
root on the affected appliance, potentially resulting in full system compr= omise. 2026-07-27 8 CVE-2026-59689 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-59689 ] Progress Software--LoadMaster A Missing Authorization vulnera= bility in Progress Software LoadMaster, ECS Connection Manager, Object Scal=
e Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated = attacker with low privileges to perform privileged administrative operation=
s via the REST API that should not be accessible to their permission level,=
potentially resulting in a system compromise. 2026-07-27 8 CVE-2026-59690 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-59690 ] pronamic--Pronamic Pa=
y The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalati=
on in all versions up to, and including, 10.1.0 This is due to the `maybe_u= pdate_user_role()` function passing an attacker-controlled Gravity Forms fi= eld value (`$lead[$feed->user_role_field_id]`) directly into `WP_User::set_= role()` without any allowlist validation, capability comparison, or permiss= ion check to constrain which roles can be assigned. This makes it possible = for authenticated attackers, with Subscriber-level access and above, to esc= alate their own WordPress account to Administrator by tampering with the ro=
le field value in a form submission. Exploitation requires that an administ= rator has already configured a Pronamic Pay payment feed in Gravity Forms w= ith the **Update User Role** option enabled and mapped to a form field; onc=
e that configuration is in place, no further preconditions exist to prevent=
an authenticated attacker from exploiting this vulnerability. 2026-08-01 8=
.8 CVE-2026-16635 [ https://www.cve.org/CVERecord?id=3DCVE-2026-16635 ] pte= rodactyl--panel Pterodactyl is a free, open-source game server management p= anel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /up= load/file endpoint accepted any valid panel-signed JWT that contained serve= r_uuid, user_uuid, and unique_id claims without checking the token's intend=
ed purpose; because the Panel issues JWTs carrying those same claims for lo= wer-privilege operations such as WebSocket authentication and file-download=
links, an authenticated subuser could reuse one of those tokens (for examp=
le a WebSocket token obtained with only the websocket.connect permission) b=
y replaying it against /upload/file to write arbitrary files to the same se= rver, despite never being granted the file.create permission. This issue is=
fixed in Panel version 1.12.3 and Wings version 1.12.2. 2026-07-28 8.1 CVE= -2026-54593 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54593 ] pterodact= yl--panel Pterodactyl is a free, open-source game server management panel. = From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteSe= rviceProvider::configureRateLimiting() applied a single global bucket to th=
e login and two-factor checkpoint endpoints instead of keying by IP or acco= unt: the fall-through Limit::perMinute(10) covering POST /auth/login and PO=
ST /auth/login/checkpoint omitted ->by(), so Laravel derived a constant cac=
he key (md5('authentication')) shared by every request. An unauthenticated = attacker sending roughly ten requests per minute from a single IP, most che= aply against the checkpoint endpoint (which has no reCAPTCHA), exhausts the=
shared counter and causes HTTP 429 for every user attempting to log in or = complete two-factor authentication, a panel-wide authentication denial of s= ervice that also locks out administrators. This issue is fixed in version 1= .13.0. 2026-07-28 7.5 CVE-2026-61609 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-61609 ] pterodactyl--wings Wings is the server control plane for Pt= erodactyl, a free, open-source game server management panel. Prior to 1.12.=
3, {{config.}} placeholders in egg configuration-file templates allow a low= -privileged user to read {{config.token}}, {{config.token_id}}, and {{confi= g.docker.registries}} from the full daemon configuration. This issue is fix=
ed in version 1.12.3. 2026-07-31 9.9 CVE-2026-52855 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-52855 ] pterodactyl--wings Wings is the server contr=
ol plane for Pterodactyl, a free, open-source game server management panel.=
Prior to 1.13.0, a malformed packet received during the SFTP connection ha= ndshake causes a Go panic. This issue is fixed in version 1.13.0. 2026-07-3=
1 7.5 CVE-2026-52856 [ https://www.cve.org/CVERecord?id=3DCVE-2026-52856 ] = QuantumCloud--Simple Link Directory Pro Unauthenticated Server Side Request=
Forgery (SSRF) in Simple Link Directory Pro <=3D 15.0.6 versions. 2026-07-=
27 7.2 CVE-2026-61953 [ https://www.cve.org/CVERecord?id=3DCVE-2026-61953 ]=
Quiet-Terminal-Interactive--QTINeon QTI Neon is a minimal, game-agnostic, = relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's=
handleReconnectRequest forwards RECONNECT_REQUEST packets to the host with= out bounding them, so an unauthenticated client can drive relay-to-host amp= lification and cause a denial of service on the host. No fixed version is a= vailable as of this review. 2026-07-28 8.6 CVE-2026-54609 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-54609 ] realtyna--Realtyna Organic IDX plugin =
+ WPL Real Estate The Realtyna Organic IDX plugin + WPL Real Estate plugin = for WordPress is vulnerable to Arbitrary File Upload in all versions up to,=
and including, 5.2.0 via the upload function. This is due to missing file = type validation in the upload function, combined with a publicly accessible=
I/O endpoint authenticated solely by static, plugin-seeded API credentials=
that are identical across all installations. This makes it possible for un= authenticated attackers to upload files that may be executable, which makes=
remote code execution possible. The WPL I/O service endpoint is registered=
on the public WordPress init hook with no WordPress capability check, and = the required api_key and api_secret values are static defaults seeded by th=
e plugin's own SQL migration files, meaning any unauthenticated attacker wh=
o knows these publicly documented defaults can reach and exploit the vulner= able upload path. 2026-07-31 9.8 CVE-2026-14483 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-14483 ] realtyna--Realtyna Organic IDX plugin + WPL Real=
Estate The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbi= trary File Upload in versions up to, and including, 5.3.0. This is due to m= issing file extension and content validation in the saveLiveImages() functi=
on combined with an insufficient authorization check on the get_keys() AJAX=
handler and a missing authentication check on the REST API import endpoint=
. This makes it possible for authenticated attackers, with subscriber-level=
access and above, to upload arbitrary files on the affected site's server = which may make remote code execution possible. 2026-07-31 8.8 CVE-2026-1623=
6 [ https://www.cve.org/CVERecord?id=3DCVE-2026-16236 ] Red Hat--Cost Manag= ement Metrics Operator A flaw was found in koku-metrics-operator. The opera= tor's CostManagementMetricsConfig custom resource allows user able to edit = the CR to specify an arbitrary upload URL. When authentication.type is set =
to token (the default), the cluster-global Red Hat Cloud pull-secret bearer=
token is attached to HTTP requests sent to this user-controlled URL, allow= ing the attacker to obtain the token. 2026-07-30 7.6 CVE-2026-18378 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-18378 ] Red Hat--Cost Management Met= rics Operator A flaw was found in the koku-metrics-operator for Red Hat Ope= nShift. The operator's CostManagementMetricsConfig custom resource allows a=
user able to edit the CR to specify an arbitrary upload URL. The operator = attaches its own Kubernetes service-account bearer token to queries sent to=
this user-controlled URL, allowing the attacker to obtain the token. 2026-= 07-30 7.6 CVE-2026-18381 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1838=
1 ] Red Hat--Red Hat Advanced Cluster Security 4 A flaw was found in Red Ha=
t Advanced Cluster Security for Kubernetes (RHACS). When processing Kuberne= tes Deployments, ACS replaces deployment identity metadata based on the ope= nshift.io/encoded-deployment-config label. A user with permission to create=
Deployments can set this label to "null", causing ACS to treat the workloa=
d as having empty UID, name and labels and namespace "default". This bypass=
es deploy-time policy detection and enforcement visibility, prevents correc=
t persistence in Central and breaks violation reporting and compliance corr= elation for the affected deployment. 2026-07-31 8.5 CVE-2026-10079 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-10079 ] Red Hat--Red Hat Ansible Auto= mation Platform 2 A flaw was found in aap-gateway, a component of Ansible A= utomation Platform's Event-Driven Ansible (EDA). An unauthenticated remote = attacker can bypass mutual Transport Layer Security (mTLS) authentication f=
or event streams. This is achieved by manipulating the event stream URL and=
forging the HTTP Subject header. The system also inadvertently discloses t=
he expected certificate subject in error messages, which simplifies the att= ack. This vulnerability allows an attacker to inject arbitrary events into = EDA, potentially triggering automated workflows. 2026-07-31 8.2 CVE-2026-18= 141 [ https://www.cve.org/CVERecord?id=3DCVE-2026-18141 ] Red Hat--Red Hat = Ansible Automation Platform 2 A flaw was found in the Event-Driven Ansible = (EDA) server. The ExternalEventStreamViewSet uses permissive access control=
s (permission_classes=3D[AllowAny], authentication_classes=3D[]) and relies=
solely on the Subject HTTP header value for mTLS authentication without ve= rifying that the header originated from a trusted proxy. Additionally, the = expected certificate Distinguished Name is leaked in the 403 error response=
body. An attacker who can reach the EDA API endpoint with a spoofed Subjec=
t header can inject arbitrary events into mTLS-protected event streams, tri= ggering downstream automation actions. 2026-07-27 7.5 CVE-2026-12383 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-12383 ] Red Hat--Red Hat Directory = Server 11 A flaw was found in 389 Directory Server. An unauthenticated remo=
te attacker can inject LDAP search filters into the CleanAllRUV replication=
status-check extended operation. Because the handler performs the search a= gainst cn=3Dconfig with elevated replication plugin privileges and returns =
a boolean match result, the attacker can extract sensitive server configura= tion metadata, including replication bind DNs and password storage scheme i= nformation. 2026-07-31 7.5 CVE-2026-11770 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-11770 ] Red Hat--Red Hat Directory Server 11 A stack buffer ov= erflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvele= ment_from_berval() function in repl5_ruv.c copies digit characters from a n= etwork-supplied RUV berval into a fixed 16-byte stack buffer without bounds=
checking. A remote unauthenticated attacker can crash the LDAP server by s= ending a crafted StartNSDS50ReplicationRequest extended operation containin=
g a replica ID field with more than 16 digit characters. The overflow occur=
s during payload decoding, before any authorization check. Stack protectors=
limit impact to denial of service. 2026-07-31 7.5 CVE-2026-15722 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-15722 ] Red Hat--Red Hat Enterprise Li= nux 10 A flaw in the PCP linux_sockets module exposes an unsecured internal=
connection. An attacker with initial code execution can exploit this to es= calate privileges and execute arbitrary commands as root. 2026-07-30 8.8 CV= E-2026-16526 [ https://www.cve.org/CVERecord?id=3DCVE-2026-16526 ] Red Hat-= -Red Hat Enterprise Linux 10 A security flaw combining LDAP filter injectio=
n and improper authorization checks was found in Samba Active Directory Dom= ain Controller (AD DC). When processing LDAP Compare requests, Samba fails =
to properly validate user-supplied attribute names and executes the resulti=
ng internal database search in a trusted context, bypassing normal Access C= ontrol List (ACL) enforcement. An authenticated low-privilege domain user c=
an exploit these flaws to disclose confidential Active Directory attributes=
that would normally be inaccessible. The disclosed information may be leve= raged to derive sensitive authentication material, potentially leading to p= rivilege escalation and complete domain compromise. For example: In deploym= ents configured with Group Managed Service Accounts (gMSAs), an attacker ca=
n extract the "msKds-RootKeyData" attribute and derive gMSA passwords offli= ne, potentially leading to complete domain compromise if privileged gMSAs a=
re present. 2026-07-30 8.8 CVE-2026-58222 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-58222 ] Red Hat--Red Hat Enterprise Linux 10 A flaw was found =
in sg3_utils. The sg_inq command, when invoked with the --export option, ou= tputs device identification data without sanitizing control characters in S= CSI name string fields. A newline character embedded in a device-supplied n= ame string can inject arbitrary properties into the udev device database. T= his could allow an attacker who can present a crafted SCSI device to execut=
e arbitrary commands as root when the device is disconnected. 2026-07-28 7.=
6 CVE-2026-16313 [ https://www.cve.org/CVERecord?id=3DCVE-2026-16313 ] Red = Hat--Red Hat Enterprise Linux 10 A command injection flaw in PCP's linux_so= ckets PMDA allows malicious shell metacharacters via the network.persocket.= filter metric. This failed validation lets attackers execute arbitrary comm= ands as the PMDA user when metrics refresh. 2026-07-30 7.8 CVE-2026-16524 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-16524 ] Red Hat--Red Hat Enter= prise Linux 10 An unauthenticated remote attacker can bypass access control=
s by sending crafted requests to the PCP pmproxy /store endpoint. This allo=
ws the attacker to overwrite any PMDA metric, leading to arbitrary code exe= cution and system takeover. 2026-07-30 7.3 CVE-2026-16527 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-16527 ] Red Hat--Red Hat Enterprise Linux 10 A=
signed integer overflow in the PCP __pmGetPDU() function can be exploited = via crafted network packets during PDU processing or SASL negotiation. This=
permanently blinds the affected daemon, resulting in a total denial of ser= vice (DoS) for subsequent packet reads. 2026-07-30 7.5 CVE-2026-16529 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-16529 ] Red Hat--Red Hat Enterpris=
e Linux 10 A flaw was found in the Linux kernel in net/can/bcm.c in can: bc=
m, where an unprivileged local user can exploit this vulnerability to execu=
te arbitrary code within the kernel, which leads to a local privilege escal= ation (LPE). This allows the attacker to gain root privileges and take full=
control of the affected system. 2026-07-27 7.8 CVE-2026-17523 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-17523 ] Red Hat--Red Hat Enterprise Linux=
10 A flaw was found in CRIU's handling of restartable sequences (rseq) dur= ing checkpoint/restore. A malicious process inside a container can register=
an rseq critical section that hijacks CRIU's parasite code injection durin=
g checkpoint, allowing it to spoof the process credentials saved in the che= ckpoint image. On restore, the container process gains elevated capabilitie=
s and zeroed UIDs/GIDs. The practical impact on Red Hat products is limited=
by several factors: checkpoint/restore requires root privileges (podman) o=
r cluster-admin RBAC (OpenShift) to trigger and cannot be initiated from wi= thin the container itself; on OpenShift prior to 4.17 the feature required = explicit opt-in, and on 4.17+ the kubelet checkpoint API RBAC is not config= ured by default; OpenShift enforces user namespaces by default for regular = workloads (hostUsers is gated behind admin-only SCCs), which makes the spoo= fed capabilities namespace-scoped and ineffective for privilege escalation;=
SELinux type enforcement (container_t) blocks privilege transitions indepe= ndently of capabilities; seccomp filters persist through checkpoint/restore=
and cannot be corrupted via the parasite; and kernel mount namespace owner= ship checks on RHEL 9/10 kernels prevent mount-based container escape even = with spoofed capabilities. 2026-07-28 7.8 CVE-2026-18107 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-18107 ] Red Hat--Red Hat Enterprise Linux 10 An=
out-of-bounds write vulnerability was found in the BFD library's DLX ELF b= ackend (bfd/elf32-dlx.c) in GNU binutils. The dlx_rtype_to_howto() function=
maps ELF relocation types to internal howto structures but fails to perfor=
m adequate bounds checking on attacker-controlled relocation type values (v=
ia ELF32_R_TYPE(r_info)) before indexing into the dlx_elf_howto_table[] arr= ay. The DLX relocation type number space is non-contiguous (basic types 0-6=
, extended types at 0x10000+), but the default case in the switch statement=
allows arbitrary index values to reach the array access. A specially craft=
ed ELF/DLX object file can trigger this out-of-bounds write when processed =
by any BFD-consuming tool (objdump, readelf, strip, ld, nm, objcopy). The v= ulnerability has been demonstrated to achieve arbitrary code execution via =
a File Stream Oriented Programming (FSOP) attack against glibc FILE structu= res (stderr), redirecting control flow to system(). Attack scenarios includ=
e CI/CD pipelines performing automated binary analysis, developer workstati= ons running objdump/readelf on untrusted binaries, automated security scann= ing or malware analysis tools invoking binutils, and package build systems = processing third-party code. Note: This vulnerability is only exploitable w= hen binutils is built with the DLX backend enabled (typically via --enable-= targets=3Dall). 2026-07-29 7.8 CVE-2026-18220 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-18220 ] Red Hat--Red Hat OpenShift Container Platform 4 A = flaw was found in openshift/oauth-proxy. The proxy sets authenticated ident= ity headers using only dash-variant keys (X-Forwarded-User) but does not st= rip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI=
and PHP frameworks normalize both variants to the same variable, allowing =
an authenticated low-privilege user to smuggle a forged identity that may o= verride the legitimate authenticated identity in the upstream application. = 2026-07-28 8.5 CVE-2026-49332 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -49332 ] Red Hat--Red Hat OpenShift Virtualization 4 In containerized-data-= importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended t=
o provide read-only access to CDI resources, includes a rule granting creat=
e on the datavolumes/source subresource. CDI's DataVolume clone authorizati=
on accepts this permission as sufficient to authorize cloning the contents =
of any PVC the caller can name, without requiring write access to the sourc=
e namespace. A user or service account bound to the view role, commonly gra= nted cluster-wide via ClusterRoleBinding, who also has ordinary write acces=
s (edit/admin) to any single namespace, can use this to exfiltrate the cont= ents of any PVC in the cluster into a namespace they control, bypassing nam= espace isolation and the read-only guarantee of the view role. 2026-07-27 7=
.7 CVE-2026-17527 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17527 ] Red=
Hat--Red Hat Quay 3 A flaw was found in Quay. A user configured in GLOBAL_= READONLY_SUPER_USERS is able to view robot account tokens for repositories = they are not a member of, allowing an attacker with read-only superuser pri= vileges to impersonate any robot account. 2026-07-29 7.2 CVE-2026-18255 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-18255 ] redaxo--core REDAXO is a=
PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapo= ol::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php let=
s an authenticated backend user with media[upload] permission upload a JPEG= /PHP polyglot named shell.php.any.jpg, which web servers with multi-extensi=
on PHP handlers can execute as the web-server user. This issue is fixed in = version 5.21.1. 2026-07-31 7.5 CVE-2026-53599 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-53599 ] RedHatInsights--yggdrasil-worker-package-manager A=
flaw was found in yggdrasil-worker-package-manager. A local attacker with = existing access to the system could exploit an argument injection vulnerabi= lity in the APT backend. This allows specially crafted package names, which=
begin with a hyphen, to be misinterpreted as command options by apt-get. S= uccessful exploitation could lead to remote code execution (RCE) with root = privileges, enabling the attacker to fully compromise the system's integrit=
y, confidentiality, and availability. 2026-07-31 7.8 CVE-2026-18157 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-18157 ] RexTheme--Product Feed Manag=
er Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <=3D = 7.6.1 versions. 2026-07-27 7.1 CVE-2026-59553 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-59553 ] Rich Source--DMS+ (Non-Mobile) DMS+ (Non-Mobile) d= eveloped by Rich Source has a Use of Hard-coded Credentials vulnerability. = Unauthenticated remote attackers can exploit a fixed API key to gain contro=
l over all installed DMS+ devices. 2026-07-31 10 CVE-2026-18452 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-18452 ] RomanCode--MapSVG Unauthenticate=
d SQL Injection in MapSVG <=3D 8.14.0 versions. 2026-07-27 9.3 CVE-2026-595=
27 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59527 ] Roxnor--GetGenie U= nauthenticated Cross Site Scripting (XSS) in GetGenie <=3D 4.4.3 versions. = 2026-07-27 7.1 CVE-2026-65440 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -65440 ] rtCamp--rtMedia for WordPress, BuddyPress and bbPress Unauthentica= ted SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <=3D 4.7= .10 versions. 2026-07-27 9.3 CVE-2026-59549 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-59549 ] rtCamp--rtMedia for WordPress, BuddyPress and bbPres=
s Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress=
<=3D 4.7.10 versions. 2026-07-27 8.5 CVE-2026-59551 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-59551 ] Ruben Garcia--GamiPress Unauthenticated SQL=
Injection in GamiPress <=3D 7.9.7 versions. 2026-07-27 9.3 CVE-2026-59538 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-59538 ] ruby-oauth--oauth OAu=
th is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing client=
s and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses th=
e raw Location header of a 300 to 399 redirect returned by the OAuth server=
and follows the redirect recursively, which can mutate the consumer's conf= iguration and expose signed OAuth request metadata, including the Authoriza= tion header, to a cross-origin host. This issue is fixed in version 1.1.6. = 2026-07-28 7.2 CVE-2026-54605 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -54605 ] ruby-oauth--oauth2 OAuth2 is a Ruby wrapper for the OAuth 2.0 and = 2.1 authorization frameworks, including OpenID Connect (OIDC). From 0.4.0 t=
o 2.0.21, a protocol-relative redirect Location returned to OAuth2::Client#= request overrides the request authority, so the bearer Authorization header=
is sent to an attacker-controlled host, leaking the credential. This issue=
is fixed in version 2.0.22. 2026-07-28 8.6 CVE-2026-54603 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-54603 ] s9y--Serendipity Serendipity before 2= .6.1 contains an authentication context confusion vulnerability where passw= ord validation and session loading operate independently without ensuring b= oth use the same user record. An authenticated Editor can create a username=
collision with an Administrator account and obtain administrative privileg=
es by logging in with their own password while the session loads the Admini= strator's account data. 2026-07-30 8.8 CVE-2026-67351 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-67351 ] saadiqbal--Wholesale for WooCommerce The W= holesale for WooCommerce plugin for WordPress is vulnerable to Privilege Es= calation in all versions up to, and including, 2.0.5. This is due to the `s= ave_requests_meta()` function applying only `sanitize_text_field()` to the = `user_role_set` POST parameter before passing it directly to `WP_User::add_= role()`, with no allowlist validation against permitted wholesale roles and=
no capability check such as `current_user_can('promote_users')` or `curren= t_user_can('manage_options')`. This makes it possible for authenticated att= ackers with author-level access and above to escalate their privileges to a= dministrator by supplying `administrator` as the `user_role_set` value in a=
crafted request. The function is gated only by a nonce (`request_user_role= _nonce`) that is rendered in the meta box on the `wwp_requests` post edit s= creen; because the post type is registered with `capability_type =3D> 'post= '`, any author-level user who has authored a `wwp_requests` post - such as = one created via the wholesale registration form - can access this nonce and=
submit the role-assignment request. 2026-07-29 8.8 CVE-2026-12144 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-12144 ] savonrb--savon Savon is a Rub=
y SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interp= olates attacker-controlled WSDL operation names into Ruby source passed to = module_eval, allowing Ruby code execution in the application process. This = issue is fixed in version 2.17.2. 2026-07-31 8.1 CVE-2026-53510 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-53510 ] Sender--Sender Newsletter, SMS a=
nd Email Marketing Automation for WooCommerce Administrator SQL Injection i=
n Sender - Newsletter, SMS and Email Marketing Automation for WooCommerce <= =3D 2.10.22 versions. 2026-07-27 7.6 CVE-2026-59537 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-59537 ] Shahadat Hossain--3D Flipbook PDF Viewer & E= mbedder Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook P=
DF Viewer &amp; Embedder <=3D 1.4.2 versions. 2026-07-27 7.2 CVE-2026-59552=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-59552 ] shiptime--ShipTime: = Discounted Shipping Rates Subscriber Sensitive Data Exposure in ShipTime: D= iscounted Shipping Rates <=3D 1.1.1 versions. 2026-07-27 7.5 CVE-2026-59528=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-59528 ] SICK AG--InspectorP6=
1x An attacker may perform unauthenticated read and write operations on sen= sitive filesystem areas via the AppEngine Fileaccess over HTTP due to impro= per access restrictions. A critical filesystem directory was unintentionall=
y exposed through the HTTP-based file access feature, allowing access witho=
ut authentication. This includes device parameter files, enabling an attack=
er to read and modify application settings, including customer-defined pass= words. Additionally, exposure of the custom application directory may allow=
execution of arbitrary Lua code within the sandboxed AppEngine environment=
. 2026-07-28 9.4 CVE-2026-11841 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-11841 ] siyuan-note--siyuan SiYuan desktop before v3.7.2 contains a refl= ected cross-site scripting vulnerability in the bazaar plugin readme handle=
r that allows attackers to execute arbitrary code by crafting a malicious s= iyuan:// deep link. Attackers can inject HTML payloads via the plugin name = parameter that execute with full Node.js access through insertAdjacentHTML = rendering in an insecurely configured Electron renderer. 2026-07-27 9.6 CVE= -2026-66395 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66395 ] siyuan-no= te--siyuan SiYuan before v3.7.3 contains stored and reflected cross-site sc= ripting vulnerabilities in SVG sanitization that allows authenticated attac= kers to execute scripts by bypassing the HTML parser-based cleaner. Attacke=
rs can hide script tags within desc, style, or noscript elements which the = HTML parser treats as raw text but browsers interpret as executable SVG con= tent when served as image/svg+xml, enabling script execution in the applica= tion origin. 2026-07-27 8.7 CVE-2026-66394 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-66394 ] siyuan-note--siyuan SiYuan before v3.7.2 fails to esc= ape the title-img Individual Attribute List value when rendering Gallery an=
d Kanban cover images, allowing stored cross-site scripting via unescaped s= tyle attribute interpolation. Attackers with editor permissions can inject = onload handlers that execute arbitrary code in the Electron renderer with f= ull Node.js access when victims open affected documents. 2026-07-27 8.4 CVE= -2026-66396 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66396 ] smub--Eas=
y Digital Downloads eCommerce Payments and Subscriptions made easy The Easy=
Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upl= oad in versions up to and including 3.6.9. This is due to insufficient file=
type validation in the edd_do_ajax_import_file_upload() function , which o= nly checks the client-supplied $_FILES['edd-import-file']['type'] Content-T= ype header against an allow-list of CSV mime types, then uses raw move_uplo= aded_file() (bypassing wp_handle_upload()'s core MIME enforcement) to write=
the file under its original extension into the web-accessible wp-content/u= ploads/edd/exports/ directory. This makes it possible for authenticated att= ackers, with Shop Manager-level access and above, to upload arbitrary files=
on the affected site's server which may make remote code execution possibl=
e. 2026-07-29 7.2 CVE-2026-12476 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-12476 ] Softtr Information Technology Trade Ltd. Co.--E-Commerce Pack C= ross-Site request forgery (CSRF) vulnerability in Softtr Information Techno= logy Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery. This=
issue affects E-Commerce Pack: before 5.03.01.49. 2026-07-30 8.3 CVE-2026-= 5219 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5219 ] SolarWinds--Web H= elp Desk SolarWinds Web Help Desk is found to be affected by a SAML authent= ication bypass vulnerability. This requires the SAML 2.0 authentication met= hod to be enabled. 2026-07-30 9.8 CVE-2026-28323 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-28323 ] somta--Juggle Juggle through 1.6.0 contains a r= emote code execution vulnerability that allows unauthenticated remote attac= kers to execute arbitrary OS commands by connecting to the exposed H2 datab= ase web console using default shipped credentials. Attackers can access the=
unprotected /h2-console endpoint, authenticate with default credentials, a=
nd leverage the H2 CREATE ALIAS Runtime.exec() technique to execute arbitra=
ry commands, resulting in root-level code execution when running the stock = Docker image. 2026-07-30 9.8 CVE-2026-67208 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-67208 ] Spring--Spring Tools for Eclipse Starting Spring Boo=
t applications in the Spring Tools with the live information mode enabled m= akes the running application vulnerable against JMX-based remote code execu= tion. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.=
0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier 2= 026-07-30 8 CVE-2026-47858 [ https://www.cve.org/CVERecord?id=3DCVE-2026-47= 858 ] Spring--Spring Tools for Eclipse The Boot Dashboard Docker integratio=
n in Spring Tools publishes container control ports on all of the host's ne= twork interfaces (0.0.0.0) rather than restricting them to loopback. Affect=
ed Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlie=
r 2026-07-30 8 CVE-2026-47873 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -47873 ] Spring--Spring Tools for Eclipse When enabling Spring Boot DevTool=
s support for a remote application target (for example a Docker container o=
r Cloud Foundry app) from the Spring Tools Boot Dashboard, Spring Tools gen= erates a shared secret that authenticates DevTools remote-restart uploads t=
o the deployed application. This secret was generated using a non-cryptogra= phic pseudo-random number generator rather than a cryptographically secure = source of randomness. Affected Spring Products and Versions: Spring Tools f=
or Eclipse: 5.2.0 and earlier 2026-07-30 8.3 CVE-2026-47882 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-47882 ] Strategy11 Team--AWP Classifieds Una= uthenticated SQL Injection in AWP Classifieds <=3D 4.4.7 versions. 2026-07-=
27 9.3 CVE-2026-59550 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59550 ]=
StylemixThemes--Cost Calculator Builder PRO The Cost Calculator Builder PR=
O plugin for WordPress is vulnerable to Remote Code Execution in all versio=
ns up to, and including, 4.0.3 via the js_to_php function. This is due to i= nsufficient sanitization of the orderDetails[*].originalValue field, which =
is injected verbatim into a calculator formula string passed to PHP eval() = inside js_to_php(), with the regex allow-list in evaluateFormula() only fil= tering alphanumeric tokens and leaving non-word punctuation characters inta= ct. This makes it possible for unauthenticated attackers to execute code on=
the server. The only authentication barrier is a nonce check, but the requ= ired nonce is publicly emitted on every front-end page via the wp_head hook=
, making it freely obtainable by unauthenticated visitors. Payloads must be=
non-word XOR gadgets to bypass sanitization. 2026-07-29 9.8 CVE-2026-14900=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-14900 ] Subtle Web Inc--Form= Craft Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <=3D = 3.9.15 versions. 2026-07-27 7.2 CVE-2026-65442 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-65442 ] superplanehq--superplane SuperPlane before 0.27.0=
contains a broken object-level authorization vulnerability in the CanvasSe= rvice gRPC handlers that allows authenticated users with viewer-level acces=
s to one organization to access resources belonging to other organizations =
by supplying arbitrary canvas or queue UUIDs without organization scoping. = Attackers can read cross-tenant execution history and event payloads contai= ning sensitive secrets, write queue items and canvas events into victim org= anizations, delete arbitrary canvases, and disrupt automation workflows acr= oss tenant boundaries. 2026-07-28 8.8 CVE-2026-57510 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-57510 ] Sylius--MolliePlugin Sylius Mollie Plugin p= rovides Mollie payment integration for Sylius applications. Prior to 2.2.8,=
3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/update-payment pa= yment webhook accepts attacker-controlled id and orderId parameters but doe=
s not verify that the Mollie payment belongs to the referenced Sylius order=
, allowing an unauthenticated attacker with any valid paid Mollie payment I=
D to mark a victim order as paid without transferring funds for that order.=
This issue is fixed in 2.2.8, 3.2.4, and 3.3.1. 2026-07-30 7.5 CVE-2026-68= 500 [ https://www.cve.org/CVERecord?id=3DCVE-2026-68500 ] TeamViewer--Remot=
e TeamViewer Full Client and Host=C2=A0for macOS before version 15.80=C2=A0= contain=C2=A0a business logic error that can allow an authenticated attacke=
r to bypass=C2=A0a=C2=A0configured 2FA=C2=A0for=C2=A0Connections approval f= low=C2=A0via=C2=A0Unattended=C2=A0Access=C2=A0and=C2=A0establish=C2=A0a rem= ote connection to an affected macOS host. 2026-07-29 8 CVE-2026-12703 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-12703 ] termux--proot-distro proot= -distro is a utility for managing proot containers. Prior to version 5.1.5,=
proot-distro install extracted plain tarball root filesystems through _ext= ract_plain_tar() in proot_distro/commands/install.py and Docker layers thro= ugh _apply_layer() in proot_distro/helpers/docker.py without validating arc= hive-controlled symlink targets in member.linkname, allowing a malicious ar= chive to plant an absolute host-path symlink and write files through it ont=
o the host filesystem. This issue is fixed in version 5.1.5. 2026-07-29 8.2=
CVE-2026-54574 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54574 ] termu= x--proot-distro proot-distro is a utility for managing proot containers. Pr= ior to version 5.1.6, proot-distro restore accepted hardlink entries whose = linkname referenced another installed container and did not verify that the=
hardlink source container matched the destination container being restored=
, allowing a crafted restore archive to copy files between otherwise isolat=
ed containers. This issue is fixed in version 5.1.6. 2026-07-29 8.2 CVE-202= 6-54727 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54727 ] teydeastudio-= -WP Password Policy The WP Password Policy plugin for WordPress is vulnerab=
le to Privilege Escalation in all versions up to and including 3.7.1. This =
is due to missing authorization checks and nonce verification in the `get_u= ser()` function of the `Module_Password_Hint` class, which unconditionally = calls `WP_User::set_role()` with the attacker-supplied `role` parameter on = any account resolved via `$_POST['user_login']`, without confirming the req= uesting user holds the capability to assign roles. This makes it possible f=
or authenticated attackers, with subscriber-level access and above, to esca= late their own privileges to Administrator by submitting a crafted POST req= uest - with `action` set to `createuser` and `role` set to `administrator` =
- to the password-reset form endpoint. The vulnerable code path is reachabl=
e via the `password_hint` filter hooked during the WordPress password-reset=
form render, meaning an attacker need only possess a valid password-reset = cookie to reach the sink. 2026-07-28 8.8 CVE-2026-15992 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-15992 ] ThemeComplete--Extra Checkout Options - = addon for Extra Product Options plugin The Extra Checkout Options (addon fo=
r Extra Product Options & Add-Ons for WooCommerce) plugin for WordPress is = vulnerable to Arbitrary File Upload in all versions up to, and including, 2= .3.2. This is due to missing authorization and nonce validation in the eco_= save_settings() function, which allows low-privileged authenticated users t=
o modify the tc_eco_custom_file_types upload allowlist setting, combined wi=
th insufficient authorization on the wc_eco_upload_file AJAX action. This m= akes it possible for authenticated attackers, with Subscriber-level access = and above, to allow PHP uploads, upload a PHP file using the frontend uploa=
d nonce exposed on cart and checkout pages, and achieve remote code executi= on. NOTE: This vulnerability was partially fixed in version 2.3.2. 2026-07-=
29 8.8 CVE-2026-14270 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14270 ]=
Themefic--Ultimate Addons for Contact Form 7 Unauthenticated Cross Site Sc= ripting (XSS) in Ultimate Addons for Contact Form 7 <=3D3.5.45 versions. 20= 26-07-27 7.1 CVE-2026-65439 [ https://www.cve.org/CVERecord?id=3DCVE-2026-6= 5439 ] themetechmount--TrueBooker Appointment Booking and Scheduler System = The TrueBooker - Appointment Booking and Scheduler System plugin for WordPr= ess is vulnerable to generic SQL Injection via the 'alldata[truebooker_user=
]' parameter in all versions up to, and including, 1.2.2 due to insufficien=
t escaping on the user supplied parameter and lack of sufficient preparatio=
n on the existing SQL query. This makes it possible for unauthenticated att= ackers to append additional SQL queries into already existing queries that = can be used to extract sensitive information from the database. The check_a= jax_referer() nonce guard does not constitute an authentication or authoriz= ation barrier because the nonce is exposed to unauthenticated visitors on T= rueBooker front-end booking pages; exploitation additionally requires that = the required booking fields (category, service, person, date, and time slot=
) be present in the alldata POST parameter so that execution reaches the vu= lnerable SQL query branch. 2026-07-28 7.5 CVE-2026-13161 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-13161 ] Three Learning--Koollab LMS A pre-authe= ntication blind SQL injection vulnerability in Koollab LMS allowed an unaut= henticated attacker to use a time-based SQL oracle via the SSO OAuth endpoi=
nt to read sensitive database contents, including personally identifiable i= nformation, credentials, and valid JWT tokens that may enable account takeo= ver. 2026-07-29 9.1 CVE-2026-63229 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-63229 ] Three Learning--Koollab LMS A pre-authentication error-based = SQL injection vulnerability in Koollab LMS allowed an unauthenticated attac= ker to read sensitive database contents, including personally identifiable = information, credentials, and valid JWT tokens that may enable account take= over, via the SCORM report endpoint. 2026-07-29 9.1 CVE-2026-63230 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-63230 ] Three Learning--Koollab LMS A=
SQL injection and unsafe deserialisation vulnerability in Koollab LMS allo= wed an authenticated attacker to inject through the assessment reinforcemen=
t endpoint, control data passed to unserialize(), write a webshell to a pub= licly accessible location, and execute arbitrary code on the server. 2026-0= 7-29 9.9 CVE-2026-63232 [ https://www.cve.org/CVERecord?id=3DCVE-2026-63232=
] Three Learning--Koollab LMS A SQL injection and unsafe deserialisation v= ulnerability in Koollab LMS allowed an authenticated attacker to inject thr= ough the assessment overall answer endpoint, control data passed to unseria= lize(), write a webshell to a publicly accessible location, and execute arb= itrary code on the server. 2026-07-29 9.9 CVE-2026-63233 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-63233 ] Three Learning--Koollab LMS A SQL injec= tion and unsafe deserialisation vulnerability in Koollab LMS allowed an aut= henticated attacker to inject through the manual mark assessment endpoint, = control data passed to unserialize(), write a webshell to a publicly access= ible location, and execute arbitrary code on the server. 2026-07-29 9.9 CVE= -2026-63234 [ https://www.cve.org/CVERecord?id=3DCVE-2026-63234 ] Three Lea= rning--Koollab LMS A post-authentication SQL injection vulnerability in Koo= llab LMS allowed an authenticated attacker to use an error-based SQL oracle=
via the face-to-face runs update endpoint to read the entire application d= atabase and obtain valid JWT tokens for account takeover. 2026-07-29 8.1 CV= E-2026-63231 [ https://www.cve.org/CVERecord?id=3DCVE-2026-63231 ] Thrive T= hemes Coupon--Thrive Product Manager Unauthenticated Broken Access Control =
in Thrive Product Manager <=3D 10.9.2 versions. 2026-07-27 7.3 CVE-2026-595=
35 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59535 ] thumbor--thumbor T= humbor is an open-source photo thumbnail service by globo.com. Prior to 7.8= .0, the ALLOWED_SOURCES configuration passes plain strings to re.match() wi= thout escaping dots, so a hostname differing at dot positions can match the=
allowlist. This issue is fixed in 7.8.0. 2026-07-31 8.2 CVE-2026-53500 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-53500 ] thumbor--thumbor Thumbor=
is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Th= umbor's HMAC validation can be bypassed due to the use of Python's .replace=
() when removing the signature from the URL before validation. Since .repla= ce() removes all occurrences of the substring, an attacker can insert the s= ame signature multiple times in the URL and manipulate the final URL used f=
or validation. This allows crafting URLs where the validated string differs=
from the actual requested resource, enabling loading images from unintende=
d domains or paths. This issue is fixed in 7.8.0. 2026-07-31 8.2 CVE-2026-5= 3501 [ https://www.cve.org/CVERecord?id=3DCVE-2026-53501 ] thumbor--thumbor=
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7= .8.0, Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>=
) filter passes the user-controlled <columns> value to a C extension (thumb= or/ext/filters/_convolution.c) where it is used as a divisor (for % and /) = without validating columns > 0. When columns=3D0, the C code triggers undef= ined behavior; on x86_64 this reliably results in a fatal divide-by-zero tr=
ap (SIGFPE) and crashes the Thumbor process, causing a remote denial of ser= vice. This issue is fixed in 7.8.0. 2026-07-31 7.5 CVE-2026-53503 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-53503 ] thumbor--thumbor Thumbor is an=
open-source photo thumbnail service by globo.com. Prior to 7.8.0, the conv= olution filter regular expression performs exponential backtracking on craf= ted repeated numeric input, allowing a URL request to exhaust processing ti= me. This issue is fixed in 7.8.0. 2026-07-31 7.5 CVE-2026-53504 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-53504 ] thumbor--thumbor Thumbor is an o= pen-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's = filters:proportion(<value>) filter does not enforce an upper bound on <valu=

and runs in the post-transform phase. An attacker can trigger extremely =

large resizes (CPU/memory exhaustion) and cause denial of service. This iss=
ue is fixed in 7.8.0. 2026-07-31 7.5 CVE-2026-53505 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-53505 ] tigroumeow--AI Engine The Chatbot, AI Framew= ork & MCP for WordPress The AI Engine - The Chatbot, AI Framework & MCP for=
WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery=
in all versions up to, and including, 3.6.5 This is due to missing or inco= rrect nonce validation on the reauth_for_authorize function. This makes it = possible for unauthenticated attackers to create new administrator accounts=
with attacker-supplied credentials via a CSRF-based REST authentication by= pass, granted they can trick a site administrator into performing an action=
such as clicking on a link. This bypass can be combined with WordPress's ?= _method=3DPOST method-override support to convert a top-navigation GET requ= est into an authenticated POST to the REST users endpoint, requiring no exi= sting account on the attacker's part. 2026-08-01 8.8 CVE-2026-15988 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-15988 ] tomaka--rouille Rouille 0.3.=
3 through 3.6.2 contains an HTTP request smuggling vulnerability that allow=
s remote attackers to bypass access controls by injecting bare line feed ch= aracters (0x0A) into client-supplied request header values that are copied = verbatim to upstream connections without validation. Attackers can craft a = header value containing a complete additional HTTP request that is interpre= ted as a separate request by backends such as Go net/http and Python http.s= erver, causing the backend to process a smuggled request with attacker-chos=
en method, path, and headers that bypasses the rouille handler's access con= trol logic. 2026-07-28 7.5 CVE-2026-67182 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-67182 ] Toptech Systems--RCU II+ The RCU II+ and Multiload II+=
are vulnerable to an unauthenticated service that exposes a debug interfac=
e granting full root-level access to the embedded system. This vulnerabilit=
y stems from a network-accessible port running a Target Communications Fram= ework (TCF) service that does not require any authentication, allowing an a= ttacker to directly interact with the Linux environment that powers the dev= ice. Once connected, an attacker can freely view and modify the filesystem,=
manipulate running processes, and control network interfaces, enabling dee=
p alteration of system behavior. 2026-07-30 8.8 CVE-2026-12562 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-12562 ] tugcantopaloglu--openclaw-dashboa=
rd OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnera= bility that allows unauthenticated remote attackers to inject arbitrary HTM=
L and script payloads by submitting a crafted username in a failed login PO=
ST request, which is recorded verbatim in the audit log. When an administra= tor opens the notification panel, the unescaped log entry is rendered via i= nnerHTML with a permissive Content-Security-Policy allowing inline event ha= ndlers, enabling the attacker-supplied payload to execute in the administra= tor's session and interact with authenticated endpoints including agent ins= truction file editing and configuration changes. 2026-07-30 9.3 CVE-2026-66= 418 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66418 ] tugcantopaloglu--= openclaw-dashboard OpenClaw Dashboard contains a stored cross-site scriptin=
g vulnerability that allows unauthenticated remote attackers to execute arb= itrary JavaScript in the administrator's browser session by injecting HTML = markup into agent transcript messages processed through the sessions API. A= ttackers can craft a message containing inline event handler payloads such =
as an img tag with an onerror attribute within the 60-character rendering b= udget, which is stored in the session transcript and interpolated unsanitiz=
ed into innerHTML on the default landing page, allowing theft of session to= kens and unauthorized calls to authenticated administrative endpoints inclu= ding agent instruction file modification. 2026-07-30 9.3 CVE-2026-66421 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-66421 ] UMAI Vision--Traffic Ana= lysis System Improper neutralization of special elements used in an SQL com= mand ('SQL injection') vulnerability in UMAI Vision Traffic Analysis System=
allows SQL Injection. This issue affects Traffic Analysis System: from 30 = before 34. 2026-07-30 9.8 CVE-2026-4978 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-4978 ] umarbajwa--MailChimp Subscribe Form, Optin Builder, PopU=
p Builder, Form Builder The MailChimp Subscribe Form, Optin Builder, PopUp = Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Si=
te Scripting via Form Field Values in all versions up to, and including, 4.= 3.3 due to insufficient input sanitization and output escaping. This makes =
it possible for unauthenticated attackers to inject arbitrary web scripts i=
n pages that will execute whenever a user accesses an injected page. 2026-0= 8-01 7.2 CVE-2026-15052 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15052=
] uncannyowl--Uncanny Automator Easy Automation, Integration, Webhooks & W= orkflow Builder Plugin The Uncanny Automator - Easy Automation, Integration=
, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing=
Authorization in versions up to, and including, 7.3.2 via the automator_go= ogle_contacts_fetch_labels, automator_mautic_segment_fetch, automator_mauti= c_tags_fetch, and automator_mautic_render_contact_fields AJAX actions due t=
o a missing capability check and missing nonce verification in the correspo= nding handlers (ajax_fetch_labels, segments_fetch, tags_fetch, and render_c= ontact_fields). This makes it possible for authenticated attackers, with Su= bscriber-level access and above, to enumerate sensitive Google Contacts gro= ups/labels and Mautic segments, tags, and contact-field definitions retriev=
ed via integration credentials configured by an administrator, and to consu=
me third-party API quota. 2026-07-28 7.5 CVE-2026-15025 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-15025 ] undici--undici undici's cache intercepto=
r mishandles malformed Cache-Control private directives. In undici 7.0.0 up=
to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degen= erate qualified private directive, such as private set to an empty value, c=
an be stored in the default shared cache and later served to a different ca= ller with the same cache key, disclosing private response bodies and header=
s including Set-Cookie. Separately, a Cache-Control header that combines an=
unqualified private directive with a qualified one triggers an uncaught Ty= peError in the cache-control parser, which rejects the request and, dependi=
ng on the consumer's error handling, can terminate the process. Both issues=
affect applications using the cache interceptor in shared mode, including = the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.=
2026-07-29 7.4 CVE-2026-13697 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-13697 ] Universal Software Inc.--UKBS Missing authentication for critical=
function vulnerability in Universal Software Inc. UKBS allows Accessing Fu= nctionality Not Properly Constrained by ACLs. This issue affects UKBS: thro= ugh 28072026. NOTE: The vendor was contacted and it was learned that the pr= oduct is not supported. 2026-07-28 8.8 CVE-2026-7187 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-7187 ] Vacron--VIN-DS783E-E6 VIN-DS783E-E6 develope=
d by Vacron has a Hidden Functionality vulnerability, allowing unauthentica= ted remote attackers to exploit a specific hidden function to obtain the ad= ministrator credentials of the device. 2026-07-29 9.8 CVE-2026-18191 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-18191 ] vBulletin--vBulletin vBulle= tin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vuln= erability in the vB5_Template_Runtime::runMaths() method within the templat=
e runtime that allows unauthenticated remote attackers to execute arbitrary=
PHP code by supplying crafted input through the pagenav[pagenumber] parame= ter. Attackers can exploit the insufficiently restrictive regex filter by u= sing phpfuck-style encoding with permitted characters to inject and execute=
arbitrary PHP code via the unauthenticated ajax/render template route with= out any authentication. 2026-07-27 9.8 CVE-2026-61511 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-61511 ] vlang--v V through 0.5.2, fixed in commit = 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability=
that allows attackers to circumvent host-based allowlists by exploiting a = parser differential between net.urllib and net.http. Attackers can craft a = URL containing a backslash in the authority section such that net.urllib.pa= rse() extracts the trusted host for allowlist validation while net.http.get=
() normalizes the backslash and connects to the internal host, enabling acc= ess to internal network services that the allowlist was intended to block. = 2026-07-29 8.6 CVE-2026-67201 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -67201 ] VMware--Cloud Foundation VMware ESX contains an out-of-bounds writ=
e vulnerability in the VMXNET3 virtual network adapter.=C2=A0A malicious ac= tor with local administrative privileges on a virtual machine with VMXNET3 = virtual network adapter may exploit this issue to execute code on the host.=
Non VMXNET3 virtual adapters are not affected by this issue. 2026-07-30 9.=
3 CVE-2026-47876 [ https://www.cve.org/CVERecord?id=3DCVE-2026-47876 ] VMwa= re--Cloud Foundation VMware vCenter contains an authentication bypass vulne= rability in the VMware Directory Service.=C2=A0A malicious actor with netwo=
rk access to vCenter=C2=A0may exploit this issue to bypass authentication a=
nd gain unauthorized access to the system. 2026-07-30 9.8 CVE-2026-59309 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-59309 ] VMware--Cloud Foundatio=
n VMware vCenter contains a directory traversal vulnerability in the Syslog=
server.=C2=A0A malicious actor with network access to vCenter=C2=A0may exp= loit this issue to execute arbitrary code. 2026-07-30 9.8 CVE-2026-59310 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-59310 ] VMware--Cloud Foundatio=
n VMware ESX,=C2=A0Workstation, and Fusion=C2=A0contain an out-of-bounds re=
ad vulnerability. A malicious actor with=C2=A0VM deployment privileges coul=
d trigger an out-of-bounds read, potentially leading to information disclos= ure or more likely a Denial-of-Service (DoS) condition of the host process.= =C2=A0On Workstation and Fusion, the impact of this vulnerability is restri= cted to information disclosure. 2026-07-30 7.6 CVE-2026-41703 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-41703 ] Wasiliy Strecker / ContestGallery = developer--Contest Gallery Unauthenticated Cross Site Scripting (XSS) in Co= ntest Gallery <=3D 30.0.6 versions. 2026-07-27 7.1 CVE-2026-65447 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-65447 ] webaways--NEX-Forms Ultimate F= orms Plugin for WordPress The Nex Forms - Ultimate Form Builder - Lite plug=
in for WordPress is vulnerable to arbitrary file deletion via path traversa=
l in versions up to, and including, 9.2.3. This is due to the delete_file()=
AJAX handler retrieving a file path from the database and passing it direc= tly to unlink() with no validation (no realpath(), basename(), or allowlist=
check), combined with the insert_record() AJAX handler that lets the same = authenticated user store an arbitrary value in the target 'location' column=
(wp_kses() only strips HTML tags and does not neutralize path traversal or=
absolute paths). This makes it possible for authenticated attackers, with = admin-level access and above, to delete arbitrary files on the affected sit= e's server, including wp-config. When the plugin's user-level option is con= figured to something else, this may be exploitable with lower privileges. 2= 026-08-01 8.1 CVE-2026-15450 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 15450 ] WebPros--Plesk Improper neutralization in the Plesk XML-RPC API all= ows a remote authenticated low-privileged user to perform SQL injection and=
read arbitrary data from the Plesk database, leading to full compromise of=
the panel. 2026-07-30 9.9 CVE-2026-58046 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-58046 ] webreinvent--vaahcms VaahCMS versions 2.0.0 through 2.= 3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade=
template responsible for rendering security OTP emails, allowing remote at= tackers to execute unauthorized code in any browser that renders the affect=
ed email template with JavaScript enabled. The payload establishes a WebSoc= ket connection to a hardcoded command-and-control endpoint, installs a pass= word-field keylogger using MutationObserver to capture dynamically added in= puts, scrapes WhatsApp Web DOM content, and accepts remote commands to redi= rect or overwrite the rendered page. 2026-07-29 8.1 CVE-2026-67595 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-67595 ] wedevs--StoreGrowth Upsell, B= OGO, Quick View, Direct Checkout & Side Cart for WooCommerce The StoreGrowt=
h: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Qu= ick View, Side Cart plugin for WordPress is vulnerable to Stored Cross-Site=
Scripting via the 'message_popup' parameter in all versions up to, and inc= luding, 2.1.0 due to insufficient input sanitization and output escaping. T= his makes it possible for unauthenticated attackers to inject arbitrary web=
scripts in pages that will execute whenever a user accesses an injected pa= ge. The exploit is possible because the 'ajd_protected' nonce required by t=
he create_popup handler is exposed to all unauthenticated frontend visitors=
via wp_localize_script under bogo_save_url.ajd_nonce, effectively bypassin=
g the nonce-only access control. 2026-07-28 7.2 CVE-2026-13440 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-13440 ] Weidmueller Interface--PROCON-WEB=
SCADA In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanit= ized. This allows a remote unauthenticated attacker to execute arbitrary SQ=
L commands. 2026-07-28 9.8 CVE-2026-16462 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-16462 ] wolfcms--wolfcms Wolf CMS through 0.8.3.1 contains a r= emote code execution vulnerability in FileManagerController that allows aut= henticated attackers to create arbitrary PHP files by exploiting missing fi=
le extension validation in the create_file() and save() functions. Attacker=
s with the file_manager_mkfile capability can write malicious PHP content i= nto the web-accessible FILES_DIR directory and trigger execution by request= ing the file over HTTP. 2026-07-30 8.8 CVE-2026-67206 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-67206 ] wolfcms--wolfcms Wolf CMS through 0.8.3.1 = contains an authorization bypass vulnerability in BackupRestoreController t= hat allows authenticated non-administrative users to access restricted back=
up functionality due to a PHP operator precedence flaw in the permission ch= eck expression. Attackers can exploit the incorrect evaluation of the acces=
s control expression to create, download, and restore backups without admin= istrative privileges. 2026-07-30 8.8 CVE-2026-67207 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-67207 ] wordplus--Better Messages Chat Rooms, Group = Chat, Private Messages & AI Chat Bots The Better Messages - Chat Rooms, Gro=
up Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable=
to arbitrary file deletion due to insufficient file path validation in the=
delete_sticker function in all versions up to, and including, 2.15.19. Thi=
s makes it possible for authenticated attackers, with administrator-level a= ccess and above, to delete arbitrary files on the server, which can easily = lead to remote code execution when the right file is deleted (such as wp-co= nfig.php). The prefix check intended to restrict deletion to the uploads di= rectory can be bypassed by crafting a URL that begins with the legitimate u= ploads base URL but embeds ../ traversal sequences in the path portion, as = the normalize_sticker function only applies esc_url_raw(), which does not s= trip ../ sequences, allowing the traversal payload to be stored verbatim in=
WordPress options. 2026-07-28 7.2 CVE-2026-16585 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-16585 ] WordPress--WordPress-Coding-Standards WordPres=
s Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce = WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.Enq= ueuedResourceParameters sniff (active in the WordPress and WordPress-Extra = rulesets) reconstructed the $ver argument passed to functions such as wp_en= queue_script() and ran it through eval() inside its is_falsy() method, so a=
maliciously crafted argument such as 'system'('id') would execute during a=
scan; as a result, running PHPCS with WordPressCS over untrusted PHP (for = example a CI pipeline that lints pull requests, or a developer reviewing th= ird-party code) could lead to arbitrary command execution on the scanning h= ost. The WordPress-Core and WordPress-Docs rulesets are not affected. This = issue is fixed in version 3.4.1. 2026-07-28 8.6 CVE-2026-45293 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-45293 ] WP Chill--Kali Forms Unauthentica= ted Cross Site Scripting (XSS) in Kali Forms <=3D 2.4.18 versions. 2026-07-=
27 7.1 CVE-2026-65446 [ https://www.cve.org/CVERecord?id=3DCVE-2026-65446 ]=
WP Media--BackWPup Unauthenticated Cross Site Scripting (XSS) in BackWPup = <=3D 5.7.4 versions. 2026-07-27 7.1 CVE-2026-65443 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-65443 ] wpchill--Kali Forms Contact Form & Drag-and-D= rop Builder The Kali Forms - Contact Form & Drag-and-Drop Builder plugin fo=
r WordPress is vulnerable to Remote Code Execution in all versions up to, a=
nd including, 2.4.20 via the _save_data function. This is due to insufficie=
nt validation of the 'thisPermalink' field value before it overwrites a tru= sted callable placeholder, allowing attacker-controlled strings to reach ca= ll_user_func() in _save_data(). This makes it possible for unauthenticated = attackers to execute code on the server. Exploitation requires the target f= orm to define a field with a name matching one of the reserved placeholder = keys ('thisPermalink', 'entryCounter', or 'submission_link'), as check_if_p= laceholders_changed() only processes POST keys present in the form's field_= type_map. 2026-08-01 8.1 CVE-2026-16144 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-16144 ] wpdevelop--Booking Calendar Unauthenticated Cross Site = Scripting (XSS) in Booking Calendar <=3D 11.4.2 versions. 2026-07-27 7.1 CV= E-2026-59558 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59558 ] wpmanage= ninja--Fluent Forms Customizable Contact Forms, Survey, Quiz, & Conversatio= nal Form Builder The Fluent Forms - Customizable Contact Forms, Survey, Qui=
z, & Conversational Form Builder plugin for WordPress is vulnerable to Stor=
ed Cross-Site Scripting via Name Field Nested `password` Member in all vers= ions up to, and including, 6.2.7 due to insufficient input sanitization and=
output escaping. This makes it possible for unauthenticated attackers to i= nject arbitrary web scripts in pages that will execute whenever a user acce= sses an injected page. 2026-07-29 7.2 CVE-2026-16655 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-16655 ] wpswings--Subscriptions for WooCommerce The=
Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privil= ege Escalation in versions up to, and including, 2.0.0. This is due to the = `save_meta_boxes()` function persisting the `_wps_plan_user_role` membershi=
p plan meta from `$_POST` without an allowlist that excludes privileged rol=
es - the only validations applied, `sanitize_key()` and `wp_roles()->is_rol= e()`, both accept `'administrator'` as a valid value, and the UI's `disable=
d` attribute on the role dropdown is a client-side-only control trivially b= ypassed via DevTools or a direct POST request; additionally, because the `w= ps_membership_plan` custom post type is registered with `capability_type =

'post'`, any user who can edit posts satisfies the `current_user_can('=

edit_post', $post_id)` guard in `save_meta_boxes()`. This makes it possible=
for authenticated attackers, with Contributor-level access and above, to e= scalate their privileges to Administrator by storing `'administrator'` as t=
he role granted on membership acquisition, which the Pro companion plugin t= hen applies via `add_role()` during membership lifecycle events. Successful=
exploitation requires the Subscriptions for WooCommerce Pro companion plug=
in to be active, as it is the component that reads the stored `_wps_plan_us= er_role` meta via `get_post_meta()` and calls `add_role()` to apply the rol=
e during membership lifecycle events. 2026-08-01 8.8 CVE-2026-15414 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-15414 ] wpswings--Subscriptions for = WooCommerce The Subscriptions for WooCommerce plugin for WordPress is vulne= rable to Missing Authorization in all versions up to, and including, 2.0.0.=
This is due to the plugin not properly verifying that a user is authorized=
to perform an action via the wps_sfw_install_plugin_configuration AJAX han= dler. This makes it possible for authenticated attackers, with shop manager= -level access and above, to install and activate arbitrary WordPress.org pl= ugins. 2026-07-30 7.2 CVE-2026-15397 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-15397 ] wpwax--FormGent Next-Gen AI Form Builder for WordPress with=
Multi-Step, Quizzes, Payments & More The FormGent plugin for WordPress is = vulnerable to unauthorized arbitrary file deletion due to a missing capabil= ity check on the /wp-json/formgent/responses/attachments REST API endpoint =
in all versions up to, and including, 1.9.2 This is due to the REST API rou=
te being registered without any authentication middleware in routes/rest/ap= i.php. This makes it possible for unauthenticated attackers to delete arbit= rary files within the formgent uploads directory. Additionally, on Linux se= rvers where the wp-content/uploads/formgent directory does not yet exist (t=
he default state after plugin installation), the path traversal protection = can be bypassed, enabling deletion of arbitrary files including wp-config.p=
hp which can lead to complete site takeover via a fresh WordPress installat= ion. 2026-08-01 9.1 CVE-2026-3141 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-3141 ] WPWeb--WooCommerce - Social Login The WooCommerce - Social Logi=
n plugin for WordPress is vulnerable to Authentication Bypass in all versio=
ns up to and including 2.8.7. This is due to the plugin's Apple login handl=
er accepting the Apple id_token and decoding only its base64 payload withou=
t verifying the JWT signature against Apple's public keys or validating the=
issuer, audience, or expiry claims, combined with the security nonce requi= red to invoke the login flow being publicly exposed to unauthenticated user=
s via a localized JavaScript object on the login page. This makes it possib=
le for unauthenticated attackers to log in as any existing WordPress user -=
including administrators - by supplying a forged id_token whose payload co= ntains the target user's email address, as that email is used without any r= ole exclusion to resolve a WordPress account and immediately issue an authe= nticated session for it. 2026-08-01 9.8 CVE-2026-8457 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-8457 ] Xendit--Xendit Payment Unauthenticated Brok=
en Access Control in Xendit Payment <=3D 7.1.0 versions. 2026-07-27 7.5 CVE= -2026-66473 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66473 ] Xlight--X= light FTP Server Xlight FTP Server before 3.9.5 contains a pre-authenticati=
on heap buffer overflow vulnerability that allows remote unauthenticated at= tackers to write past the end of a heap buffer by sending a malformed SSH c= lient identification string. A logic error in the recv loop's termination c= ondition uses an incorrect OR operator where an AND operator is required, e= nabling exploitation on any SSH or SFTP connection before authentication oc= curs. 2026-07-29 9.8 CVE-2026-67191 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-67191 ] Xlight--Xlight FTP Server Xlight FTP Server before 3.9.5 con= tains a pre-authentication stack buffer overflow vulnerability that allows = unauthenticated attackers to corrupt stack memory by sending malformed SSH = packets when a GCM cipher is negotiated. Attackers can craft packets with a=
n unvalidated length field passed directly to the GCM decrypt function, ove= rwriting the stack cookie and return address to potentially achieve remote = code execution before any authentication occurs. 2026-07-29 8.1 CVE-2026-67= 192 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67192 ] Ylianst--MeshCent= ral MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection=
bypass vulnerability that allows unauthenticated remote attackers to hijac=
k authenticated administrator sessions by exploiting an unconditional early=
return in the CheckWebServerOriginName() function within webserver.js when=
self-signed certificates are in use. Attackers can open cross-origin WebSo= cket connections to any of the twelve WebSocket endpoints, send crafted act= ion commands to exfiltrate the server sessionKey used to sign session cooki= es, forge session tokens as arbitrary users, and gain full remote control o=
f all managed devices governed by the MeshCentral instance. 2026-07-30 8.8 = CVE-2026-66420 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66420 ] yolanm= ees--Spikster Spikster through commit e1cdf8c contains a missing authentica= tion vulnerability that allows unauthenticated remote attackers to access a=
ll API routes by exploiting the unattached CipiAuth middleware, which is re= gistered but never applied to any route in the API routing configuration. A= ttackers can invoke approximately 50 unprotected API endpoints to enumerate=
and provision servers, reset root passwords, read and write arbitrary file=
s on the host, and create database users. 2026-07-30 9.8 CVE-2026-67594 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-67594 ] zephyrproject--zephyr Th=
e Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rs= p() in subsys/bluetooth/host/gatt.c invoked the application's params->subsc= ribe() callback after it had already called params->notify(conn, params, NU= LL, 0). Per the public GATT API, a notify callback with NULL data is the do= cumented signal that the subscription has terminated and the bt_gatt_subscr= ibe_params struct may be freed or reused by the application; calling subscr= ibe() on the struct afterwards is a use-after-free, including an indirect c= all through the freed params->subscribe function pointer. The error branch =
is remotely (adjacent) reachable: a Zephyr device acting as a GATT client t= hat calls bt_gatt_subscribe() can be driven into this ordering when a conne= cted GATT server peer answers the CCC write with an ATT Error Response (the=
peer-supplied error code flows through att_error_rsp -> att_handle_rsp int=
o gatt_write_ccc_rsp). For applications that free or recycle subscription p= arameters in their notification-termination handler, this results in memory=
corruption, a crash (denial of service), or potentially attacker-influence=
d control flow. The fix reorders the handler so the subscribe() callback ru=
ns before the terminating notify(NULL) in both the error and unsubscribe pa= ths. 2026-07-31 7.6 CVE-2026-10685 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-10685 ] zephyrproject--zephyr The OCPP 1.6 client in subsys/net/lib/o= cpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/= ocpp_j.c) using a hand-rolled helper, extract_string_field(), that copied t=
he message's uid and action fields with strncpy(out_buf, token + 1, outlen =
- 1) and then scanned the result with strchr(out_buf, '"'). Because strncpy=
does not NUL-terminate the destination when the source is at least outlen =
- 1 (127) bytes long, the subsequent strchr reads past the 128-byte destina= tion buffer into adjacent stack memory; if a " byte is found beyond the buf= fer, a one-byte out-of-bounds NUL write also occurs. A related defect in ex= tract_payload() runs strchr/strrchr over the receive buffer, which may not =
be NUL-terminated when a maximal-length frame fills it. The parsed bytes co=
me directly from the OCPP central-system server over a websocket: the reade=
r thread fills recv_buf via websocket_recv_msg() and calls parse_rpc_msg() =
on each inbound DATA frame (subsys/net/lib/ocpp/ocpp.c). A malicious or com= promised central server, or an on-path attacker (OCPP is commonly deployed = over plain ws://), can send an RPC frame whose uid or action field is 127+ = bytes with no closing quote, triggering the out-of-bounds access. The prima=
ry impact is a remotely triggerable denial of service: the unbounded scan c=
an fault on an unmapped page, and the stray NUL write can corrupt adjacent = stack state. The over-read data is not reflected to the peer, so disclosure=
is limited. The feature is EXPERIMENTAL and must be explicitly enabled (CO= NFIG_OCPP). The fix replaces the manual parser with the bounds-respecting j= son_mixed_arr_parse() and copies the extracted uid with an explicitly NUL-t= erminated buffer, eliminating both over-reads. 2026-08-02 7 CVE-2026-10848 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-10848 ] zip-lib--zip-lib Vers= ions of the package zip-lib before 1.1.0 are vulnerable to Directory Traver= sal via the caching mechanism for path validation during the extraction pro= cess. An attacker can bypass security checks designed to prevent directory = traversal. The intended security function, isOutsideTargetFolder, only chec=
ks and caches the path status when the initial directory symlink is created=
during the first extraction. 2026-07-28 7.5 CVE-2026-17524 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-17524 ]=20

Back to top [ #top ]

Medium Vulnerabilities

Primary
Vendor -- Product Description Published CVSS Score Source Info 100plugins--= Open User Map Contributor Cross Site Scripting (XSS) in Open User Map <=3D = 1.4.46 versions. 2026-07-27 6.5 CVE-2026-66445 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-66445 ] @fastify/forwarded--@fastify/forwarded @fastify/f= orwarded resolves client addresses from the X-Forwarded-For header. In vers= ions before 3.0.2, when the header contains two or more comma separated ent= ries, the parser trims only space characters and does not strip horizontal = tabs, even though RFC 7230 defines optional whitespace as both space and ta=
b. As a result, an entry padded with a tab keeps the literal tab in the res= olved address string. Applications that make exact string match security de= cisions on the resolved client IP, such as an allowlist, a blocklist, a per=
IP rate limit key, or audit log correlation, can be evaded because the tab=
corrupted string no longer matches the expected value. This does not cross=
the trust boundary, since a tab corrupted string is not a valid IP and can= not be mistaken for a trusted proxy. The issue is fixed in @fastify/forward=
ed 3.0.2. 2026-07-29 5.3 CVE-2026-18174 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-18174 ] acacode--swagger-typescript-api swagger-typescript-api = generates API clients for Fetch or Axios from OpenAPI specifications. Prior=
to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolv=
es external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch=
any http or https target without private IP, redirect, DNS rebinding, or s= ame-origin validation, allowing an attacker-controlled OpenAPI spec to make=
the generator issue requests to internal or link-local services. This issu=
e is fixed in version 13.12.2. 2026-07-29 6.1 CVE-2026-54663 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-54663 ] acowebs--Checkout Field Editor for = WooCommerce Checkout Manager Shop manager Cross Site Scripting (XSS) in Che= ckout Field Editor for WooCommerce &#8211; Checkout Manager <=3D 3.0.5 vers= ions. 2026-07-27 5.9 CVE-2026-66475 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-66475 ] AcyMailing Newsletter Team--Anti Spam and list cleaner AcyCh= ecker Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list clea= ner &#8211; AcyChecker <=3D 1.8.1 versions. 2026-07-27 6.5 CVE-2026-65448 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-65448 ] adonisjs--http-server = AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJ=
S framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2=
, the error.message is interpolated into the default HTML exception respons=
e without escaping, allowing a crafted missing-route URL to execute attacke= r-controlled JavaScript when a victim opens it and no custom status page or=
JSON response handles the error. When debug mode is disabled and no custom=
status page handles the error, the default HTML renderer interpolates erro= r.message directly into an HTML response. This issue is fixed in versions 8= .2.1 and 9.1.0. 2026-07-30 6.1 CVE-2026-61526 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-61526 ] ads-tec Industrial IT--DVG-IRF1401 An unauthentica= ted remote attacker can abuse the improper validation of the post-login red= irect of the web-UI to trick users to a malicious website. This can result =
in a loss of confidentiality and availability. 2026-07-28 6.1 CVE-2026-1417=
1 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14171 ] Alibaba--Alibaba Cl= oud RDS OpenAPI MCP Server Improper exposure of the MCP server in alibabacl= oud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP to= ols via network access to an MCP endpoint listening on all network interfac=
es by default. 2026-07-28 5.8 CVE-2026-9680 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-9680 ] ameliabooking--Booking System Trafft The Booking Syst=
em Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting=
via the `bookingWebsiteUrl` setting in all versions up to, and including, = 1.0.17 due to a missing capability check on the `set_options` AJAX action w= hen the plugin is operating in agency mode. The `trafftSetOptions()` handle=
r verifies a nonce that is exposed to any authenticated user (it is printed=
inline on every admin page, including profile.php) but performs no capabil= ity check before calling `update_option('trafft_option', ['bookingWebsiteUr=
l' =3D> ...])`. This setting is then used by `trafftAdminAssets()` to enque=
ue `<bookingWebsiteUrl>/embed.js` as a script on every front-end page that = renders the booking shortcode. This makes it possible for authenticated att= ackers, with Subscriber-level access and above, to point the embed-script U=
RL at an attacker-controlled origin and execute arbitrary JavaScript in the=
browser of every site visitor (including admins). 2026-07-29 6.4 CVE-2026-= 8791 [ https://www.cve.org/CVERecord?id=3DCVE-2026-8791 ] ANDRITZ--HIPASE-2=
50 The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in = affected versions exposes an undocumented endpoint that changes the server'=
s logging level and target without requiring authentication. A remote, unau= thenticated attacker with network access to the service may suppress audit = logging, potentially concealing other activity on the system. 2026-07-31 5.=
3 CVE-2026-65311 [ https://www.cve.org/CVERecord?id=3DCVE-2026-65311 ] Apac=
he Software Foundation--Apache Thrift Improper Validation of Certificate wi=
th Host Mismatch vulnerability in Apache Thrift Python bindings. This issue=
affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to = version 0.24.0, which fixes the issue. This replaces=C2=A0CVE-2026-41603 20= 26-07-27 5.9 CVE-2026-66053 [ https://www.cve.org/CVERecord?id=3DCVE-2026-6= 6053 ] Apache Software Foundation--Apache Traffic Server Apache Traffic Ser= ver reads out of bounds while parsing DNS answers. This issue affects Apach=
e Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from=
10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 =
or 10.1.4, which fix the issue. 2026-07-29 6.5 CVE-2026-58160 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-58160 ] Apache Software Foundation--Apache=
Traffic Server Apache Traffic Server copies the client Host header into a = fixed-size stack buffer without a bound during redirect handling, so an ove= r-long Host header overflows the stack when redirect following is enabled. = This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.= 0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to up= grade to version 9.2.15 or 10.1.4, which fix the issue. 2026-07-29 5.9 CVE-= 2026-33930 [ https://www.cve.org/CVERecord?id=3DCVE-2026-33930 ] Apache Sof= tware Foundation--Apache Traffic Server Apache Traffic Server mishandles in= tegers while decoding HPACK/XPACK headers, corrupting memory. This issue af= fects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9= .2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to vers= ion 9.2.15 or 10.1.4, which fix the issue. 2026-07-29 5.9 CVE-2026-58152 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-58152 ] Apache Software Foundat= ion--Apache Traffic Server Apache Traffic Server mishandles PROXY protocol = input, truncating ports and overflowing the stack. This issue affects Apach=
e Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from=
10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 =
or 10.1.4, which fix the issue. 2026-07-29 5.9 CVE-2026-58158 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-58158 ] Apache Software Foundation--Apache=
Traffic Server The Apache Traffic Server prefetch plugin can crash when pr= ocessing attacker-influenced input. This issue affects Apache Traffic Serve=
r: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through=
10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, whic=
h fix the issue. 2026-07-29 5.9 CVE-2026-58183 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-58183 ] Apache Software Foundation--Apache Traffic Server=
The Apache Traffic Server intercept plugin has a use-after-free. This issu=
e affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 throu=
gh 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to = version 9.2.15 or 10.1.4, which fix the issue. 2026-07-29 5.9 CVE-2026-5818=
5 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58185 ] Apache Software Fou= ndation--Apache Traffic Server Apache Traffic Server mis-parses ports in UR=
Ls and userinfo, allowing port-based access-control bypass. This issue affe= cts Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2= .14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to versio=
n 9.2.15 or 10.1.4, which fix the issue. 2026-07-29 4.9 CVE-2026-58156 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-58156 ] Apache Software Foundatio= n--Apache Traffic Server Apache Traffic Server updates the HTTP/2 HPACK dyn= amic table before confirming the header block encoded successfully, so an e= ncode failure leaves the encoder out of sync with the peer decoder and corr= upts subsequent header blocks on the connection. This issue affects Apache = Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 1= 0.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or=
10.1.4, which fix the issue. 2026-07-29 4.8 CVE-2026-65100 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-65100 ] Apache Software Foundation--Apache T= raffic Server Apache Traffic Server reuses multiplexed HTTP/2 origin connec= tions without verifying the server certificate covers the new request hostn= ame. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, f= rom 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.=
15 or 10.1.4, which fix the issue. 2026-07-29 4.8 CVE-2026-65325 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-65325 ] ArcadeData--arcadedb ArcadeDB b= efore 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the = ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operat= ions, which map to setCustomValue and setBucketSelectionStrategy in LocalDo= cumentType. An authenticated user with only read access (e.g., a read-only = API token) can submit these ALTER TYPE statements via the HTTP command endp= oint to mutate a type's custom schema metadata and bucket-selection strateg=
y, bypassing the documented updateSchema permission boundary and potentiall=
y corrupting schema metadata and record routing. 2026-08-01 4.3 CVE-2026-67= 344 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67344 ] ArnasDon--wacrm W= ACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, th=
e automation send_webhook action in src/lib/automations/engine.ts and its v= alidation in src/lib/automations/validate.ts allowed an authenticated user = with automation privileges to submit an arbitrary webhook URL that the serv=
er fetched without the existing isDeliverableUrl SSRF guard in src/lib/webh= ooks/ssrf.ts, allowing requests to private, loopback, link-local, or cloud = metadata addresses such as the cloud metadata endpoint at 169.254.169.254. = This vulnerability is fixed with commit 23838a9959550e975d732ae08a44a3a2f0c= c084b. 2026-07-30 6.4 CVE-2026-67530 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-67530 ] arnog--mathlive MathLive provides web components for math d= isplay and input. Prior to 0.110.0, MathLive fails to escape text-mode cont= ent in \text{} and \mbox{} commands in Box.toMarkup at src/core/box.ts, in = xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts=
, and through convertLatexToMarkup, convertLatexToMathMl, <math-span>, <mat= h-div>, and the default identity MathfieldElement.createHTML, allowing mali= cious input to run arbitrary JavaScript when rendered. This issue is fixed =
in version 0.110.0. 2026-07-29 6.3 CVE-2026-54705 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-54705 ] AstrBotDevs--AstrBot A vulnerability was ident= ified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function =
of the file astrbot/core/astr_main_agent.py. The manipulation of the argume=
nt req.func_tool leads to incorrect authorization. The attack may be initia= ted remotely. The exploit is publicly available and might be used. The iden= tifier of the patch is d23011262e8e75e1ec41b0f1f0091493a022327e. It is sugg= ested to install a patch to address this issue. 2026-07-27 6.3 CVE-2026-175=
29 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17529 ] AstrBotDevs--AstrB=
ot A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5.=
Affected by this vulnerability is the function _build_handoff_toolset of t=
he file AstrBot/astrbot/core/astr_agent_tool_exec.py of the component Subag= ent. The manipulation results in incorrect authorization. The attack may be=
launched remotely. The exploit has been released to the public and may be = used for attacks. The patch is identified as d23011262e8e75e1ec41b0f1f00914= 93a022327e. A patch should be applied to remediate this issue. 2026-07-27 6=
.3 CVE-2026-17530 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17530 ] Aut= odesk--AutoCAD A maliciously crafted DWG or DXF file, when parsed through A= utodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious=
actor can leverage this vulnerability to cause a crash or disclose sensiti=
ve information. 2026-07-29 6.1 CVE-2026-16465 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-16465 ] Autodesk--AutoCAD A maliciously crafted DWG or DXF=
file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Rea=
d vulnerability. A malicious actor can leverage this vulnerability to cause=
a crash or disclose sensitive information. 2026-07-29 5.5 CVE-2026-17550 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-17550 ] azukaar--Cosmos-Server=
Cosmos provides users the ability self-host a home server by acting as a s= ecure gateway to your application, as well as a server manager. In 0.22.18,=
`GET /cosmos/api/constellation/public-devices` discloses Constellation dev= ice metadata to a requester that supplies any non-empty Authorization heade=
r. The handler strips the string Bearer from the header but never validates=
the resulting token and never uses it in the database query. This vulnerab= ility is fixed in 0.22.19. 2026-07-28 5.3 CVE-2026-49447 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-49447 ] better-auth--better-auth better-auth ve= rsions before 1.4.9 contain a two-factor authentication bypass vulnerabilit=
y when session.cookieCache is enabled. Attackers with valid primary credent= ials can access authenticated routes without completing second-factor verif= ication by exploiting premature session caching. 2026-08-01 6.5 CVE-2026-67= 337 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67337 ] better-auth--bett= er-auth better-auth (npm) before 1.4.2 allows an external request to config= ure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unse= t). An attacker able to make the very first request to the server after sta= rtup can poison the router's base path, causing all routes to return 404 fo=
r all users (denial of service). The issue is not reachable when baseURL is=
explicitly configured or on typical managed hosting platforms. 2026-08-02 = 5.9 CVE-2025-71401 [ https://www.cve.org/CVERecord?id=3DCVE-2025-71401 ] be= tter-auth--better-auth better-auth versions before 1.6.2 fail to validate t=
he OAuth state parameter against the stored nonce when using cookie-backed = state storage without PKCE. Attackers can forge the state parameter and sup= ply an attacker-controlled authorization code to create authenticated sessi= ons bound to the attacker's external identity or persistently link attacker=
accounts to victim profiles. 2026-08-01 5.3 CVE-2026-67335 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-67335 ] better-auth--oauth-provider @better-= auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience=
to the authorization grant, allowing clients to request tokens for unrelat=
ed resources. Attackers can complete an OAuth flow and obtain access tokens=
whose audience targets resource servers the authorization never covered, b= ypassing intended authorization boundaries. 2026-08-01 6.4 CVE-2026-67332 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-67332 ] blendmedia--WP CTA Cal=
l Now Button, Sticky Button & Call to Action Builder The WP CTA plugin for = WordPress is vulnerable to Server-Side Request Forgery via the 'sticky_s_me= dia' parameter in imported JSON files in all versions up to, and including,=
2.1.2. This is due to the import_sidebars() function passing user-supplied=
URLs from imported JSON data to file_get_contents() with only FILTER_VALID= ATE_URL validation (which allows internal IPs). This makes it possible for = authenticated attackers, with Administrator-level access and above, to make=
web requests to arbitrary locations originating from the web application, = which can be used to query and modify information from internal services. T=
he response content is saved as a WordPress media attachment, making this a=
full-read SSRF. 2026-07-29 4.9 CVE-2026-6089 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-6089 ] bplugins--Survey Form Block collect answers and ins= ights from your audience The Survey Form Block plugin for WordPress is vuln= erable to unauthorized access of data due to a missing capability check on = the get_all_data() function in all versions up to, and including, 1.0.1. Th=
is makes it possible for authenticated attackers, with Subscriber-level acc= ess and above, to export all survey submission data and column metadata. 20= 26-07-29 4.3 CVE-2026-5626 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56=
26 ] brainstormforce--SureForms Contact Form Builder, AI Forms, Payment For=
m, Survey & Quiz The SureForms - Contact Form, Payment Form & Other Custom = Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Script= ing via the 'headingWrapper' parameter in all versions up to, and including=
, 2.8.1 due to insufficient input sanitization and output escaping. This ma= kes it possible for authenticated attackers, with contributor-level access = and above, to inject arbitrary web scripts in pages that will execute whene= ver a user accesses an injected page. 2026-08-01 6.4 CVE-2026-7623 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-7623 ] brightio--penelope Penelope Sh= ell Handler is a post-exploitation shell handler for authorized security te= sting. Prior to 0.20.0, the Unix download() implementation in penelope.py u= sed tar.extractall(local_download_folder) on tar archives returned by remot=
e sessions without validating member paths, allowing a malicious or comprom= ised session to write files outside the intended download directory and pot= entially overwrite ~/.penelope/peneloperc. This issue is fixed in version 0= .20.0. 2026-07-29 5.9 CVE-2026-50558 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-50558 ] Budibase--budibase Budibase before 3.38.1 contains a server= -side request forgery vulnerability in the REST datasource integration that=
fails to validate HTTP redirects against the IP blacklist. Attackers with = Builder role can configure a REST datasource pointing to an external server=
that returns a redirect to internal IP addresses, bypassing blacklist prot= ection to access cloud metadata endpoints and internal services. 2026-08-01=
6.8 CVE-2026-67311 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67311 ] C= haty--Chaty Pro The Chaty Pro plugin for WordPress is vulnerable to Authent= icated Time-Based Blind SQL Injection in versions up to and including 3.5.5=
. This is due to the fetch_custom_field() function in admin/class-admin-bas= e.php retrieving the widget_id POST parameter via filter_input(INPUT_POST, = ...) and directly concatenating the value into a raw SQL query in a numeric=
context without using $wpdb->prepare() or any integer casting. Additionall=
y, the nonce verification check is performed after the SQL query has alread=
y executed, providing no protection against the injection. This makes it po= ssible for authenticated attackers with subscriber-level access and above t=
o inject arbitrary SQL commands, potentially leading to unauthorized extrac= tion of sensitive database contents including user credentials and configur= ation data. 2026-07-28 6.5 CVE-2026-6251 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-6251 ] chrisvrichardson--MapPress Maps for WordPress Unauthenti= cated Sensitive Data Exposure in MapPress Maps for WordPress <=3D 2.97.6 ve= rsions. 2026-07-27 5.3 CVE-2026-65564 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-65564 ] Cisco--Cisco Secure Firewall Management Center (FMC) A vul= nerability in the web interface of Cisco Secure Firewall Management Center = (FMC) Software could allow an unauthenticated, remote attacker to log in to=
an affected device using a low-privileged account to access sensitive data=
within the impacted systems. This vulnerability is due to the presence of = static user credentials for a low-privileged&nbsp;account. An attacker coul=
d exploit this vulnerability by using the account to log in to an affected = system. A successful exploit could allow the attacker to log in to the affe= cted system and access sensitive data as the low-privileged user.&nbsp; Not= e:&nbsp;If the FMC management interface does not have public internet acces=
s, the attack surface that is associated with this vulnerability is reduced= .&nbsp;&nbsp; Cisco has assigned this security advisory a Security Impact R= ating (SIR) of High rather than Medium as the score indicates. The reason i=
s that this vulnerability can be used with other Cisco Secure FMC Software = vulnerabilities to elevate privileges. 2026-07-29 5.3 CVE-2026-20316 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-20316 ] clastix--kamaji Kamaji is t=
he Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the P= ostgreSQL and MySQL datastore drivers build DDL statements by interpolating=
the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via = fmt.Sprintf, without escaping identifiers. These fields have no format vali= dation, so a value containing a quote character breaks out of the quoted id= entifier - SQL injection executed over Kamaji's root connection to the shar=
ed datastore. etcd driver is not affected.This issue is fixed in version 26= .7.4-edge. 2026-07-30 4.7 CVE-2026-62845 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-62845 ] cloudreve--cloudreve Cloudreve is a self-hosted file ma= nagement and sharing system. Prior to 4.17.0, the built-in thumbnail and av= atar image decoders limit compressed file size but do not limit decoded pix=
el dimensions, allowing an authenticated user to submit a small PNG, JPEG, =
or GIF that triggers an unbounded allocation and terminates the Cloudreve p= rocess through fatal out-of-memory behavior. This issue is fixed in version=
4.17.0. 2026-07-31 6.5 CVE-2026-55497 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-55497 ] cloudreve--cloudreve Cloudreve is a self-hosted file ma= nagement and sharing system. Prior to 4.17.0, ViewerSessionValidation uses = only the session-id prefix of a WOPI access token and does not enforce the = requested viewer action, allowing a malicious or compromised WOPI viewer wi=
th a view session to forge the token suffix and invoke WOPI write routes fo=
r the underlying file. This issue is fixed in version 4.17.0. 2026-07-31 6.=
3 CVE-2026-62323 [ https://www.cve.org/CVERecord?id=3DCVE-2026-62323 ] clou= dreve--cloudreve Cloudreve is a self-hosted file management and sharing sys= tem. Prior to 4.17.0, the WOPI PUT_RELATIVE handler passes X-WOPI-Suggested= Target to URI.JoinRaw as a path rather than a filename, allowing slash and = dot-dot segments to escape the source file directory and create or conditio= nally overwrite files elsewhere in the same owner account. This issue is fi= xed in version 4.17.0. 2026-07-31 4.3 CVE-2026-55495 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-55495 ] cloudreve--cloudreve Cloudreve is a self-ho= sted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/= search calls SearchActive without adding a StatusActive predicate and seria= lizes matches at RedactLevelUser, allowing any logged-in user to enumerate = email addresses and profile metadata for inactive or banned accounts. The s= ervice calls userClient.SearchActive, but despite its name that method filt= ers only by email/nickname keyword and never adds a StatusActive predicate =
- while the sibling lookups GetActiveByID and GetActiveByDavAccount, define=
d a few lines above it, do. Search hits are serialized at RedactLevelUser, = which includes the email address. This issue is fixed in version 4.17.0. 20= 26-07-31 4.3 CVE-2026-55496 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5= 5496 ] cloudreve--cloudreve Cloudreve is a self-hosted file management and = sharing system. Prior to 4.17.0, a single-file share event-stream subscript= ion resolves the share root to the owner's parent folder and subscribes to = that folder topic, allowing an authenticated share recipient to receive nam= es, paths, rename targets, event types, and hashed identifiers for unshared=
sibling files and folders. This issue is fixed in version 4.17.0. 2026-07-=
31 4.3 CVE-2026-55499 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55499 ]=
codeigniter4--CodeIgniter4 CodeIgniter is a PHP full-stack web framework. =
In versions prior to 4.7.4, IncomingRequest::isSecure() trusted the X-Forwa= rded-Proto and Front-End-Https headers from any incoming request, allowing =
an attacker could spoof these headers and cause the application to incorrec= tly treat an HTTP request as secure. This may have impacted applications th=
at rely on isSecure(), force_https(), forceGlobalSecureRequests, or similar=
logic to enforce HTTPS-only access or make security-sensitive decisions. E= xploitability depends on deployment configuration. Applications are most ex= posed if the backend is reachable directly over HTTP, or if a reverse proxy= /load balancer forwards client-supplied forwarding headers without strippin=
g or overwriting them. This issue has been fixed in version 4.7.4. 2026-07-=
31 4.8 CVE-2026-63220 [ https://www.cve.org/CVERecord?id=3DCVE-2026-63220 ]=
codename065--Download Manager The Download Manager plugin for WordPress is=
vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute i=
n all versions up to, and including, 3.3.66 due to insufficient input sanit= ization and output escaping. This makes it possible for authenticated attac= kers, with contributor-level access and above, to inject arbitrary web scri= pts in pages that will execute whenever a user accesses an injected page. w= p_kses_post() does not neutralize the payload because it operates on post c= ontent at save time and does not process shortcode attribute values that ar=
e emitted unescaped at render time. 2026-08-01 6.4 CVE-2026-16685 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-16685 ] codesupplyco--Powerkit Superch= arge your WordPress Site The Powerkit - Supercharge your WordPress Site plu= gin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' = Shortcode Attribute in all versions up to, and including, 3.1.0 due to insu= fficient input sanitization and output escaping. This makes it possible for=
authenticated attackers, with contributor-level access and above, to injec=
t arbitrary web scripts in pages that will execute whenever a user accesses=
an injected page. 2026-08-01 6.4 CVE-2026-15644 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-15644 ] codesupplyco--Powerkit Supercharge your WordPre=
ss Site The Powerkit - Supercharge your WordPress Site plugin for WordPress=
is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute=
in all versions up to, and including, 3.1.0 due to insufficient input sani= tization and output escaping. This makes it possible for authenticated atta= ckers, with contributor-level access and above, to inject arbitrary web scr= ipts in pages that will execute whenever a user accesses an injected page. = 2026-08-01 6.4 CVE-2026-15645 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -15645 ] codesupplyco--Powerkit Supercharge your WordPress Site The Powerki=
t - Supercharge your WordPress Site plugin for WordPress is vulnerable to S= tored Cross-Site Scripting via Shortcode Attributes in all versions up to, = and including, 3.1.0 due to insufficient input sanitization and output esca= ping. This makes it possible for authenticated attackers, with contributor-= level access and above, to inject arbitrary web scripts in pages that will = execute whenever a user accesses an injected page. 2026-08-01 6.4 CVE-2026-= 15649 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15649 ] CODESYS--CODESY=
S PROFINET An out of bounds write vulnerability in the CODESYS PROFINET Con= troller allows an unauthenticated attacker on the same network segment to s= end malformed PROFINET communication data that triggers an exception in the=
affected PLC application. The exception is handled by the CODESYS Control = runtime system and results in a controlled stop of the PLC application. 202= 6-07-29 6.5 CVE-2026-35226 [ https://www.cve.org/CVERecord?id=3DCVE-2026-35= 226 ] contrid--Newsletters The Newsletters Lite plugin for WordPress is vul= nerable to Stored Cross-Site Scripting via the 'target' attribute of the [n= ewsletters_post] shortcode in versions up to and including 4.15. This is du=
e to insufficient input sanitization and output escaping in the posts_singl= e() function which propagates the attacker-controlled 'target' attribute in=
to the global $wpml_target, and in the shortcode_posts() 'post_thumbnail' h= andler which concatenates $wpml_target into a target=3D"..." HTML attribute=
without esc_attr(). This makes it possible for authenticated attackers, wi=
th Contributor-level access and above, to inject arbitrary web scripts in p= ages that will execute whenever a user accesses an injected page. 2026-07-2=
9 6.4 CVE-2026-12938 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12938 ] = contrid--Newsletters The Newsletters Lite plugin for WordPress is vulnerabl=
e to Stored Cross-Site Scripting via the 'link' attribute of the post_thumb= nail (and newsletters_post_thumbnail) shortcodes in versions up to and incl= uding 4.15. This is due to insufficient input sanitization and output escap= ing in the post_thumbnail() method in helpers/shortcode.php, which concaten= ates the user-controlled $link shortcode attribute directly into an href at= tribute without esc_url() or esc_attr(). This makes it possible for authent= icated attackers, with contributor-level access and above, to inject arbitr= ary web scripts in pages that will execute whenever a user accesses an inje= cted page. 2026-07-29 6.4 CVE-2026-12939 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-12939 ] cozythemes--Cozy Blocks Page Builder for Gutenberg Edit=
or & FSE with 600+ Patterns, 58 Blocks & Templates The Cozy Blocks - Page B= uilder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates=
plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pos= tMeta.font.size' Block Attribute in all versions up to, and including, 2.2.=
11 due to insufficient input sanitization and output escaping. This makes i=
t possible for authenticated attackers, with contributor-level access and a= bove, to inject arbitrary web scripts in pages that will execute whenever a=
user accesses an injected page. 2026-07-28 6.4 CVE-2026-15393 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-15393 ] cozythemes--Cozy Blocks Page Buil= der for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates Th=
e Cozy Blocks - Page Builder for Gutenberg Editor & FSE with 600+ Patterns,=
58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-S= ite Scripting via 'layoutCircle.alignment' Block Attribute in all versions =
up to, and including, 2.2.11 due to insufficient input sanitization and out= put escaping. This makes it possible for authenticated attackers, with cont= ributor-level access and above, to inject arbitrary web scripts in pages th=
at will execute whenever a user accesses an injected page. 2026-08-01 6.4 C= VE-2026-15950 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15950 ] cozyvis= ion1--SMS Alert SMS & OTP for WooCommerce, Order Notifications & Abandoned = Cart Recovery The SMS Alert - SMS & OTP for WooCommerce, Order Notification=
s & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-base=
d SQL Injection via the 'orderby' parameter in all versions up to, and incl= uding, 3.9.7 due to insufficient escaping on the user supplied parameter an=
d lack of sufficient preparation on the existing SQL query. This makes it p= ossible for authenticated attackers, with administrator-level access and ab= ove, to append additional SQL queries into already existing queries that ca=
n be used to extract sensitive information from the database. 2026-07-28 4.=
9 CVE-2026-15670 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15670 ] cozy= vision1--SMS Alert SMS & OTP for WooCommerce, Order Notifications & Abandon=
ed Cart Recovery The SMS Alert - SMS & OTP for WooCommerce, Order Notificat= ions & Abandoned Cart Recovery plugin for WordPress is vulnerable to generi=
c SQL Injection via the 'id' parameter in all versions up to, and including=
, 3.9.7 due to insufficient escaping on the user supplied parameter and lac=
k of sufficient preparation on the existing SQL query. This makes it possib=
le for authenticated attackers, with administrator-level access and above, =
to append additional SQL queries into already existing queries that can be = used to extract sensitive information from the database. 2026-07-28 4.9 CVE= -2026-15671 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15671 ] cozyvisio= n1--SMS Alert SMS & OTP for WooCommerce, Order Notifications & Abandoned Ca=
rt Recovery The SMS Alert - SMS & OTP for WooCommerce, Order Notifications =
& Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL=
Injection via 'checkout_payment_plans' and 'order_status' Settings in all = versions up to, and including, 3.9.7 due to insufficient escaping on the us=
er supplied parameter and lack of sufficient preparation on the existing SQ=
L query. This makes it possible for authenticated attackers, with administr= ator-level access and above, to append additional SQL queries into already = existing queries that can be used to extract sensitive information from the=
database. This is a second-order SQL injection: the malicious payload is s= tored in the 'checkout_payment_plans' and 'order_status' settings via updat= e_option() and executed later when the cod_to_prepaid_cart_notification_sen= dsms_hook WP-Cron event fires SA_CodTOPrepaid::sendSms(). 2026-07-28 4.4 CV= E-2026-15673 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15673 ] Creative= item--Ekushey Project Manager CRM Ekushey Project Manager CRM through versi=
on 5.0 contains a missing uniqueness constraint vulnerability that allows a= uthenticated administrators to create duplicate client accounts with identi= cal email and password credentials. Attackers can exploit the lack of email=
field uniqueness enforcement to create conflicting account states where mu= ltiple accounts share the same email address with different passwords, resu= lting in unpredictable authentication behavior and unauthorized account acc= ess. 2026-07-27 6.7 CVE-2026-66028 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-66028 ] Creativeitem--Ekushey Project Manager CRM Ekushey Project Man= ager CRM through version 5.0 contains a stored cross-site scripting vulnera= bility that allows authenticated client users to inject arbitrary HTML and = JavaScript by entering malicious payloads into the client Name field on the=
Edit Profile page without sanitization. Attackers can craft and store mali= cious scripts that execute in the browser sessions of Staff or Administrato=
r users who view the Manage Clients or Manage Client Projects pages where c= lient names are rendered unsanitized. 2026-07-27 5.4 CVE-2026-66029 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-66029 ] Creativeitem--Ekushey Projec=
t Manager CRM Ekushey Project Manager CRM through version 5.0 ccontains a s= tored cross-site scripting vulnerability that allows authenticated client u= sers to inject arbitrary HTML and JavaScript by entering malicious payloads=
into the Ticket Title field on the Create New Ticket page. Attackers can c= raft and store malicious scripts that execute in the browser sessions of St= aff or Administrator users who view the Client Support page where ticket ti= tles are rendered unsanitized. 2026-07-27 5.4 CVE-2026-66030 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-66030 ] Creativeitem--Ekushey Project Manag=
er CRM Ekushey Project Manager CRM through version 5.0 contains a stored cr= oss-site scripting vulnerability that allows authenticated client users to = inject arbitrary HTML and JavaScript by entering malicious payloads into th=
e Reply Ticket field. Attackers can craft and store malicious scripts that = execute in the browser sessions of Staff or Administrator users who view th=
e Support Ticket detail page. 2026-07-27 5.4 CVE-2026-66031 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-66031 ] CSL Mobile Limited--CSL 1010 M2M 3G = WiFi Module CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a=
weak encryption vulnerability that allows unauthenticated attackers to rec= over all stored secrets in plaintext by reversing a single-byte XOR cipher = that uses a static key to obfuscate the configuration backup file. Attacker=
s can trivially decrypt the Router.cfg backup file to expose web administra= tion and telnet passwords, WPA/WPA2 pre-shared keys, PPPoE and 3G/APN crede= ntials, and SIM identifiers including IMSI and IMEI. 2026-07-30 6.2 CVE-202= 6-67596 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67596 ] cubewp1211--C= ubeWP Framework The CubeWP Framework plugin for WordPress is vulnerable to = SQL Injection in all versions up to and including 1.1.30. This is due to in= sufficient input sanitization in the cubewp_remove_relation() AJAX function=
, specifically the use of wp_unslash() on the relation_id parameter before = interpolating it directly into a raw SQL query without using $wpdb->prepare= (). The wp_unslash() call explicitly removes the backslash escaping that Wo= rdPress's wp_magic_quotes() adds to all $_POST data, neutralizing the only = layer of SQL injection protection. The sanitize_text_field() function appli=
ed afterward offers no SQL protection. This makes it possible for authentic= ated attackers, with subscriber-level access and above, to append additiona=
l SQL queries to the existing query. 2026-08-01 6.5 CVE-2026-6453 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-6453 ] CyberTimon--RapidRAW RapidRAW b= efore 1.6.0 does not validate the lutPath field in preset files before pass= ing it to File::open() in lut_processing.rs. On Windows, a UNC path in lutP= ath causes an outbound SMB connection to an attacker-controlled host, leaki=
ng the victim's NTLMv2 credentials. The vulnerable code path is reachable t= hrough two vectors: community presets fetched automatically from the remote=
preset repository when the victim opens the Community tab, and individual = preset files imported directly by the victim via the preset import feature = (handle_import_presets_from_file in file_management.rs). The second vector = does not require control of the community preset repository and is triggere=
d when a user imports a preset file shared through Discord, forums, or simi= lar channels. 2026-07-30 6.5 CVE-2026-64816 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-64816 ] DaveGamble--cJSON cJSON through 1.7.19 contains an i= nefficient algorithmic complexity flaw in cJSON_Compare(). When comparing o= bjects, the function recurses into each shared subtree twice, once in each = direction, with no depth guard, making the running time exponential in nest= ing depth. A small, deeply nested document of a few hundred bytes (depth ar= ound 40) compared for equality consumes hours of CPU, and the cost roughly = doubles with each additional level of nesting. An application that calls cJ= SON_Compare() on attacker-influenced JSON that is structurally equal to a r= eference document is exposed to a denial-of-service condition. 2026-07-29 5=
.9 CVE-2026-67216 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67216 ] Dav= eGamble--cJSON cJSON through 1.7.19 applies RFC 6902 JSON Patch operations = non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation t= hat is missing its value member, or a move operation whose destination path=
cannot be resolved, the existing target member is detached and deleted bef= ore the operation is fully validated, so the target document is mutated whi=
le cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() retu= rns a failure status. An attacker who can supply the patch document can des= troy addressable members of the target document even though the API reports=
that the patch failed, defeating the all-or-nothing behavior callers rely =
on to reject bad patches. 2026-07-29 5.3 CVE-2026-67217 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-67217 ] davejesch--Database Collation Fix The Da= tabase Collation Fix plugin for WordPress is vulnerable to time-based SQL I= njection via the 'force-collation-algorithm' parameter in all versions up t=
o, and including, 1.2.10 due to insufficient escaping on the user supplied = parameter and lack of sufficient preparation on the existing SQL query. Thi=
s makes it possible for unauthenticated attackers to append additional SQL = queries into already existing queries that can be used to extract sensitive=
information from the database. Exploitation requires a trigger.txt file to=
be present in the plugin's directory (/wp-content/plugins/database-collati= on-fix/trigger.txt), a condition created by DesktopServer integration event=
s such as site creation, copy, import, move, export, or deploy. 2026-08-01 = 5.3 CVE-2026-15018 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15018 ] de= cidim--decidim Decidim is a participatory democracy framework. Prior to 0.3= 0.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the no= rmal download_your_data flow requires the requester to be logged in as the = export owner, but the resulting Active Storage blob redirect URL can be rep= layed without authentication by anyone who obtains it. This is because Deci= dim::DownloadYourDataController#download_file authenticates the export owne=
r but redirects to a signed Active Storage blob URL that is no longer bound=
to the owner session. This issue is fixed in versions 0.30.9, 0.31.5, and = 0.32.0.rc2. 2026-07-31 6.5 CVE-2026-45377 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-45377 ] decidim--decidim Decidim is a participatory democracy = framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a=
participant can directly load /admin/demographics/questions/edit_questions=
and reach the demographics questionnaire editor without the required admin= istrator authorization. The demographics questionnaire editor should requir=
e admin access, but the route under /admin/demographics/questions renders t=
he editor interface without checking whether the caller is an admin. A norm=
al participant can load the page and see the live update form action, which=
proves the protected interface is reachable. This issue is fixed in versio=
ns 0.31.5 and 0.32.0.rc2. 2026-07-31 5.4 CVE-2026-45086 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-45086 ] decidim--decidim Decidim is a participat= ory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in=
0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search int= erpolates params[:term] into raw Arel.sql ORDER BY similarity expressions b= efore sanitization, allowing an authenticated organization administrator to=
execute blind PostgreSQL expressions and infer data through timing differe= nces. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2. 2026-= 07-31 5.5 CVE-2026-45376 [ https://www.cve.org/CVERecord?id=3DCVE-2026-4537=
6 ] decidim--decidim Decidim is a participatory democracy framework. Prior =
to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, = the identity-document verification admin controllers load pending Authoriza= tion records by raw identifier without confirming current_organization owne= rship, allowing an administrator from one tenant to view, approve, or rejec=
t another tenant's ID-document request. This issue is fixed in versions 0.3= 0.9, 0.31.5, and 0.32.0.rc2. 2026-07-31 4.9 CVE-2026-45330 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-45330 ] deveasel--Demi One Click Demo Import,=
Backup & Site Migration The Demi - One Click Demo Import, WP Backup & Site=
Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy i=
n all versions up to, and including, 0.0.8 via the handle_restore_step func= tion. This is due to missing HTTP access controls on the wp-content/uploads= /demi-backup-state/ directory, which exposes the cryptographic restore key = used to both authenticate the unauthenticated AJAX handler and forge signed=
restore-state envelopes. This makes it possible for unauthenticated attack= ers to copy arbitrary files to attacker-controlled destinations on the serv= er. An active restore operation must have been initiated, which writes the = .restore_key and .restore_step_token files to the public upload directory, = before the exposed secrets can be harvested and chained to achieve unauthen= ticated arbitrary file copy. 2026-07-28 5.3 CVE-2026-15012 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-15012 ] devitemsllc--ShopLentor All-in-One Wo= oCommerce Growth & Store Enhancement Plugin The ShopLentor - All-in-One Woo= Commerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerab=
le to Insecure Direct Object Reference in all versions up to, and including=
, 3.4.5 via the 'optionSection' parameter due to missing validation on a us=
er controlled key. This makes it possible for authenticated attackers, with=
contributor-level access and above, to read arbitrary wp_options rows - in= cluding internal plugin news feed data, WooCommerce block pattern transient=
s, and third-party configuration records - whose values are stored as array= s-of-arrays containing 'title' keys, enabling cross-plugin data leakage. 20= 26-07-28 4.3 CVE-2026-16797 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1= 6797 ] devitemsllc--ShopLentor All-in-One WooCommerce Growth & Store Enhanc= ement Plugin The ShopLentor - All-in-One WooCommerce Growth & Store Enhance= ment Plugin plugin for WordPress is vulnerable to time-based SQL Injection = via the 'orderby' parameter in all versions up to, and including, 3.4.5 due=
to insufficient escaping on the user supplied parameter and lack of suffic= ient preparation on the existing SQL query. This makes it possible for auth= enticated attackers, with administrator-level access and above, to append a= dditional SQL queries into already existing queries that can be used to ext= ract sensitive information from the database. 2026-07-28 4.9 CVE-2026-16811=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-16811 ] dfir-iris--iris-web = The IRIS web application in version 2.4.26 and possibly others does not pro= tect its MFA validation against brute-force attacks. 2026-07-30 5.9 CVE-202= 6-16971 [ https://www.cve.org/CVERecord?id=3DCVE-2026-16971 ] dfir-iris--ir= is-web The IRIS web application in version 2.4.26 and possibly others does = not protect its user authentication against brute-force attacks. 2026-07-30=
5.9 CVE-2026-18362 [ https://www.cve.org/CVERecord?id=3DCVE-2026-18362 ] d= fir-iris--iris-web The IRIS web application in version 2.4.26 and possibly = others contains a logout functionality which is ineffective. Stolen session=
cookies can therefore be misused for a long time. 2026-07-30 4.2 CVE-2026-= 16970 [ https://www.cve.org/CVERecord?id=3DCVE-2026-16970 ] dotonpaper--Pin= point Booking System Version 2 The Pinpoint Booking System - Version 2 plug=
in for WordPress is vulnerable to blind SQL Injection via the 'field' param= eter in all versions up to, and including, 2.9.9.6.9 due to insufficient es= caping on the user supplied parameter and lack of sufficient preparation on=
the existing SQL query. This makes it possible for authenticated attackers=
, with administrator-level access and above, to append additional SQL queri=
es into already existing queries that can be used to extract sensitive info= rmation from the database. The nonce required to reach the vulnerable endpo= int is emitted on all plugin admin pages loaded under manage_options, makin=
g it trivially obtainable by any authenticated administrator. 2026-08-01 4.=
9 CVE-2026-15403 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15403 ] drak= kan--SFTPGo SFTPGo prior to 2.7.4 contains a permission bypass vulnerabilit=
y that allows authenticated users to circumvent per-directory access contro=
ls by creating symbolic links in a permitted directory that point to files =
in directories where download, upload, or overwrite permissions are denied.=
Attackers can exploit the create_symlinks permission combined with read an=
d write access in one directory to read or modify files in restricted direc= tories, as operations are authorized against the link's directory permissio=
ns rather than the dereferenced target's directory permissions. 2026-07-30 = 4.2 CVE-2026-10031 [ https://www.cve.org/CVERecord?id=3DCVE-2026-10031 ] ed= ge22--GenerateBlocks The GenerateBlocks plugin for WordPress is vulnerable =
to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes=
in all versions up to, and including, 2.3.0 due to insufficient input sani= tization and output escaping. This makes it possible for authenticated atta= ckers, with contributor-level access and above, to inject arbitrary web scr= ipts in pages that will execute whenever a user accesses an injected page. =
A Contributor-level attacker can store the malicious payload by placing a d= ynamic tag such as {{post_meta key:...}} in a non-URL HTML attribute (e.g.,=
title, aria-label, alt, or data-* attributes) of a GenerateBlocks element = block, then setting the corresponding unprotected post meta key via the Cus= tom Fields metabox to a value containing a closing quote and an injected ev= ent-handler attribute. 2026-08-01 6.4 CVE-2026-13458 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-13458 ] eLyiN--gemini-bridge gemini-bridge is a lig= htweight MCP server bridging AI agents to Google's Gemini AI via the offici=
al CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode re=
ad any file path supplied in the files argument without confining it to the=
working directory, then forwarded the contents to the Gemini CLI. Because = the caller also controls query, the file contents are echoed back through t=
he Gemini round-trip (and sent to Google), making this an arbitrary local f= ile read. This issue is fixed in version 1.3.1. 2026-07-31 6.2 CVE-2026-547=
85 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54785 ] facturadorvirtual-= -Facturacin Electrnica Costa Rica The Facturaci=C3=83=C2=B3n Electr=C3=83= =C2=B3nica Costa Rica plugin for WordPress is vulnerable to Cross-Site Requ= est Forgery in all versions up to, and including, 2.0.2. This is due to mis= sing or incorrect nonce validation on the (global scope, included by fvcr_a= dmin_page_html) function. This makes it possible for unauthenticated attack= ers to modify the plugin's configuration, including API tokens, access toke= ns, economic activity, Hacienda environment mode, invoice and ticket emissi=
on flags, exchange rate, and branch settings via a forged request granted t= hey can trick a site administrator into performing an action such as clicki=
ng on a link. 2026-07-29 4.3 CVE-2026-9720 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-9720 ] Flipper Code--WP Maps Insertion of Sensitive Informati=
on Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Emb= edded Sensitive Data. This issue affects WP Maps: from n/a through 4.9.6. 2= 026-07-31 4.3 CVE-2026-28144 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 28144 ] foomagoo--Plugin Organizer The Plugin Organizer plugin for WordPres=
s is vulnerable to SQL Injection via the 'PO_plugin_path' parameter in vers= ions up to, and including, 10.2.4. This is due to insufficient escaping on = the user-supplied parameter in the perform_plugin_search() function, where = esc_sql() output is passed as the replacement string to preg_replace(), whi=
ch collapses backslash escapes and defeats the quoting protection; addition= ally, the AJAX handler lacks both nonce verification and capability checks.=
This makes it possible for authenticated attackers, with subscriber-level = access and above, to append additional SQL queries into already existing qu= eries that can be used to extract sensitive information from the database. = 2026-07-28 6.5 CVE-2026-15304 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -15304 ] Franky--Events Made Easy Unauthenticated Broken Access Control in = Events Made Easy <=3D 3.1.3 versions. 2026-07-27 6.5 CVE-2026-59557 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-59557 ] FreeRDP--FreeRDP FreeRDP bef= ore 3.29.0 contains a buffer over-disclosure vulnerability in the gateway W= ebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong=
reply reuses a fixed 1024-byte response stream whose length is not sealed =
to the actual received Ping payload, so a malicious gateway/WebSocket peer = sending a non-empty Ping control frame causes the client to reply with an o= verlong Pong that discloses bytes beyond the received payload (the peer rec= eives the masking key and can unmask the reply). A zero-length Ping reaches=
an assertion and terminates the client (denial of service). 2026-08-01 6.5=
CVE-2026-67292 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67292 ] FreeR= DP--FreeRDP FreeRDP before 3.29.0 fails to properly validate server-supplie=
d RDPDR paths in drive redirection, allowing attackers to access prefix-sib= ling paths outside the configured shared root. A malicious RDP server can r= ead, write, delete, and enumerate files in sibling directories by sending n= on-rooted paths that bypass the shared-root boundary check. 2026-08-01 6.3 = CVE-2026-67295 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67295 ] FreeRD= P--FreeRDP FreeRDP before 3.29.0 improperly validates the Extended Key Usag=
e (EKU) purpose of the peer certificate during client-side server TLS authe= ntication. In x509_utils_verify(), when server-purpose (X509_PURPOSE_SSL_SE= RVER) verification fails, the code falls back to client-purpose and any-pur= pose verification, so a trusted, hostname-matching certificate valid only f=
or clientAuth can be accepted as the RDP server certificate. In environment=
s relying on EKU separation between client and server certificates, this al= lows a clientAuth-only certificate issued by a trusted CA to bypass server = certificate purpose validation. 2026-08-01 5.9 CVE-2026-67294 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-67294 ] FreeRDP--FreeRDP FreeRDP versions = 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 = planar RLE bitmap decoder functions planar_decompress_plane_rle and planar_= decompress_plane_rle_only in libfreerdp/codec/planar.c. Only the 1-byte con= trol byte is bounds-checked; the subsequent 0-15 attacker-declared raw byte=
s are read without validating that the source buffer contains them. A malic= ious or compromised RDP server can send a truncated planar-encoded bitmap o=
r surface update (reachable via both the Bitmap Update PDU and RDPGFX Surfa=
ce Command paths) that causes the client to read past the end of the source=
buffer. The issue is fixed in FreeRDP 3.29.0. 2026-08-01 5.4 CVE-2026-6730=
6 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67306 ] FreeRDP--FreeRDP Fr= eeRDP before 3.29.0 (affected versions <=3D 3.28.0) contains an improper ce= rtificate hostname validation vulnerability. The TLS hostname matcher (tls_= match_hostname() in libfreerdp/crypto/tls.c) treats a wildcard pattern such=
as *.example.com as matching any hostname ending in .example.com, so it in= correctly accepts a wildcard certificate for multi-label subdomains like a.= b.example.com (which OpenSSL's X509_check_host() rejects). This weakens TLS=
server authentication under wildcard-certificate conditions. 2026-08-01 4.=
2 CVE-2026-67293 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67293 ] Free= RDP--FreeRDP FreeRDP before 3.29.0 (affected versions <=3D 3.28.0) contains=
a divide-by-zero vulnerability in the rdpecam camera redirection client. e= cam_dev_process_start_streams_request() parses a server-controlled CAM_MEDI= A_TYPE_DESCRIPTION from a StartStreamsRequest PDU but validates only Format=
and Flags, not FrameRateDenominator. When a malicious or compromised RDP s= erver sends a StartStreamsRequest with FrameRateDenominator set to zero, ec= am_encoder_context_init() (channels/rdpecam/client/encoding.c) computes Fra= meRateNumerator / FrameRateDenominator, causing an integer division by zero=
(SIGFPE) and termination of the FreeRDP client process. Camera redirection=
must be enabled on the client for the channel to be reachable. Fixed in Fr= eeRDP 3.29.0. 2026-08-01 4.3 CVE-2026-67302 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-67302 ] FreeRDP--FreeRDP FreeRDP before 3.29.0 contains a re= achable assertion (WINPR_ASSERT(OutputBufferLength =3D=3D BytesReturned)) i=
n serial_process_irp_device_control() in channels/serial/client/serial_main= .c. When serial device redirection is enabled and a server-controlled IRP_M= J_DEVICE_CONTROL request specifies an unsupported IOCTL with a non-zero Out= putBufferLength, CommDeviceIoControl() can fail with BytesReturned =3D 0, c= ausing the mismatch to trigger the assertion and abort the client process (= denial of service). 2026-08-01 4.3 CVE-2026-67303 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-67303 ] fusewp--FuseWP WordPress User Sync to Email Li=
st & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.=
) The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forge=
ry in all versions up to, and including, 1.1.24.2. This is due to missing n= once verification on the toggle_sync_status() function. This makes it possi= ble for unauthenticated attackers to toggle the status of sync rules (enabl= e/disable) via a forged request granted they can trick a site administrator=
into performing an action such as clicking on a link. 2026-07-30 4.3 CVE-2= 026-5582 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5582 ] getgrav--grav=
Grav Login Plugin versions before 3.8.13 contain an insufficient session e= xpiration vulnerability in TokenStorage.php where the findTriplet() method = fails to properly validate Remember Me token timestamps. Attackers with a c= aptured Remember Me cookie can authenticate indefinitely instead of the con= figured timeout period, as the expiry check compares an array to a scalar v= alue which always evaluates incorrectly in PHP. 2026-07-29 4.8 CVE-2026-664=
00 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66400 ] ggml-org--llama.cp=
p A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This = affects the function _visit_pattern of the file common/json-schema-to-gramm= ar.cpp. The manipulation results in null pointer dereference. The attack ca=
n be launched remotely. The pull request to fix this issue awaits acceptanc=
e. 2026-07-27 5.3 CVE-2026-17500 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-17500 ] ggml-org--llama.cpp A flaw has been found in ggml-org llama.cpp=
e15efe0. This vulnerability affects the function transform of the file com= mon/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Convers= ion. This manipulation causes uncontrolled recursion. The attack may be ini= tiated remotely. The pull request to fix this issue awaits acceptance. 2026= -07-27 5.3 CVE-2026-17501 [ https://www.cve.org/CVERecord?id=3DCVE-2026-175=
01 ] GitLab--GitLab GitLab has remediated an issue in GitLab EE affecting a=
ll versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19= .2.1 that under certain conditions could have allowed an authenticated user=
to merge code into a protected branch without the required approvals due t=
o a race condition in approval rule processing. 2026-07-29 6.5 CVE-2026-131=
13 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13113 ] GitLab--GitLab Git= Lab has remediated an issue in GitLab EE affecting all versions from 18.8 b= efore 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain=
conditions could have allowed some sensitive information to be disclosed t=
o an unintended host due to improper handling of upstream requests in virtu=
al registries. 2026-07-29 5.4 CVE-2026-16553 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-16553 ] GitLab--GitLab GitLab has remediated an issue in Gi= tLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1= .3, and 19.2 before 19.2.1 that under certain conditions could have allowed=
an unauthorized user to view project import source information due to a mi= ssing authorization check. 2026-07-29 5.3 CVE-2026-6336 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-6336 ] GitLab--GitLab GitLab has remediated an i= ssue in GitLab CE/EE affecting all versions from 12.8 before 19.0.5, 19.1 b= efore 19.1.3, and 19.2 before 19.2.1 that under certain conditions could ha=
ve allowed an authenticated user with Maintainer role to modify protected b= ranch configuration due to improper authorization in a projects API endpoin=
t. 2026-07-29 4.9 CVE-2026-14341 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-14341 ] GitLab--GitLab GitLab has remediated an issue in GitLab CE/EE a= ffecting all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 = before 19.2.1 that under certain conditions could have allowed an unauthent= icated user to view the title of a confidential issue through a publicly ac= cessible merge request due to improper authorization checks. 2026-07-29 4.3=
CVE-2026-14351 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14351 ] GitLa= b--GitLab GitLab has remediated an issue in GitLab EE affecting all version=
s from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditi= ons could have allowed an authenticated user to access information from una= uthorized projects due to improper neutralization of untrusted content proc= essed by the AI-assisted code review functionality. 2026-07-29 4.3 CVE-2026= -15077 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15077 ] GitLab--GitLab=
GitLab has remediated an issue in GitLab EE affecting all versions from 19=
.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could=
have allowed an authenticated user to bypass administrator-configured tool=
governance policies due to improper authorization enforcement during token=
generation. 2026-07-29 4.3 CVE-2026-15831 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-15831 ] GitLab--GitLab GitLab has remediated an issue in GitL=
ab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3=
, and 19.2 before 19.2.1 that under certain conditions could have allowed a=
n attacker to execute arbitrary JavaScript in another user's browser via a = crafted URL, due to improper sanitization of user-controlled input. 2026-07= -29 4.7 CVE-2026-3093 [ https://www.cve.org/CVERecord?id=3DCVE-2026-3093 ] = GitLab--GitLab GitLab has remediated an issue in GitLab CE/EE affecting all=
versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2=
.1 that under certain conditions could have allowed an authenticated user w= ith guest-role permissions to access test report contents they were not aut= horized to view due to improper access control enforcement. 2026-07-29 4.3 = CVE-2026-4672 [ https://www.cve.org/CVERecord?id=3DCVE-2026-4672 ] Gladinet= --CentreStack CentreStack before 17.4 contains a session variable injection=
vulnerability that allows unauthenticated attackers to inject arbitrary se= ssion variables by embedding newline and tab characters into a crafted Acco= untName parameter posted to the SelectProvider.aspx endpoint. Attackers can=
exploit the lack of input sanitization in the custom session serialization=
format to inject a resellerid session variable, bypassing the IsValidRSess= ion authentication check and gaining unauthorized access to management page=
s. 2026-07-30 6.5 CVE-2026-54364 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-54364 ] GNOME--GIMP A flaw was found in the file-sgi plugin in GIMP. Wh=
en processing an RLE-compressed SGI image, the plugin allocates memory for =
a row table. The image header dimensions (ysize and zsize) are read as 16-b=
it unsigned integers. If a crafted file sets both dimensions to their maxim=
um value (65535), the multiplication ysize * zsize overflows the standard 3= 2-bit int boundary before being passed to calloc. This integer overflow iss=
ue results in undefined behavior, aborting the plugin and causing a denial =
of service. 2026-07-27 5.5 CVE-2026-66757 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-66757 ] go-vikunja--vikunja Vikunja versions >=3D 0.24.0 and <= =3D 2.3.0 contain a broken object level authorization (BOLA) vulnerability =
in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view= }/tasks). The endpoint loads the requested project view from the URL path w= ithout verifying the caller is authorized for it. For a link-share token ho= lder, the task scope is pinned to the share's own project, but the view is = taken from the attacker-controlled path and never re-validated. As a result=
, a holder of any project share link can read any other tenant's kanban buc= ket records - bucket titles and the full created_by user object (username, = name, id) - for every view in the instance. The same missing pre-authorizat= ion view load also creates a project/view-ID existence oracle (404 vs. non-= 404) usable by link shares and ordinary authenticated users. Task contents = remain constrained to the share's own project and are not disclosed. Fixed =
in 2.4.0. 2026-08-02 6.5 CVE-2026-68582 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-68582 ] goshs-labs--goshs goshs is a feature-rich single-binary=
file server for red teamers and developers. Prior to 2.1.5, the httpserver= /updown.go multipart upload handler split part.FileName() on / but did not = reject .., allowing an unauthenticated upload with filename .. to create a = file outside the served tree. This issue is fixed in version 2.1.5. 2026-07= -28 6.5 CVE-2026-66063 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66063 =
] goshs-labs--goshs goshs is a feature-rich single-binary file server for r=
ed teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFi=
le handler opened files using a cleaned path but derived the authorization = filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL= -file protection and block-list checks. This issue is fixed in version 2.1.=
5. 2026-07-28 5.3 CVE-2026-66064 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-66064 ] guzzle--guzzle guzzlehttp/guzzle versions before 7.14.2 fail to=
properly isolate Proxy-Authorization headers from origin servers in cURL h= andlers. Attackers can capture proxy credentials through origin server acce=
ss logs when requests are redirected, bypassed, or sent through SOCKS proxi=
es that Guzzle misclassifies as direct connections. 2026-08-01 5.3 CVE-2026= -67339 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67339 ] guzzle--guzzle=
guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulne= rability in the CookieJar that accepts unlimited Set-Cookie header fields w= ith no size restrictions. Attackers can return many large cookies from a ma= licious server, causing Guzzle to store excessive data in memory and genera=
te oversized Cookie headers that fail in handlers or destination servers. 2= 026-08-01 5.3 CVE-2026-67353 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 67353 ] guzzle--guzzle guzzlehttp/guzzle versions before 7.15.1 contain an = information disclosure vulnerability in RedirectMiddleware. When the option=
al allow_redirects.referer setting is enabled, the middleware copies the UR=
I fragment (the portion after '#') from the referring request into the gene= rated Referer header when following a same-scheme redirect (e.g., HTTPS to = HTTPS). An attacker who controls the redirect destination can read this fra= gment from the incoming Referer header, potentially disclosing one-time log=
in secrets, access tokens, state values, or other sensitive client data to =
a server never meant to receive it. The referer setting is disabled by defa= ult. Fixed in 7.15.1, which strips the fragment before generating the Refer=
er value. 2026-08-01 5.9 CVE-2026-67354 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-67354 ] guzzle--guzzle guzzlehttp/guzzle versions before 7.15.1=
fail to preserve host-only cookie scope, storing the request host in the D= omain field instead of marking cookies as host-only. Attackers controlling = child hosts can receive host-only cookies intended only for parent hosts, p= otentially disclosing session identifiers and authorization tokens when the=
same cookie jar is reused across trust boundaries. 2026-08-01 5.9 CVE-2026= -67355 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67355 ] HCL Software--= HCL iControl HCL iControl v4.3.0 was affected by Security Misconfiguration = vulnerabilities. It involves the public exposure of internal configuration = files due to improper web server or application hardening. 2026-07-31 5.1 C= VE-2026-56567 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56567 ] HCL Sof= tware--HCL iControl HCL iControl was affected by Sensitive Data Exposure vu= lnerabilities. It involves the public exposure of internal configuration fi= les due to improper web server or application hardening. 2026-07-31 4 CVE-2= 026-56569 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56569 ] HCL--HCL iC= ontrol HCL iControl was affected by Improper Input Validation vulnerability=
. It is vulnerable to unexpected system behavior and potential security byp= asses. This was caused by an implementation flaw in an architectural securi=
ty tactic that fails to properly validate whether the received input matche=
s the expected type. 2026-07-31 4.3 CVE-2025-62347 [ https://www.cve.org/CV= ERecord?id=3DCVE-2025-62347 ] hfiref0x--LightFTP LightFTP 2.3.1 contains a = race condition vulnerability that allows remote attackers to crash the serv=
er by racing a fresh connection that reuses the FTP context against an in-p= rogress ABRT cleanup. Attackers can exploit the unprotected re-check of Wor= kerThreadId between worker_thread_cleanup() and pthread_join() outside of M= TLock to cause pthread_join() to operate on an invalid thread ID, resulting=
in a server crash. CVE-2024-11144 identifies an incomplete fix of this vul= nerability. 2026-07-31 5.9 CVE-2026-67607 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-67607 ] HT Plugins--Insert Headers and Footers Code HT Script = Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Foo= ters Code - HT Script <=3D 1.1.8 versions. 2026-07-27 4.3 CVE-2026-66474 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-66474 ] IBM--DataPower Gateway = 10.6CD IBM DataPower Gateway is vulnerable to an XML external entity inject= ion (XXE) attack when processing XML data. A privileged user could exploit = this vulnerability to expose sensitive information or consume memory resour= ces. 2026-07-30 5.5 CVE-2025-36374 [ https://www.cve.org/CVERecord?id=3DCVE= -2025-36374 ] IBM--Db2 IBM Db2 12.1.0 through 12.1.4 federated server is vu= lnerable to a denial of service when running non fenced federated queries. = 2026-07-30 6.2 CVE-2026-10695 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -10695 ] IBM--Engineering Requirements Management DOORS and DOORS Web Acces=
s IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.=
1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-sit=
e scripting. This vulnerability allows an unauthenticated attacker to embed=
arbitrary JavaScript code in the Web UI thus altering the intended functio= nality potentially leading to credentials disclosure within a trusted sessi= on. 2026-07-30 6.1 CVE-2025-0152 [ https://www.cve.org/CVERecord?id=3DCVE-2= 025-0152 ] IBM--Langflow OSS IBM Langflow OSS 1.0.0 through 1.8.4 contains = multiple broken access control vulnerabilities in its file handling API tha=
t allow unauthorized access to user files.The /api/v1/files/images/{flow_id= }/{file_name} endpoint does not enforce authentication or authorization che= cks, allowing unauthenticated remote attackers to retrieve image files asso= ciated with any flow by specifying a valid flow_id and file_name.Additional= ly, the /api/v1/files/download/{flow_id}/{file_name} endpoint requires auth= entication but fails to properly validate ownership of the requested resour= ce. As a result, an authenticated user can access files belonging to other = users by supplying arbitrary identifiers, leading to an authorization bypas=
s (IDOR).Successful exploitation may result in unauthorized disclosure of s= ensitive data, including files stored in private flows. This issue breaks t= enant isolation in multi-user deployments. 2026-07-30 6.5 CVE-2026-10700 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-10700 ] IBM--OPENBMC IBM OPENBM=
C FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadO= nly users to escalate privileges and give themselves administrator privileg= es. 2026-07-28 6.5 CVE-2026-7868 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-7868 ] IBM--OPENBMC IBM OPENBMC FW1110.00 through FW1110.20, and FW1060= .00 through FW1060.71 allows a user to supply a password with a resource du=
mp request stores that password into the BMC audit log where an admin user = can see it. 2026-07-28 4.5 CVE-2026-8058 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-8058 ] IBM--Operations Analytics - Log Analysis IBM Operations = Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6= .1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.= 8.4 does not invalidate session after a password chance which could allow a=
n authenticated user to impersonate another user on the system. 2026-07-30 = 6.3 CVE-2024-40683 [ https://www.cve.org/CVERecord?id=3DCVE-2024-40683 ] IB= M--PowerVM Hypervisor IBM PowerVM Hypervisor FW1110.00 through FW1110.20, a=
nd FW1060.00 through FW1060.71 could allow an attacker with physical access=
to the Transparent Memory Encryption (TME) hardware to decrypt encrypted m= emory due to insufficient cryptographic entropy. 2026-07-28 4.2 CVE-2026-49=
32 [ https://www.cve.org/CVERecord?id=3DCVE-2026-4932 ] IBM--Sterling B2B I= ntegrator IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 th= rough 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 a=
nd IBM Sterling File Gateway 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2= .0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 Ebics serv=
er component is vulnerable to cross-site scripting. This vulnerability allo=
ws an authenticated user to embed arbitrary JavaScript code in the Web UI t= hus altering the intended functionality potentially leading to credentials = disclosure within a trusted session. 2026-07-30 5.4 CVE-2025-36298 [ https:= //www.cve.org/CVERecord?id=3DCVE-2025-36298 ] IBM--Sterling B2B Integrator = IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File=
Gateway 6.2.2.0 through 6.2.2.0_1 is vulnerable to cross-site scripting. T= his vulnerability allows an authenticated user to embed arbitrary JavaScrip=
t code in the Web UI thus altering the intended functionality potentially l= eading to credentials disclosure within a trusted session. 2026-07-30 5.4 C= VE-2025-36431 [ https://www.cve.org/CVERecord?id=3DCVE-2025-36431 ] IBM--St= erling B2B Integrator IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, = 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling F= ile Gateway 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0=
through 6.2.2.0_1 is vulnerable to=C2=A0stored=C2=A0cross-site=C2=A0script= ing. This vulnerability allows a privileged user=C2=A0to embed arbitrary Ja= vaScript=C2=A0code=C2=A0in the Web UI=C2=A0thus altering the=C2=A0intended = functionality potentially leading to credentials disclosure within a truste=
d session. 2026-07-28 5.5 CVE-2026-7775 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-7775 ] IBM--Sterling B2B Integrator IBM Sterling B2B Integrator=
6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through = 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 = through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 stores potentially sensiti=
ve information in log files that could be read by a privileged user. 2026-0= 7-28 4.9 CVE-2026-1918 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1918 ]=
IBM--Sterling B2B Integrator IBM Sterling B2B Integrator 6.2.0.0 through 6= .2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM = Sterling File Gateway 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2,=
and 6.2.2.0 through 6.2.2.0_1 is vulnerable to an information disclosure d=
ue to sensitive information being included in the source code comments of a=
mailbox component. 2026-07-28 4.3 CVE-2026-3157 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-3157 ] IBM--Sterling B2B Integrator IBM Sterling B2B In= tegrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 = through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5_2, = 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 is vulnerable to a=
n information disclosure due to sensitive information being included in the=
source code comments of a dashboard component. 2026-07-28 4.3 CVE-2026-315=
8 [ https://www.cve.org/CVERecord?id=3DCVE-2026-3158 ] IBM--Sterling B2B In= tegrator IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0=
through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.1_2,=
and 6.2.2.0 through 6.2.2.0_1 could allow an authenticated user to obtain = sensitive information that should only be available to a privileged user. 2= 026-07-28 4.3 CVE-2026-7362 [ https://www.cve.org/CVERecord?id=3DCVE-2026-7= 362 ] IBM--Tivoli System Automation Application Manager IBM Tivoli System A= utomation Application Manager 4.1 and IBM WebSphere Application Server is a= ffected by cross-site scripting in the Administrative Console. 2026-07-30 5=
.4 CVE-2026-11383 [ https://www.cve.org/CVERecord?id=3DCVE-2026-11383 ] IBM= --TS4500 CLI tool IBM TS4500 CLI tool Versions:=C2=A0 0.1.31 through 1.12.0=
.0 does not validate or improperly validates TLS certificate validation, wh= ich could allow=C2=A0an attacker to obtain sensitive information using man =
in the middle techniques. 2026-07-28 5.9 CVE-2026-16107 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-16107 ] IBM--UCD - IBM UrbanCode Deploy IBM UCD =
- IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and I=
BM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8=
.2 through 8.2.1.0 is susceptible to an Exposure of Sensitive Information V= ulnerability in plugin output logs. This exposure could allow an attacker w= ith access to the logs to potentially obtain senstive values related to tha=
t step. 2026-07-30 4.3 CVE-2026-10569 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-10569 ] IBM--Verify Identity Access IBM Verify Identity Access 11.=
0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and I=
BM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Ve= rify Access Container 10.0 through 10.0.9.1 could allow a remote attacker t=
o obtain sensitive information when a detailed technical error message is r= eturned in the browser. This information could be used in further attacks a= gainst the system. 2026-07-30 5.3 CVE-2026-11904 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-11904 ] IBM--WebSphere Application Server IBM WebSphere=
Application Server 8.5, and 9.0 traditional could allow a remote attacker =
to conduct a cross-site scripting attack. 2026-07-28 6.1 CVE-2026-14515 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-14515 ] icegram--Icegram Engage = Popups, Optins, CTAs & Lead Generation The Icegram Engage - Popups, Optins,=
CTAs & Lead Generation plugin for WordPress is vulnerable to second-order = SQL Injection via 'messages[][id]' Parameter in all versions up to, and inc= luding, 3.1.42 due to insufficient escaping on the user supplied parameter = and lack of sufficient preparation on the existing SQL query. This makes it=
possible for authenticated attackers, with contributor-level access and ab= ove, to append additional SQL queries into already existing queries that ca=
n be used to extract sensitive information from the database. The injection=
is second-order: the malicious id value is first persisted to post meta vi=
a the save_campaign_preview() AJAX action (gated by a nonce check and edit_= post capability, requiring Editor-level access or above), and only executed=
as SQL when a subsequent preview request triggers get_message_data() to in= terpolate the stored value directly into a SQL IN() clause without $wpdb->p= repare() or integer casting. 2026-08-01 6.5 CVE-2026-16087 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-16087 ] icegram--Icegram Mailer Reliable Emai=
l Deliverability, No-code SMTP Replacement & Email logs The Icegram Mailer = plugin for WordPress is vulnerable to SQL Injection via the 'fields' parame= ter in versions up to, and including, 1.0.12. This is due to insufficient e= scaping on the user supplied parameter and lack of sufficient preparation o=
n the existing SQL query in the Icegram_Mailer_Logs_Table::get_logs() funct= ion, where each element of the `fields` array received from $_REQUEST['data=
'] is joined verbatim into the SELECT clause via implode() with no whitelis=
t, escaping, or prepared-statement placeholder. This makes it possible for = authenticated attackers, with Administrator-level access and above, to appe=
nd additional SQL queries into already existing queries that can be used to=
extract sensitive information from the database. 2026-08-01 4.9 CVE-2026-1= 5951 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15951 ] igloohome--Smart=
Lock Mobile Application In igloohome Smart Lock Mobile App versions 3.2.3 = and prior, an Inclusion of Sensitive Information in Source Code vulnerabili=
ty could allow an unauthorized actor to access functions or backend service=
s that were not sufficiently protected by authentication controls. 2026-07-=
28 5.3 CVE-2026-16581 [ https://www.cve.org/CVERecord?id=3DCVE-2026-16581 ]=
ImageMagick--ImageMagick ImageMagick is free and open-source software used=
for editing and manipulating digital images. In versions prior to 7.1.2-27=
, a heap buffer over-write can occur in the fx operation by passing a craft=
ed argument. This issue has been fixed in version 7.1.2-27. 2026-07-30 5 CV= E-2026-62363 [ https://www.cve.org/CVERecord?id=3DCVE-2026-62363 ] ImageMag= ick--ImageMagick ImageMagick is free and open-source software used for edit= ing and manipulating digital images. In versions prior to both 6.9.13-52 an=
d 7.1.2-27, processing an extremely large JNX file on 32-bit platforms can = cause an integer overflow, leading to a heap buffer over-write. This issue = has been fixed in versions 6.9.13-52 and 7.1.2-27. 2026-07-30 5.1 CVE-2026-= 62946 [ https://www.cve.org/CVERecord?id=3DCVE-2026-62946 ] ImageMagick--Im= ageMagick ImageMagick is free and open-source software used for editing and=
manipulating digital images. In versions prior to 7.1.2-27, the BGR decode=
r does not check for an end-of-file in every location so a crafted image co= uld result in an heap buffer over-read. This issue has been fixed in versio=
n 7.1.2-27. 2026-07-29 5.3 CVE-2026-64685 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-64685 ] ImageMagick--ImageMagick ImageMagick is free and open-= source software used for editing and manipulating digital images. In versio=
ns prior to 6.9.13-51 and 7.0.1-0 and above prior to 7.1.2-26, an invalid k= ernel can cause a heap buffer over-write when performing a morphology opera= tion with a user supplied kernel. This issue has been fixed in versions 6.9= .13-51 and 7.1.2-26. 2026-07-29 4.7 CVE-2026-62343 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-62343 ] inspirythemes--RealHomes Memberships The Real= Homes Memberships plugin for WordPress is vulnerable to authorization bypas=
s in all versions up to, and including, 3.0.9. This is due to the plugin no=
t properly verifying that a user is authorized to perform an action. This m= akes it possible for authenticated attackers, with subscriber-level access = and above, to grant themselves any premium membership tier without completi=
ng a PayPal transaction, generating a falsified active payment receipt and = gaining unauthorized access to restricted property listing allowances. 2026= -08-01 4.3 CVE-2026-10782 [ https://www.cve.org/CVERecord?id=3DCVE-2026-107=
82 ] iSaumya--Ad Invalid Click Protector (AICP) Unauthenticated Broken Acce=
ss Control in Ad Invalid Click Protector (AICP) <=3D 1.3.0 versions. 2026-0= 7-27 6.5 CVE-2026-65445 [ https://www.cve.org/CVERecord?id=3DCVE-2026-65445=
] itpathsolutions--Contact Form to Any API The Contact Form to Any API plu= gin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anya= pi_form_field' Post Meta in all versions up to, and including, 3.0.6 due to=
insufficient input sanitization and output escaping. This makes it possibl=
e for authenticated attackers, with contributor-level access and above, to = inject arbitrary web scripts in pages that will execute whenever a user acc= esses an injected page. 2026-07-29 6.4 CVE-2026-15735 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-15735 ] jegtheme--Jeg Kit for Elementor Powerful A= ddons for Elementor, Widgets & Templates for WordPress The Jeg Kit for Elem= entor plugin for WordPress is vulnerable to Sensitive Information Exposure =
in all versions up to, and including, 3.1.1 via the `enqueue_scripts()` met= hod in `class/dashboard/class-dashboard.php`. The plugin injects a `JkitDas= hboardOption` JavaScript object containing full plugin inventory (names, ve= rsions, paths, active status), system environment details (WordPress versio=
n, PHP version, site URLs, server capabilities), and potentially third-part=
y API credentials (Mailchimp API key via `jkit_user_data`) as an inline scr= ipt on the `post.php` admin page. Because this data is output without any c= apability check beyond post editing access, any authenticated user with Con= tributor-level access or above can view this sensitive configuration data b=
y inspecting the page source. This makes it possible for authenticated atta= ckers, with Contributor-level access and above, to extract sensitive site c= onfiguration data, installed plugin details, and potentially third-party AP=
I keys. 2026-08-01 4.3 CVE-2026-2916 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-2916 ] jfrog--artifactory Improper URL validation when handling spe= cific URLs, allows an attacker, under certain conditions, to make unauthori= zed requests from JFrog Artifactory, potentially exposing internal services=
and cached response data. 2026-07-27 6.5 CVE-2026-65618 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-65618 ] jfrog--artifactory A URL validation wea= kness in JFrog Artifactory Ansible repository handling could allow a user, = under specific repository access conditions, to cause unintended server-sid=
e requests. The issue primarily affects confidentiality and integrity and h=
as been addressed in fixed Artifactory versions. 2026-07-27 6.8 CVE-2026-65= 923 [ https://www.cve.org/CVERecord?id=3DCVE-2026-65923 ] jfrog--artifactor=
y JFrog Artifactory support for Terraform remote repositories was found to =
be susceptible to Server-Side Request Forgery (SSRF). An authenticated user=
- or, if anonymous access is enabled on the repository, an unauthenticated=
user - could cause Artifactory to issue outbound HTTP requests to arbitrar=
y destinations and receive the response content. 2026-07-27 6.5 CVE-2026-65= 924 [ https://www.cve.org/CVERecord?id=3DCVE-2026-65924 ] jfrog--artifactor=
y A user with JFrog Artifactory Cargo remote repository read access could m= ake Artifactory request unintended URLs and return the response. 2026-07-27=
6.5 CVE-2026-65925 [ https://www.cve.org/CVERecord?id=3DCVE-2026-65925 ] j= frog--artifactory Build readers can access another repository's environment=
properties. A caller with read access to an ordinary repository can select=
a readable repository parameter while retrieving environment properties fo=
r a protected build, exposing build environment secrets (confidentiality im= pact; no integrity or availability impact demonstrated). 2026-07-27 6.5 CVE= -2026-66018 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66018 ] jgwhite33= --WP Google Review Slider Unauthenticated Cross Site Request Forgery (CSRF)=
in WP Google Review Slider <=3D 18.4 versions. 2026-07-27 4.3 CVE-2026-664=
28 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66428 ] juev--nebula-mesh = nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual pr= ivate network. Prior to version 0.3.2, newly-minted operator API key expose=
d in redirect URL (Referer, history, proxy logs). This issue has been patch=
ed in version 0.3.2. 2026-07-28 5.5 CVE-2026-47768 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-47768 ] jupyterlab--jupyterlab JupyterLab before 4.5.=
9 contains a stored cross-site scripting vulnerability in the Extension Man= ager that fails to validate URI protocols in package metadata URLs. Attacke=
rs can publish malicious PyPI packages with javascript: URLs in project met= adata that execute arbitrary JavaScript in the JupyterLab origin when users=
click the extension name. 2026-08-01 6.1 CVE-2026-67338 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-67338 ] klubraum--Klubraum Membership Request T=
he Klubraum Membership Request plugin for WordPress is vulnerable to unauth= orized modification of data due to a missing capability check on the `kr_mr= _store_settings()` function in all versions up to, and including, 1.1.0. Th=
is makes it possible for unauthenticated attackers to update the plugin's s= ettings, including the Klubraum API token and introduction text, effectivel=
y hijacking the plugin's integration with the Klubraum service. 2026-07-29 = 5.3 CVE-2026-4604 [ https://www.cve.org/CVERecord?id=3DCVE-2026-4604 ] labe= lblanc--Improved Save Button The Improved Save Button plugin for WordPress =
is vulnerable to second-order SQL Injection via 'meta_key' Custom Field via=
'Save and Duplicate' Action in all versions up to, and including, 1.2.1 du=
e to insufficient escaping on the user supplied parameter and lack of suffi= cient preparation on the existing SQL query. This makes it possible for aut= henticated attackers, with author-level access and above, to append additio= nal SQL queries into already existing queries that can be used to extract s= ensitive information from the database. 2026-07-30 6.5 CVE-2026-16092 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-16092 ] Leantime--Leantime Leantim=
e 3.6.2 and prior contains a broken access control vulnerability that allow=
s authenticated users to read milestone data from projects they are not ass= igned to by supplying arbitrary integer milestone IDs to the tickets.getMil= estone JSON-RPC endpoint. Attackers can enumerate integer milestone IDs thr= ough the JSON-RPC API to access project planning information, milestone tit= les, descriptions, and timelines across all projects on the instance regard= less of project membership. 2026-07-27 6.5 CVE-2026-66412 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-66412 ] Leantime--Leantime Leantime 3.6.2 cont= ains an open redirect vulnerability in the Login controller that allows una= uthenticated attackers to redirect authenticated users to arbitrary externa=
l sites by manipulating the redirectUrl POST parameter. Attackers can craft=
a malicious login URL with a tampered redirectUrl value that bypasses FILT= ER_SANITIZE_URL validation to redirect victims to attacker-controlled sites=
for phishing or credential theft. 2026-07-30 6.1 CVE-2026-66414 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-66414 ] lrnz--Shortcodify The Shortcodi=
fy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'n= ame' Shortcode Attribute in all versions up to, and including, 1.4.3 due to=
insufficient input sanitization and output escaping. This makes it possibl=
e for authenticated attackers, with contributor-level access and above, to = inject arbitrary web scripts in pages that will execute whenever a user acc= esses an injected page. 2026-07-28 5 CVE-2026-11598 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-11598 ] magepeopleteam--Event Booking Manager for Wo= oCommerce Sell Tickets, Event Registration, RSVP & Event Calendar The Event=
Booking Manager for WooCommerce - Sell Tickets, Event Registration, RSVP &=
Event Calendar plugin for WordPress is vulnerable to authorization bypass =
in all versions up to, and including, 5.3.7. This is due to the plugin not = properly verifying that a user is authorized to perform an action. This mak=
es it possible for authenticated attackers, with contributor-level access a=
nd above, to modify site-wide payment settings - including WooCommerce paym= ent enablement, cart redirect behavior, login requirements for checkout, co= nfirmation page ID, and confirmed ticket statuses - that govern how all eve=
nt bookings are processed. 2026-07-29 4.3 CVE-2026-17166 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-17166 ] mailerpress--MailerPress Newsletter, em= ail marketing & AI automation The MailPress plugin for WordPress is vulnera= ble to unauthorized access in versions up to, and including, 1.5.0 via the = campaign revision-restore REST endpoint (POST /wp-json/mailpress/v1/campaig= n/<id>/restore-revision/<revision_id>). The route in the vulnerable range w=
as registered without a permissionCallback, allowing the restoreRevision() = handler to run for unauthenticated requests and overwrite a campaign's cont= ent_html with any prior revision. This makes it possible for unauthenticate=
d attackers to modify campaign content by restoring an arbitrary revision. = 2026-07-31 5.3 CVE-2026-18436 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -18436 ] mailerpress--MailerPress Newsletter, email marketing & AI automati=
on The MailerPress - Newsletter, email marketing & AI automation plugin for=
WordPress is vulnerable to unauthorized access due to a missing capability=
check on the `mailerpress/v1/contact` endpoint in all versions up to, and = including, 1.5.0. This makes it possible for unauthenticated attackers to u= pdate contact details. 2026-07-31 5.3 CVE-2026-18437 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-18437 ] Mattermost--Mattermost Mattermost versions = 11.6.x <=3D 11.6.5, 10.11.x <=3D 10.11.20, 11.8.x <=3D 11.8.1, 11.7.x <=3D = 11.7.4 fail to limit the number of frames and enforce the file size cap on = animated GIF uploads, which allows an authenticated attacker to cause a den= ial of service via a crafted animated GIF uploaded as a custom emoji.. Matt= ermost Advisory ID: MMSA-2026-00695 2026-07-27 6.5 CVE-2026-10819 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-10819 ] Mattermost--Mattermost Matterm= ost versions 11.8.x <=3D 11.8.0, 11.7.x <=3D 11.7.3, 11.6.x <=3D 11.6.5, 10= .11.x <=3D 10.11.20 fail to verify file deletion path which allows an admin=
with SAML system-console write permissions to delete arbitrary files outsi=
de the config directory from the server via the remove file endpoint.. Matt= ermost Advisory ID: MMSA-2026-00666 2026-07-28 5.5 CVE-2026-7521 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-7521 ] Mattermost--Mattermost Mattermos=
t versions 11.8.x <=3D 11.8.0, 11.7.x <=3D 11.7.3, 11.6.x <=3D 11.6.5, 10.1= 1.x <=3D 10.11.20 fail to bound the time and resource consumption of server= -side document content extraction which allows an authenticated user with f= ile-upload permission to degrade file uploads for all users on the server v=
ia repeatedly uploading small documents that are cheap to upload but expens= ive to extract, saturating the shared extraction worker pool.. Mattermost A= dvisory ID: MMSA-2026-00694 2026-07-27 4.3 CVE-2026-10600 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-10600 ] mervb1--Easy Property Listings The Eas=
y Property Listings plugin for WordPress is vulnerable to Stored Cross-Site=
Scripting via 'facebook' User Contact Method in all versions up to, and in= cluding, 3.5.24 due to insufficient input sanitization and output escaping.=
This makes it possible for authenticated attackers, with subscriber-level = access and above, to inject arbitrary web scripts in pages that will execut=
e whenever a user accesses an injected page. 2026-08-01 6.4 CVE-2026-16684 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-16684 ] Microsoft--Microsoft = Edge for Android Improper input validation in Microsoft Edge for Android al= lows an unauthorized attacker to perform tampering over a network. 2026-07-=
28 5.4 CVE-2026-62828 [ https://www.cve.org/CVERecord?id=3DCVE-2026-62828 ]=
mihail-barinov--Advanced Woo Labels Product Labels & Badges for WooCommerc=
e The Advanced Woo Labels - Product Labels & Badges for WooCommerce plugin = for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bg_colo=
r' parameter in all versions up to, and including, 2.48 due to insufficient=
input sanitization and output escaping. This makes it possible for authent= icated attackers, with contributor-level access and above, to inject arbitr= ary web scripts in pages that will execute whenever a user accesses an inje= cted page. 2026-08-01 6.4 CVE-2026-15662 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-15662 ] MikroTik--RouterOS An API session management flaw in pr= oducts with the MikroTik RouterOS API enabled are vulnerable to a Insuffici= ent Session Expiration vulnerability. This could allow active sessions to r= etain their previous permission set after inactivity timeouts or user group=
changes. As a result, an authenticated user whose permissions have been re= duced may continue accessing information. 2026-07-30 4.9 CVE-2026-14227 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-14227 ] miniOrange--WordPress So= cial Login and Register Contributor Cross Site Scripting (XSS) in WordPress=
Social Login and Register <=3D 7.8.0 versions. 2026-07-27 6.5 CVE-2026-655=
61 [ https://www.cve.org/CVERecord?id=3DCVE-2026-65561 ] mndpsingh287--Them=
e Editor The Theme Editor plugin for WordPress is vulnerable to Cross-Site = Request Forgery in all versions up to, and including, 3.1. This is due to m= issing nonce validation on the ms_update AJAX action. This makes it possibl=
e for unauthenticated attackers to modify child theme CSS styles via a forg=
ed request granted they can trick an administrator into performing an actio=
n such as clicking on a link. 2026-08-01 4.3 CVE-2025-14469 [ https://www.c= ve.org/CVERecord?id=3DCVE-2025-14469 ] modelcontextprotocol--ruby-sdk MCP R= uby SDK is the official Ruby SDK for Model Context Protocol servers and cli= ents. Prior to 0.23.0, MCP::Server::Transports::StdioTransport and MCP::Cli= ent::Stdio in the mcp gem use IO#gets without a byte limit, allowing a peer=
that sends data without a newline to exhaust process memory. This issue is=
fixed in version 0.23.0. 2026-07-29 6.2 CVE-2026-63119 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-63119 ] modelcontextprotocol--ruby-sdk MCP Ruby = SDK is the official Ruby SDK for Model Context Protocol servers and clients=
. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the = mcp gem does not expire sessions by default, so repeated initialize request=
s retain unbounded ServerSession objects and can exhaust process memory. Th=
is issue is fixed in version 0.23.0. 2026-07-29 5.3 CVE-2026-67430 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-67430 ] mohammadr3z-- The Persian Ele= mentor (=C3=98=C2=A7=C3=99=E2=80=9E=C3=99=E2=80=A6=C3=99=E2=80=A0=C3=98=C2= =AA=C3=99=CB=86=C3=98=C2=B1 =C3=99=C2=81=C3=98=C2=A7=C3=98=C2=B1=C3=98=C2= =B3=C3=9B=C5=92) plugin for WordPress is vulnerable to Price Manipulation i=
n all versions up to, and including, 2.8.1. This is due to the plugin trust= ing a user-supplied payment amount without server-side validation against t=
he configured ZarinPal widget price. This makes it possible for unauthentic= ated attackers to submit arbitrary payment amounts to the ZarinPal gateway = via the 'amount' parameter. 2026-07-30 5.3 CVE-2026-1982 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-1982 ] MoonshotAI--Kimi Code Kimi Code (@moonsh= ot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a stat=
ic hostname and IP-literal denylist in assertSafeFetchTarget, without resol= ving DNS or re-validating hosts after HTTP redirects. An attacker who can i= nfluence a FetchURL call (for example via prompt injection) can supply a cr= afted public hostname that resolves to loopback or another internal address=
, or a public URL that redirects to such a target, and thereby reach intern=
al network services that the denylist was intended to block. FetchURL is in= cluded in the default auto-approve tool set, so the call does not require i= nteractive user confirmation in manual mode. 2026-07-27 5.5 CVE-2026-17534 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-17534 ] MZ Automation GmbH--l= ibiec61850 The ACSE layer contains a flaw in the processing of AARQ PDUs du= ring MMS connection establishment. When parsing certain fields within the c= alling AP title, an attacker controlled length value of zero or one may cau=
se the parser to read past the end of a heap buffer. 2026-07-30 6.5 CVE-202= 6-56758 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56758 ] MZ Automation=
GmbH--libiec61850 The MMS BER decoder contains a boundary-handling flaw in=
the processing of certain fields within confirmed-request messages. When a=
crafted BER-encoded element is received over an established MMS session (T=
CP port 102), the decoder may advance its internal read position incorrectl=
y, leading to a heap out-of-bounds read. This condition causes the MMS hand= ling process to terminate unexpectedly, resulting in a denial-of-service. 2= 026-07-30 6.5 CVE-2026-63550 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 63550 ] MZ Automation GmbH--libiec61850 The MMS BER decoder contains a flaw=
in decoding fixed-width BER fields (boolean/integer): an attacker-supplied=
length value is not validated, causing a read past the end of a heap buffe=
r. This leads to termination of the MMS service process and a denial-of-ser= vice condition. 2026-07-30 6.5 CVE-2026-65421 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-65421 ] MZ Automation GmbH--libiec61850 The MMS server con= nection handler contains a flaw in its processing of BER-encoded request da= ta. When an MMS confirmed request PDU containing an extended BER tag is rec= eived over an established session, the decoder may advance its internal buf= fer incorrectly due to a missing bounds check. This results in a one byte h= eap out-of-bounds read and causes the MMS service process to terminate, lea= ding to a denial-of-service condition. 2026-07-30 6.5 CVE-2026-66349 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-66349 ] MZ Automation GmbH--libiec6= 1850 The GOOSE payload parser contains a boundary handling flaw that can be=
triggered by a single unauthenticated Layer 2 multicast frame on the proce=
ss bus. When processing specific payload fields, an attacker controlled inn=
er element length may exceed its enclosing length, causing the parser to ov=
er read by one byte. This out-of-bounds read reliably terminates the subscr= iber process, resulting in a denial-of-service condition. 2026-07-30 6.5 CV= E-2026-66364 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66364 ] MZ Autom= ation GmbH--libiec61850 The GOOSE parser contains an off-by-one boundary-ha= ndling flaw that can be triggered by a single unauthenticated Layer-2 multi= cast frame on the process bus. When specific GOOSE message fields are proce= ssed, the parser advances its internal buffer position incorrectly, resulti=
ng in a heap out-of-bounds read. On affected platforms, this condition reli= ably terminates the subscriber process and causes a denial-of-service. 2026= -07-30 6.5 CVE-2026-66369 [ https://www.cve.org/CVERecord?id=3DCVE-2026-663=
69 ] MZ Automation GmbH--libiec61850 The GOOSE subscriber component imprope= rly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE (E= therType 0x88B8) Layer-2 multicast messages. A specially crafted GOOSE fram=
e containing an undersized timestamp field can trigger a heap out-of-bounds=
read during message processing, causing the process to crash and resulting=
in a denial-of-service condition. 2026-07-30 6.5 CVE-2026-66720 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-66720 ] MZ Automation--lib60870 A craft=
ed IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated obje=
ct count causes TestCommand_getFromBuffer to read one byte past the end of = the heap-allocated message buffer. 2026-07-30 6.5 CVE-2026-61893 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-61893 ] MZ Automation--lib60870 A craft=
ed IEC 60870-5-104 I-frame with a declared object count exceeding what fits=
in the ASDU body causes InformationObject_ParseObjectAddress to read one b= yte past the end of the heap-allocated message buffer. 2026-07-30 6.5 CVE-2= 026-63033 [ https://www.cve.org/CVERecord?id=3DCVE-2026-63033 ] nanoid_proj= ect--nanoid nanoid (Nano ID) before 5.1.6 contains an infinite loop in the = customAlphabet and customRandom functions. When these functions are configu= red with a size of 0, the internal generation loop never satisfies its exit=
condition and spins indefinitely, hanging the calling thread. An applicati=
on that passes an unvalidated, attacker-controlled size of 0 to these funct= ions is exposed to a denial-of-service condition. 2026-07-29 5.9 CVE-2026-6= 7213 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67213 ] nanoid_project--= nanoid nanoid (Nano ID) before 5.1.16 contains an infinite loop in the cust= omAlphabet and nanoid functions of its non-secure module (nanoid/non-secure=
). When these functions are given a negative size, the loop counter is decr= emented from a negative value and never reaches its termination condition, = spinning indefinitely and hanging the calling thread. An application that p= asses an unvalidated, attacker-controlled negative size to these functions =
is exposed to a denial-of-service condition. 2026-07-29 5.9 CVE-2026-67214 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-67214 ] nasirahmed--Advanced = Form Integration Connect Forms to 200+ Apps The Advanced Form Integration -=
Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authoriza= tion bypass in all versions up to, and including, 2.6.0. This is due to the=
plugin not properly verifying that a user is authorized to perform an acti= on. This makes it possible for authenticated attackers, with subscriber-lev=
el access and above, to overwrite the site's stored MailUp OAuth tokens in = the adfoin_mailup_keys option with attacker-controlled tokens, hijacking fu= ture form-submission data to a MailUp account they control or nulling the t= okens to break the integration entirely. This is exploitable by any authent= icated user who can reach /wp-admin/profile.php, as admin_init fires for al=
l logged-in users visiting any wp-admin page. 2026-07-28 4.3 CVE-2026-16587=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-16587 ] netty--netty Netty i=
s an asynchronous, event-driven network application framework. In versions = prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder (=C2=A0Stomp= SubframeEncoder=C2=A0) does not escape or validate header values in =C2=A0C= ONNECT=C2=A0 and =C2=A0CONNECTED=C2=A0 frames, so raw newline (=C2=A0\n=C2= =A0) characters in a header value are written directly to the wire, allowin=
g an attacker who controls a header value to inject additional STOMP header=
s. This happens because the encoder intentionally skips escaping for CONNEC= T/CONNECTED frames per the STOMP 1.2 specification but never rejects the ra=
w newlines, and since a broker parses each line as a separate header, an at= tacker controlling a value such as a user-supplied login or passcode can ov= erwrite connection parameters or add authentication/role headers to bypass = authentication or escalate privileges (the actual impact is broker-dependen= t). The issue is fixed in versions 4.1.136.Final and 4.2.16.Final. 2026-07-=
29 6.5 CVE-2026-59920 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59920 ]=
netty--netty Netty is an asynchronous, event-driven network application fr= amework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAPro=
xy encoder (=C2=A0HAProxyMessageEncoder=C2=A0) writes AF_UNIX source and de= stination socket addresses into the HAProxy V1 text protocol without valida= ting them for CRLF characters, so an attacker who controls an AF_UNIX addre=
ss can inject =C2=A0\r\n=C2=A0 sequences and split the single PROXY header = into multiple lines. This is possible because the V1 protocol uses CRLF as = its line terminator and, unlike IPv4/IPv6 addresses whose format checks imp= licitly reject CRLF, AF_UNIX addresses are only validated for length (up to=
108 bytes), allowing a forged second PROXY header line that spoofs the cli= ent source/destination IP to a downstream server or load balancer. The issu=
e is fixed in versions 4.1.136.Final and 4.2.16.Final. 2026-07-29 5.5 CVE-2= 026-59919 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59919 ] netty--nett=
y Netty is an asynchronous, event-driven network application framework. Pri=
or to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder const= ructs multipart HTTP request bodies by directly concatenating user-supplied=
filenames and field names into Content-Disposition MIME headers without va= lidating or sanitizing CRLF characters (\r\n). Since MIME headers are delim= ited by CRLF, an attacker who controls the filename can inject arbitrary MI=
ME headers into the multipart body part. The root cause is that neither the=
encoder nor the FileUpload implementations' setFilename() methods, which o= nly check for null, neutralize CRLF characters before the filename is embed= ded into the header. This issue has been fixed in versions 4.1.136.Final an=
d 4.2.16.Final. 2026-07-28 5.7 CVE-2026-59921 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-59921 ] Nexcess--Event Tickets Unauthenticated Broken Acce=
ss Control in Event Tickets <=3D 5.29.0.1 versions. 2026-07-27 5.3 CVE-2026= -65567 [ https://www.cve.org/CVERecord?id=3DCVE-2026-65567 ] nextlevelbuild= er--GoClaw A flaw has been found in nextlevelbuilder GoClaw up to 3.13.2. A= ffected by this vulnerability is the function ExecTool.Execute of the file = goclaw/internal/http/tools_invoke.go of the component jq Handler. Executing=
a manipulation can lead to information disclosure. The attack can be launc= hed remotely. The exploit has been published and may be used. This patch is=
called 1230. It is advisable to implement a patch to correct this issue. 2= 026-07-28 4.3 CVE-2026-18038 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 18038 ] nice-select2--nice-select2 Versions of the package nice-select2 bef= ore 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> ele= ment. An attacker can supply a malicious payload that is rendered directly = into the DOM without proper sanitization, causing arbitrary script executio=
n in a victim's browser when they view or interact with the affected page. = 2026-07-28 6.1 CVE-2026-17528 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -17528 ] nik00726--Responsive Thumbnail Slider The Wp Responsive Thumbnail = Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting=
via the 'id' parameter in versions up to, and excluding, 1.1.53. This is d=
ue to insufficient input sanitization and output escaping in the responsive= _thumbnail_image_management() function, which echoes $_GET['id'] directly i= nto a double-quoted HTML attribute with no esc_attr() call. The only guard =
is a loose PHP numeric comparison ($_GET['id']>0) that a string beginning w= ith a numeric prefix trivially satisfies, and the addslashes() applied by w= p_magic_quotes() is inert in HTML-attribute context because backslash is no=
t an HTML escape character. This makes it possible for unauthenticated atta= ckers to inject arbitrary web scripts in pages that execute if they can suc= cessfully trick a user into performing an action such as clicking on a spec= ially crafted link. 2026-08-01 6.1 CVE-2026-18344 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-18344 ] NTPsec--ntpsec Buffer overflow in NTPsec's Zyf=
er refclock allows local attacker to crash ntpd 2026-07-31 4.7 CVE-2026-183=
21 [ https://www.cve.org/CVERecord?id=3DCVE-2026-18321 ] o6 Automation--ope= n62541 An unsigned integer underflow in the PubSub signature verification p= ath in open62541 may allow a remote attacker to cause a denial of service v=
ia a crafted UDP packet. 2026-07-30 5.9 CVE-2026-63362 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-63362 ] OliveTin--OliveTin OliveTin gives access =
to predefined shell commands from a web interface. From 3000.2.0 until 3000= .17.0, the service/internal/executor/arguments.go checkShellArgumentSafety = function does not treat regex: custom argument types as unsafe for Shell mo=
de actions, allowing values that pass typeSafetyCheckRegex to be interpolat=
ed by wrapCommandInShell into an sh -c command string and enabling OS comma=
nd injection. This issue is fixed in version 3000.17.0. 2026-07-29 6.6 CVE-= 2026-67438 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67438 ] OliveTin--= OliveTin OliveTin gives safe and simple access to predefined shell commands=
from a web interface. Prior to 3000.17.0, the service/internal/api/api.go = StartActionAndWait and StartActionByGetAndWait endpoints return full LogEnt=
ry output after execution without enforcing the logs permission, allowing a=
user with exec permission but logs:false to read action output. This issue=
is fixed in version 3000.17.0. 2026-07-29 4.3 CVE-2026-67439 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-67439 ] onionshare--onionshare OnionShare =
is an open source tool that lets you securely and anonymously share files, = host websites, and chat with friends using the Tor network. Prior to 2.6.4,=
OnionShare CLI/Desktop does not enforce the Receive mode disable_files set= ting in cli/onionshare_cli/web/receive_mode.py, where ReceiveModeRequest._g= et_file_stream() writes multipart file[] data to disk despite the text-only=
setting. This issue is fixed in version 2.6.4. 2026-07-31 5.4 CVE-2026-547=
07 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54707 ] onionshare--onions= hare OnionShare is an open source tool that lets you securely and anonymous=
ly share files, host websites, and chat with friends using the Tor network.=
Prior to 2.6.4, OnionShare CLI/Desktop follows symbolic links in cli/onion= share_cli/web/send_base_mode.py through SendBaseModeWeb.set_file_info() and=
stream_individual_file(), allowing remote recipients of Share or Website m= ode to read local files outside the selected directory. This issue is fixed=
in version 2.6.4. 2026-07-31 4.8 CVE-2026-54706 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-54706 ] opajaap--WP Photo Album Plus The WP Photo Album=
Plus plugin for WordPress is vulnerable to generic SQL Injection via the '= table' parameter in all versions up to, and including, 9.2.04.002 due to in= sufficient escaping on the user supplied parameter and lack of sufficient p= reparation on the existing SQL query. This makes it possible for authentica= ted attackers, with administrator-level access and above, to append additio= nal SQL queries into already existing queries that can be used to extract s= ensitive information from the database. The export-table endpoint lacks a n= once check, meaning this vulnerability can also be triggered via CSRF by tr= icking an authenticated administrator into visiting a malicious page. 2026-= 07-29 4.9 CVE-2026-15344 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1534=
4 ] openremote--openremote OpenRemote (org.openremote:openremote) versions = <=3D 1.26.2 contain an insecure direct object reference vulnerability in th=
e setAssetLinks endpoint of AlarmResourceImpl. The realm access check valid= ates only a single realm obtained via realms.stream().findFirst() on a Hash= Set of realms from the request, rather than all realms. Because HashSet ite= ration order is non-deterministic, an authenticated attacker who includes a= larm-asset links from both their own realm and a victim realm can, with rou= ghly 50% probability per request (retryable), persist cross-tenant links an=
d disclose victim asset names (returned via @Formula fields) through GET re= quests on the attacker's own alarm. Fixed in 1.27.0. 2026-08-01 5.4 CVE-202= 6-67310 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67310 ] openwrt--luci=
luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scriptin=
g vulnerability in the blocklist name field that allows lower-privileged us= ers to inject active HTML. When an administrator views the AdBlock Fast sta= tus page, the injected payload executes in the administrator's browser unde=
r the LuCI origin. 2026-08-02 5.4 CVE-2026-68583 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-68583 ] opf--openproject OpenProject is open-source, we= b-based project management software. Prior to 17.6.0, GET /api/v3/custom_op= tions/:id resolved CustomOption records by global numeric id and allowed Us= erCustomField and GroupCustomField options without checking visible(current= _user), so authenticated non-admin users could enumerate sequential custom = option ids and read labels belonging to admin_only user or group custom fie= lds. This issue is fixed in 17.6.0. 2026-07-30 4.3 CVE-2026-67528 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-67528 ] opf--openproject OpenProject i=
s open-source, web-based project management software. Prior to 17.6.0, GET = /api/v3/time_entries and GET /api/v3/cost_entries rendered _links.workPacka= ge.title and _links.workPackage.href through associated_resource in modules= /costs/lib/api/v3/time_entries/time_entry_representer.rb and modules/costs/= lib/api/v3/cost_entries/cost_entry_representer.rb without checking WorkPack= age.visible or view_work_packages, allowing users with view_time_entries or=
view_cost_entries to read private work package subjects and ids. This issu=
e is fixed in 17.6.0. 2026-07-30 4.3 CVE-2026-67529 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-67529 ] papra-hq--papra Papra is a minimalistic docu= ment management and archiving platform. Prior to version 26.5.0, an authent= icated user who is a member of any organization can delete or rename tags b= elonging to a different organization, given the target tag's ID. The route = handler verifies the caller's membership of the ":organizationId" in the UR=
L, but the repository write filters on tag.id alone, so the URL-level org s= cope never reaches the database. This issue has been patched in version 26.= 5.0. 2026-07-27 5.4 CVE-2026-48052 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-48052 ] pgadmin.org--pgAdmin 4 In SERVER mode, pgAdmin 4 enforces aut= hentication per route via the @pga_login_required decorator; the applicatio= n's before_request hook only handles desktop-mode auto-login and the Kerber= os/Webserver-auth redirect, so any route shipped without the decorator is r= eachable without authentication (CWE-306). This is the same defect class pr= eviously fixed as CVE-2026-12046 (the sqleditor close/update_connection rou= tes). A follow-up sweep, prompted by a report describing an incomplete fix = for CVE-2026-12046, found further routes missing @pga_login_required: the C= onstraints blueprint's nodes and proplist (object listing) routes and its d= elete route (a state-mutating DELETE that removes table constraints); prefe= rences.get_all_cli (GET, discloses all CLI-settable preference values); deb= ugger.close (DELETE); and schema_diff.close (DELETE). An unauthenticated ne= twork client could therefore enumerate constraint metadata, delete table co= nstraints, read preference values, and force-close debugger or schema-diff = sessions belonging to other users, without ever authenticating. Fix adds th=
e missing @pga_login_required decorator (and the corresponding import to th=
e Constraints module) to each of these routes. The change is decorator-only=
; no behavioral changes to the underlying handlers. This issue affects pgAd= min 4 in SERVER mode: the Constraints and Debugger routes from 1.0, the Sch= ema Diff close route from 4.18, and preferences.get_all_cli from 8.2, all b= efore 9.17. 2026-07-31 6.5 CVE-2026-17348 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-17348 ] pgadmin.org--pgAdmin 4 The per-tool permission system = (custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3) d=
id not enforce its permission check consistently. In SERVER mode, pgAdmin 4=
gates each tool behind a per-tool Flask-Security permission, but the permi= ssion decorator (permissions_required) was applied only to a single "front = door" route per tool. Every other backend route and Socket.IO handler in th=
at tool's workflow relied solely on pga_login_required/socket_login_require=
d, which check authentication but not the tool permission. The reporter ver= ified three cases against a test build: (1) a user without tools_query_tool=
permission received 403 on the protected sqleditor initialization route, b=
ut the same session went on to connect the server, initialize the viewdata = backend chain, and retrieve real table row content; (2) a user without tool= s_grant_wizard received 403 on the protected acl route, but the same sessio=
n still enumerated grantable objects, generated GRANT SQL, and successfully=
applied it -- confirmed database-side via has_table_privilege(); (3) a use=
r without tools_schema_diff received 403 on the protected panel route, but = the same session initialized schema diff, enumerated and connected database=
s, and obtained real DDL differences via the compare_database Socket.IO han= dler. The reporter also confirmed a related but distinct issue: a non-owner=
triggering /misc/workspace/adhoc_connect_server against an administrator-o= wned shared server caused pgAdmin to persist a new server row still owned b=
y the administrator (user_id/shared unchanged from the source), even though=
the connection attempt itself reported failure. During remediation, the sa=
me front-door-only permission gap was found to also affect the ERD, PSQL, a=
nd Debugger tools, and the Backup, Restore, Maintenance, and Import/Export = blueprints, none of which were part of the original report; these were fixe=
d using the same pattern as an extension of the reported defect class. An a= uthenticated user who had valid pgAdmin login and a stored, working databas=
e connection, but had been explicitly denied a specific tool's permission b=
y an administrator, could therefore still drive that tool end-to-end throug=
h its other routes and sockets, including obtaining an interactive psql ses= sion over the /pty Socket.IO namespace and invoking backup/restore/maintena= nce/import-export jobs. Because the bypass only restores access to tools op= erating over the user's own already-authenticated database connection, it d= oes not grant the user any database privilege they did not already hold; it=
circumvents pgAdmin's own tool-level access-control policy (an organisatio= nal segregation-of-duties control, separate from database-level authorizati= on), letting a user reach a pgAdmin feature an administrator intended to wi= thhold from them, using capabilities their existing database role already p= ermits through other means. Socket.IO event handlers had no permission-awar=
e equivalent of permissions_required; only socket_login_required existed, c= hecking authentication but not the tool permission. Fix adds a socket_permi= ssions_required decorator (mirroring permissions_required, honouring the Ad= ministrator bypass, reading permissions via has_permission()) and applies i=
t, alongside permissions_required, as the outermost decorator on every back= end route and Socket.IO handler for the affected tools. Regression tests as= sert 403 on every gated route and socket handler for a permission-less user=
. This issue affects pgAdmin 4 in SERVER mode: from 9.3 before 9.17. 2026-0= 7-31 5.4 CVE-2026-17350 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17350=
] Phoenix Contact--CHARX SEC-3150 The credentials for the local user "user= -app" may be exposed in log files, potentially enabling a low-privileged lo= cal attacker with access to the logs to authenticate via SSH as the limited=
user "user-app". Charging could be interrupted. 2026-07-30 6.6 CVE-2026-44= 105 [ https://www.cve.org/CVERecord?id=3DCVE-2026-44105 ] Phoenix Contact--= CHARX SEC-3150 An unauthenticated remote attacker can trigger a firmware up= date download via the OCPP backend by supplying an invalid firmware file. T= his will cause the file to remain accessible for a short period before it i=
s deleted due to improper locking during the cleanup process. 2026-07-30 5.=
3 CVE-2026-44102 [ https://www.cve.org/CVERecord?id=3DCVE-2026-44102 ] Phoe= nix Contact--CHARX SEC-3150 An unauthenticated remote attacker can inject m= alicious firmware into the internal charging module because the JupiCore se= rvice transmits firmware updates without performing integrity or verificati=
on check. Successful exploitation may compromise the integrity of the affec= ted device. This vulnerability could be used in chain with CVE-2026-44104. = 2026-07-30 5.3 CVE-2026-44103 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -44103 ] pion--stun pion/stun is a Go implementation of STUN. Prior to 3.1.=
3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR= -MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, al= lowing remote denial of service. This issue is fixed in version 3.1.3. 2026= -07-31 5.3 CVE-2026-54909 [ https://www.cve.org/CVERecord?id=3DCVE-2026-549=
09 ] pixelyoursite--PixelYourSite Your smart PIXEL (TAG) & API Manager The = PixelYourSite - Your smart PIXEL (TAG) & API Manager plugin for WordPress i=
s vulnerable to Sensitive Information Exposure in all versions up to, and i= ncluding, 11.2.1 via the getWooPurchaseEventParams. This makes it possible = for unauthenticated attackers to extract WooCommerce purchase metadata - in= cluding product names, product IDs, quantities, per-item prices, order tota= ls, currency, and order/transaction IDs - for any existing order by supplyi=
ng an invalid or arbitrary order key. This is exploitable against any known=
or enumerated order ID, as the plugin resolves the order from the URL path=
variable alone and emits the full woo_purchase tracking payload into the p= age HTML via the pysOptions JavaScript object across its Facebook, Google A= nalytics, and Google Tag Manager integrations regardless of key validity. 2= 026-08-01 5.3 CVE-2026-18059 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 18059 ] projectcapsule--capsule Capsule is a multi-tenancy and policy-based=
framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeM= etadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.Fo= rbiddenAnnotations.Regex were not validated by the configuration admission = webhook, allowing a Cluster Admin to store a malformed regex that later rea= ched regexp.MustCompile in pkg/api/forbidden_list.go through internal/webho= ok/node/user_metadata.go and crashed the node admission webhook on Node cre= ate, update, or patch requests. This issue is fixed in version 0.13.8. 2026= -07-30 6.8 CVE-2026-65834 [ https://www.cve.org/CVERecord?id=3DCVE-2026-658=
34 ] projectcapsule--capsule Capsule is a multi-tenancy and policy-based fr= amework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-= 2026-22872 fix, TenantResource RawItems and Generators in internal/controll= ers/resources/collect.go, including handleRawItem and handleGeneratorItem, = did not apply the ResourceReference.LoadResources and IsNamespacedGVK clust= er-scoped resource rejection guard used by NamespacedItems, allowing a Tena=
nt Owner to create cluster-scoped resources such as ClusterRole or Validati= ngWebhookConfiguration through the cluster-admin controller client. This is= sue is fixed in version 0.13.8. 2026-07-30 6.6 CVE-2026-65835 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-65835 ] pterodactyl--wings Wings is the se= rver control plane for Pterodactyl, a free, open-source game server managem= ent panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-fil=
e parsers in parser.go can process an oversized non-file parser configurati=
on file and exhaust Wings process memory. This issue is fixed in version 1.= 13.0. 2026-07-31 5.5 CVE-2026-52857 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-52857 ] pydantic--pydantic-ai Pydantic AI is a Python agent framewor=
k for building Generative AI applications. In versions 1.56.0 through 1.98.=
0, when an application opts a URL into force_download=3D'allow-local' (disa= bling the default block on private/internal IPs), the cloud-metadata blockl= ist could be bypassed by encoding the metadata IP in an IPv6 transition for=
m (IPv4-mapped IPv6, 6to4, or NAT64), exposing cloud IAM short-term credent= ials on dual-stack or translated networks. This is an incomplete fix of GHS= A-2jrp-274c-jhv3 / CVE-2026-25580, whose remediation did not hold for IPv6-= encoded forms of the metadata IPs. An application is affected only if it ex= plicitly opts a FileUrl (ImageUrl, AudioUrl, VideoUrl, DocumentUrl) into fo= rce_download=3D'allow-local' on a URL influenced by untrusted input; it is = not affected when using bundled integrations to ingest user input (Agent.to= _web / clai web, VercelAIAdapter, AGUIAdapter / Agent.to_ag_ui), since they=
do not propagate force_download from external data, nor when downloading o= nly from developer-controlled URLs. This issue has been fixed in version 1.= 99.0. 2026-07-29 6.8 CVE-2026-46678 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-46678 ] pydantic--pydantic-ai Pydantic AI is a Python agent framewor=
k for building Generative AI applications. In versions 1.65.0 through 1.105= .0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a=
Pydantic AI UI adapter (such as the Vercel AI adapter) can reference arbit= rary files in the application's model-provider or cloud-storage account. Wh= ile file URL parts are validated against a scheme allowlist, UploadedFile r= eferences - which point to a file by provider file ID or cloud-storage URI = (e.g. s3://, gs://) - were forwarded without validation. Because the provid=
er resolves an UploadedFile using the server-side identity (IAM role, servi=
ce account, or provider API key) rather than the client's, an attacker can = craft message history to make the server read objects from its own account =
or other tenants, given a referenceable identifier. Exploitation requires a=
valid file identifier, which is not always unguessable depending on how th=
e application names objects. This issue has been fixed in versions 1.106.0 = and 2.0.0b6. 2026-07-29 6.8 CVE-2026-54249 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-54249 ] pydantic--pydantic-ai Pydantic AI is a Python agent f= ramework for building applications and workflows with Generative AI. In ver= sions 1.88.0 up to but not including 1.107.1 and 2.0.0b1 up to but not incl= uding 2.5.0, the UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and V= ercel AI via VercelAIAdapter) use sanitize_messages to strip unresolved ("d= angling") client-submitted tool calls from untrusted message history before=
it reaches the agent, a defense-in-depth default that prevents the agent f= rom executing tool calls the model never emitted. However, the strip anchor=
ed to a message index computed before sanitization ran, so when a trailing = client message sanitized to empty and was dropped (for example a client sys= tem message under the default manage_system_prompt=3D'server'), a preceding=
assistant response carrying an unresolved tool call became the new tail an=
d was dispatched without inspection. As a result, a remote client could cau=
se a registered, non-approval server tool to run with client-supplied argum= ents rather than arguments the model produced. The impact is bounded by wha=
t the affected tools do and is most significant for applications that gate = tool execution in a model-request hook (before_model_request / after_model_= request), since a forged call skips the model turn and bypasses that guardr= ail; approval-gated tools (requires_approval=3DTrue) are not auto-executed =
by this path. This issue has been fixed in versions 1.107.1 and 2.5.0. 2026= -07-29 6.5 CVE-2026-65975 [ https://www.cve.org/CVERecord?id=3DCVE-2026-659=
75 ] quantumcloud--WPBot AI ChatBot for Live Support, Lead Generation, AI S= ervices The WPBot - AI ChatBot for Live Support, Lead Generation, AI Servic=
es plugin for WordPress is vulnerable to Sensitive Information Exposure in = all versions up to, and including, 8.5.9 via the wpbot_send_email_transcrip= t_free. This makes it possible for unauthenticated attackers to exfiltrate = full chat transcripts and associated user PII - including names, email addr= esses, and phone numbers - stored in the wpbot_user and wpbot_conversation = tables to an attacker-controlled email address. 2026-07-28 5.3 CVE-2026-167=
73 [ https://www.cve.org/CVERecord?id=3DCVE-2026-16773 ] quantumcloud--WPBo=
t AI ChatBot for Live Support, Lead Generation, AI Services The Chatbot plu= gin for WordPress is vulnerable to Missing Authorization in versions up to,=
and including, 8.5.9 via the wpcs_send_email() AJAX handler. This is due t=
o the wpcs_send_email() function being registered on both wp_ajax_wpcs_send= _email and wp_ajax_nopriv_wpcs_send_email with no nonce verification, capab= ility check, or rate limiting, while forwarding attacker-controlled recipie= nt, subject, and body directly to wp_mail(). This makes it possible for una= uthenticated attackers to send arbitrary emails to any recipient from the s= ite's domain, enabling spam, phishing, and abuse that can lead to the site'=
s IP/domain being blacklisted. 2026-07-28 5.3 CVE-2026-16774 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-16774 ] Red Hat--Cost Management Metrics Op= erator A flaw was found in koku-metrics-operator. The operator's CostManage= mentMetricsConfig custom resource allows a user able to edit the CR to spec= ify an arbitrary OAuth token endpoint. When authentication.type is set to s= ervice-account, the operator sends the tenant's Red Hat SSO client_id and c= lient_secret to this user-controlled URL, allowing the attacker to obtain t=
he credentials. 2026-07-30 6.8 CVE-2026-18382 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-18382 ] Red Hat--Red Hat Build of Keycloak A flaw was foun=
d in the group policy evaluation logic of Keycloak, an identity and access = management solution. When a group policy is set to extend permissions to ch= ild groups, the system incorrectly uses a simple text-based prefix check to=
verify group membership. This allows a user who belongs to a different gro=
up with a similar starting name to bypass security checks and gain unauthor= ized access to administrative functions or protected resources. 2026-07-31 = 6.5 CVE-2026-18203 [ https://www.cve.org/CVERecord?id=3DCVE-2026-18203 ] Re=
d Hat--Red Hat Build of Keycloak A flaw was found in the client policy enfo= rcement mechanism of Keycloak. The issue occurs when the system checks grou=
p membership by name instead of a unique identifier. An attacker with clien=
t management privileges could bypass security policies by joining a group w= ith a matching name in a different part of the group hierarchy, potentially=
allowing them to register or update clients without following required sec= urity hardening profiles. 2026-07-29 6.5 CVE-2026-18207 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-18207 ] Red Hat--Red Hat Build of Keycloak A fla=
w was found in the OIDC token introspection endpoint of the keycloak-servic=
es component. Keycloak is an open-source identity and access management sol= ution used to secure modern applications and services. The issue occurs whe=
n a confidential client, configured to receive signed JWT introspection res= ponses, attempts to introspect a token issued for a different audience. Alt= hough the endpoint correctly identifies the token as inactive for that clie= nt, it still returns the full set of token claims within a signed JWT field=
. This allows an unauthorized client to bypass audience-based restrictions = and access sensitive information contained in the token. 2026-07-31 6.5 CVE= -2026-18208 [ https://www.cve.org/CVERecord?id=3DCVE-2026-18208 ] Red Hat--= Red Hat Build of Keycloak Keycloak allows users to log in using Google acco= unts and can be configured to only allow users from specific Google Workspa=
ce domains. A flaw was found where the token exchange feature, which allows=
swapping a Google token for a Keycloak token, does not check these domain = restrictions. This means an attacker with a valid Google account from a dif= ferent domain could bypass the security check and gain access to the Keyclo=
ak realm. 2026-07-31 6.8 CVE-2026-18214 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-18214 ] Red Hat--Red Hat Build of Keycloak Keycloak provides a = way to let users log in using Microsoft accounts while restricting access t=
o a specific organization (tenant). A flaw was discovered where this restri= ction is ignored when using the token exchange feature. This means an attac= ker with a valid Microsoft token from a completely different organization c= ould gain access to the Keycloak realm, potentially accessing sensitive dat=
a or performing unauthorized actions. 2026-07-31 6.8 CVE-2026-18215 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-18215 ] Red Hat--Red Hat Build of Ke= ycloak A flaw was found in the user creation component of Keycloak when Fin= e-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a su= b-administrator with permission to create users to add those users to any g= roup, even groups the sub-administrator is not authorized to manage. This c= ould lead to unauthorized access to sensitive information or elevated privi= leges for the newly created users. 2026-08-02 6.6 CVE-2026-18571 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-18571 ] Red Hat--Red Hat Build of Keycl= oak Keycloak provides authorization services that allow administrators to r= estrict access to resources based on time policies (for example, only allow= ing access during business hours). A flaw was discovered where a user can i= nclude a fake time value in their authorization request that overrides the = actual server time. This allows the user to bypass these time-based restric= tions and access protected resources at unauthorized times. 2026-08-02 6.5 = CVE-2026-18572 [ https://www.cve.org/CVERecord?id=3DCVE-2026-18572 ] Red Ha= t--Red Hat Build of Keycloak A flaw was found in the keycloak-services comp= onent of Keycloak, which is used for managing authentication and authorizat= ion flows. The issue occurs when a realm administrator configures client po= licies to enforce specific authentication requirements on confidential clie= nts. Due to improper evaluation of the client state during an update operat= ion, an attacker with client management permissions can bypass these securi=
ty policies by first creating a public client and then updating it to a con= fidential client with weaker authentication. This can result in the persist= ence of clients that do not comply with the intended security hardening of = the realm. 2026-08-02 6.5 CVE-2026-18573 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-18573 ] Red Hat--Red Hat Build of Keycloak Keycloak provides a = way to manage identity providers and organizations through its administrati=
ve API. A flaw was discovered where an administrator with permission to man= age identity providers could link a new provider to an organization without=
having the required permissions to manage that organization. This could al= low an unauthorized administrator to influence how users log into specific = organizations. 2026-07-29 5.5 CVE-2026-18201 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-18201 ] Red Hat--Red Hat Build of Keycloak A flaw was found=
in the full-scope-disabled client-policy executor within the keycloak-serv= ices component. This component is responsible for enforcing security polici=
es during client registration and configuration in Red Hat Build of Keycloa=
k. The issue occurs because the executor only validates the fullScopeAllowe=
d field when it is explicitly provided in a request. By omitting this field=
, a delegated user can bypass the policy, resulting in a client created wit=
h full scope access. This allows the client to obtain tokens with unauthori= zed role mappings. 2026-08-02 5.4 CVE-2026-18570 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-18570 ] Red Hat--Red Hat Build of Keycloak A flaw was f= ound in the RoleContainerResource component of Keycloak. The issue occurs b= ecause certain name-based endpoints in the admin REST API do not properly e= nforce authorization checks when managing composite roles. This allows a de= legated administrator with manage-realm permissions to remove essential chi=
ld roles from built-in admin roles, potentially disrupting administrative f= unctions within a realm. 2026-07-31 4.9 CVE-2026-16105 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-16105 ] Red Hat--Red Hat Build of Keycloak A flaw=
was found in the secure-client-uris client policy executor within Keycloak=
core services. This component is responsible for enforcing security requir= ements on client configurations, such as requiring encrypted connections fo=
r redirect URIs. Due to an improper check that only looks at the start of a=
web address rather than properly verifying the host, an attacker can bypas=
s these security restrictions by using a specially crafted domain name. Thi=
s could allow an attacker to intercept sensitive authentication codes over = unencrypted connections. 2026-07-31 4.2 CVE-2026-18211 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-18211 ] Red Hat--Red Hat Build of Keycloak A flaw=
was found in the TokenManager component of the Keycloak identity managemen=
t service. When an administrator attempts to revoke tokens for a specific a= pplication (client) using a "not-before" policy, the revocation may be sile= ntly ignored if the overall security realm already has an older, non-zero r= evocation policy in place. This issue can allow previously issued tokens to=
remain valid for refreshing sessions and accessing user information even a= fter an administrator has attempted to invalidate them. =C3=A2=E2=80=9D=C2= =81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2= =80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81= =C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80= =9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3= =A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D= =C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2= =E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2= =81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2= =80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81= =C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80= =9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3= =A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D= =C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2= =E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2= =81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2= =80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81= =C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80= =9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3= =A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81 2026-07-31 4.2 CVE-2026-18218 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-18218 ] Red Hat--Red Hat Certifica=
te System 10 A flaw was found in Dogtag PKI's ACME responder where the web.= xml security constraints use exact URL pattern matching for admin-only enab= le/disable endpoints. By appending a trailing slash to the URL, an unauthen= ticated attacker can bypass the Tomcat authentication constraint while REST= Easy still routes the request to the handler, allowing unauthorized togglin=
g of the ACME service state including persistent denial of service. 2026-07= -28 6.5 CVE-2026-18047 [ https://www.cve.org/CVERecord?id=3DCVE-2026-18047 =
] Red Hat--Red Hat Certificate System 10 A flaw was found in Dogtag PKI's A= CME responder where the HTTP-01 challenge validator accepts IP address lite= rals as dns identifiers and follows HTTP redirects without validating that = the target is a public address. An unauthenticated ACME account holder can = exploit this to perform server-side request forgery (SSRF), making the Dogt=
ag server send HTTP GET requests to internal network services. With the InM= emory database backend, the response body of internal targets is disclosed =
to the attacker through the ACME challenge error. 2026-07-30 5.8 CVE-2026-1= 8369 [ https://www.cve.org/CVERecord?id=3DCVE-2026-18369 ] Red Hat--Red Hat=
Enterprise Linux 10 A flaw was found in the PCP (Performance Co-Pilot) `pm= proxy` service. A remote attacker can exploit a vulnerability in the `pmLog= LoadInDom()` function by sending a specially crafted request. This bypasses=
a critical bounds check, which can lead to the `pmproxy` service crashing,=
causing a Denial of Service (DoS). Additionally, this flaw may enable the = leakage of sensitive information from the system's memory. 2026-07-30 6.5 C= VE-2026-16530 [ https://www.cve.org/CVERecord?id=3DCVE-2026-16530 ] Red Hat= --Red Hat Enterprise Linux 10 A flaw was found in ansible-collection-redhat= -leapp. An attacker with privileged write access to a managed node's Leapp = report content can manipulate it. When an operator runs a specific remediat= ion task, this manipulated report can cause the Ansible controller to read = its own local files and copy them to the managed node. This vulnerability l= eads to information disclosure, potentially exposing sensitive controller-s= ide data such as private keys or credentials. 2026-07-30 6.2 CVE-2026-68562=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-68562 ] Red Hat--Red Hat Ent= erprise Linux 10 An unauthenticated remote attacker can exploit a path trav= ersal vulnerability in the PCP pmproxy logger servlet using a crafted hostn= ame. This allows arbitrary file and directory creation, potentially leading=
to a denial of service. 2026-07-30 5.3 CVE-2026-16531 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-16531 ] Red Hat--Red Hat Enterprise Linux 10 An o= ut-of-bounds read flaw was found in Samba's Kerberos Key Distribution Cente= r's (KDC) password change (kpasswd) service. When processing malformed ASN.= 1-encoded Kerberos password change request, Samba server miscalculates the = structure size and attempts to read up to six bytes beyond the end of the a= llocated buffer. While this out-of-bounds read typically results in a harml= ess decryption failure, if the read hits unmapped memory, it causes the KDC=
process to crash. An authenticated attacker can send a specially crafted k= passwd request containing malformed ASN.1 data to trigger the out-of-bounds=
read, which may cause the KDC process to terminate, resulting in a denial =
of service. 2026-07-30 5.3 CVE-2026-58216 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-58216 ] Red Hat--Red Hat Enterprise Linux 10 A flaw was found =
in Samba's internal DNS server where unauthenticated TKEY registration requ= ests were added to the TKEY name cache before being rejected. A remote, una= uthenticated attacker can exploit this behavior by sending a large number o=
f TKEY requests with arbitrary names, exhausting the cache and evicting leg= itimate TKEY entries. This can prevent legitimate TSIG authentication for s= igned DNS queries, resulting in a denial of service. 2026-07-30 5.3 CVE-202= 6-58218 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58218 ] Red Hat--Red = Hat Enterprise Linux 10 A flaw was found in ansible-collection-redhat-leapp=
. When a remediation task is executed with elevated privileges and the `lea= pp_old_postgresql_data` option is selected, a PostgreSQL data backup archiv=
e is created with insecure permissions. This allows a local non-root user o=
n the managed node to read sensitive archived PostgreSQL data, leading to i= nformation disclosure. 2026-07-30 5.5 CVE-2026-68563 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-68563 ] Red Hat--Red Hat Hardened Images A flaw was=
found in the GNU Binutils (Binary Utilities) linker. This vulnerability, a=
heap-buffer-overflow read (CWE-125), occurs when the linker processes a sp= ecially crafted 32-bit XCOFF (Extended Common Object File Format) object fi= le. An attacker could exploit this by providing a malicious file, leading t=
o an out-of-bounds read of memory. This can result in information disclosur=
e, potentially revealing sensitive heap data, and a Denial of Service (DoS)=
due to the linker crashing. 2026-07-27 5.6 CVE-2026-15003 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-15003 ] remix-run--react-router React Router =
is a router for React. In versions 6.4.0 through 7.17.0, if application cod=
e was written in a way that allows attacker-supplied input to overwrite cer= tain aspects of errors caught by the SSR process, then it was possible for =
an attacker to trigger unexpected constructor execution on the client, whic=
h would in turn trigger an outbound network request. This is only possible = with very specific (and unlikely) application-layer code. Note that this do=
es not impact an application if it is using Declarative Mode. It only impac=
ts Framework Mode and Data Mode applications that perform manual SSR/hydrat= ion. This issue has been fixed in version 7.18.0. 2026-07-27 6.1 CVE-2026-5= 3666 [ https://www.cve.org/CVERecord?id=3DCVE-2026-53666 ] remix-run--react= -router React Router is a router for React. In versions 7.11.0 through 7.17= .0, the RSCErrorHandler is missing protocol validation, allowing for redire= cts from untrusted sources. This issue is a follow up to CVE-2026-53667, an=
d only affects consuming applications if they are using the unstable RSC AP= Is. This issue has been fixed in version 7.18.0. 2026-07-27 6.9 CVE-2026-53= 667 [ https://www.cve.org/CVERecord?id=3DCVE-2026-53667 ] remix-run--react-= router React Router is a router for React. In versions 6.30.2 through 6.30.=
4 and 7.9.6 through 7.12.0, applications that allow open redirects are vuln= erable to XSS. An attacker could craft a malicious link that redirects user=
s to an unexpected external site or that exploits an XSS vector.This issue = has been fixed in version 7.13.0. 2026-07-27 6.9 CVE-2026-53668 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-53668 ] Roxnor--FundEngine Subscriber Br= oken Access Control in FundEngine <=3D 1.7.8 versions. 2026-07-27 6.5 CVE-2= 026-59560 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59560 ] rubengc--Ga= miPress Gamification plugin to reward points, achievements, badges & ranks =
in WordPress The GamiPress - Gamification plugin to reward points, achievem= ents, badges & ranks in WordPress plugin for WordPress is vulnerable to Sto= red Cross-Site Scripting via 'heading_size' Shortcode Attribute in all vers= ions up to, and including, 7.9.9.1 due to insufficient input sanitization a=
nd output escaping. This makes it possible for authenticated attackers, wit=
h contributor-level access and above, to inject arbitrary web scripts in pa= ges that will execute whenever a user accesses an injected page. The wp_kse= s_post filter applied at post save does not neutralize this payload because=
only the inert shortcode text is stored in post_content; the dangerous HTM=
L is synthesized at render time by the shortcode handler, entirely bypassin=
g save-time sanitization. 2026-07-28 6.4 CVE-2026-15730 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-15730 ] rubengc--GamiPress Gamification plugin t=
o reward points, achievements, badges & ranks in WordPress The GamiPress - = Gamification plugin to reward points, achievements, badges & ranks in WordP= ress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via = 'heading_size' Shortcode Attribute in 'gamipress_achievement' in all versio=
ns up to, and including, 7.9.9.1 due to insufficient input sanitization and=
output escaping. This makes it possible for authenticated attackers, with = contributor-level access and above, to inject arbitrary web scripts in page=
s that will execute whenever a user accesses an injected page. WordPress sa= ve-time wp_kses_post does not neutralize this payload because the injected = value is stored inside a shortcode attribute rather than as a raw HTML tag,=
and is only emitted into HTML at render time without escaping. 2026-08-01 = 6.4 CVE-2026-16090 [ https://www.cve.org/CVERecord?id=3DCVE-2026-16090 ] ru= bengc--GamiPress Gamification plugin to reward points, achievements, badges=
& ranks in WordPress The GamiPress - Gamification plugin to reward points,=
achievements, badges & ranks in WordPress plugin for WordPress is vulnerab=
le to Stored Cross-Site Scripting via the 'gamipress_rank' Shortcode in all=
versions up to, and including, 7.9.9.1 due to insufficient input sanitizat= ion and output escaping. This makes it possible for authenticated attackers=
, with contributor-level access and above, to inject arbitrary web scripts =
in pages that will execute whenever a user accesses an injected page. 2026-= 08-01 6.4 CVE-2026-16091 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1609=
1 ] s9y--Serendipity Serendipity before 2.6.1 contains an open redirect vul= nerability in exit.php that allows unauthenticated attackers to redirect us= ers to arbitrary external sites by supplying a malicious Base64-encoded url=
parameter when the Track Exits plugin is configured with commentredirectio=
n set to s9y. Attackers can craft trusted-looking URLs leveraging the legit= imate blog domain to conduct phishing, deliver malware, or bypass URL reput= ation filters. 2026-07-31 4.3 CVE-2026-67350 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-67350 ] saadiqbal--Gutena Forms Contact Form, Survey Form, = Feedback Form, Booking Form, and Custom Form Builder The Gutena Forms - Con= tact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builde=
r plugin for WordPress is vulnerable to authorization bypass in all version=
s up to, and including, 1.9.0. This is due to the plugin not properly verif= ying that a user is authorized to perform an action. This makes it possible=
for unauthenticated attackers to modify the read/unread status of or perma= nently trash arbitrary form submission entries belonging to any form. The n= once issued by check_ajax_referer() does not function as an authorization b= arrier because the nonce action 'gutena_Forms' is emitted to unauthenticate=
d visitors via wp_localize_script() on any public page that contains a Gute=
na Forms block, making it freely obtainable by anonymous attackers. 2026-08= -01 5.3 CVE-2026-11995 [ https://www.cve.org/CVERecord?id=3DCVE-2026-11995 =
] SAP_SE--SAP NetWeaver Application Server for ABAP SAP NetWeaver Applicati=
on Server for ABAP and ABAP Platform writes sensitive session identifier in= formation into a diagnostic trace when the trace is activated by a privileg=
ed user. An attacker with access to the resulting trace data could obtain i= dentifiers that allow impersonation of legitimate users during their validi=
ty period.=C2=A0This leads to high impact on confidentiality. Integrity and=
availability are not impacted. 2026-07-28 4.3 CVE-2026-58246 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-58246 ] Sayontan Sinha--Photonic Gallery &=
Lightbox for Flickr, SmugMug & Others Contributor Cross Site Scripting (XS=
S) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <=3D 3.33 ve= rsions. 2026-07-27 6.5 CVE-2026-66434 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-66434 ] sdelements--lets-chat Let's Chat 0.4.0 through 0.4.8 conta= ins a null dereference vulnerability that allows authenticated attackers to=
crash the server by supplying a valid 24-character hex string room paramet=
er that matches no document in the database. Attackers can send a crafted G=
ET /messages request causing an uncaught TypeError in an asynchronous Mongo= ose callback that terminates the Node.js server process, with the same defe=
ct reachable through multiple code paths including the socket.io interface.=
2026-07-28 6.5 CVE-2026-66749 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-66749 ] sdelements--lets-chat Let's Chat 0.3.0 through 0.4.8 contains an = improper authorization vulnerability that allows any authenticated user to = archive any room on the server by sending a DELETE request to the rooms han= dler without ownership verification. Attackers can enumerate room IDs via t=
he rooms listing endpoint and permanently archive private or password-prote= cted rooms they cannot access, with no application-level recovery path requ= iring direct database intervention to restore. 2026-07-28 5.4 CVE-2026-6675=
1 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66751 ] sdelements--lets-ch=
at Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerab= ility that allows authenticated attackers to download file attachments from=
private and password-protected rooms they are not a member of by exploitin=
g missing room membership checks in the file retrieval route. Attackers can=
enumerate adjacent MongoDB ObjectIds derived from a known file ID to recov=
er files uploaded by other users, as the GET /files/:id/:name route in app/= controllers/files.js only enforces login authentication without consulting = room membership or the Room.canJoin check. 2026-07-28 4.3 CVE-2026-66750 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-66750 ] sendpulse--SendPulse Em= ail Marketing Newsletter The SendPulse Email Marketing Newsletter plugin fo=
r WordPress is vulnerable to Stored Cross-Site Scripting via _sp_form_code = Post Meta in all versions up to, and including, 2.2.5 due to insufficient i= nput sanitization and output escaping. This makes it possible for authentic= ated attackers, with contributor-level access and above, to inject arbitrar=
y web scripts in pages that will execute whenever a user accesses an inject=
ed page. Exploitation requires the attacker to create a sendpulse_form post=
containing a benign SendPulse loader script tag alongside arbitrary HTML (= e.g., an img onerror payload), which bypasses the allow-list check and exec= utes in the browser of any user - including administrators - who previews o=
r views a page rendering the [sendpulse-form] shortcode. 2026-08-01 6.4 CVE= -2026-13362 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13362 ] ShapedPlu= gin LLC--Location Weather Contributor Cross Site Scripting (XSS) in Locatio=
n Weather <=3D 3.0.6 versions. 2026-07-27 6.5 CVE-2026-66433 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-66433 ] Shufflehound--Gillion Unauthenticat=
ed Broken Access Control in Gillion <=3D 4.13 versions. 2026-07-27 5.3 CVE-= 2026-66477 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66477 ] softaculou= s--SpeedyCache Cache, Optimization, Performance The SpeedyCache plugin for = WordPress is vulnerable to Arbitrary File Read via Path Traversal in all ve= rsions up to, and including, 1.3.8. This is due to a mismatch between CSS U=
RL validation (which allows query strings like `.css?...`) and path resolut= ion (which strips query strings), combined with no validation that the reso= lved file is actually a CSS file. This makes it possible for authenticated = attackers, with Administrator-level access and above, to read arbitrary fil=
es from the server (including `wp-config.php` and `/etc/passwd`) by injecti=
ng crafted `<link>` tags into page content, with the file contents written =
to publicly accessible cache files. 2026-07-28 4.9 CVE-2026-5114 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-5114 ] Spring--Spring Tools for Eclipse=
Spring Tools for Eclipse stores the Spring Boot DevTools remote secret (sp= ring.devtools.remote.secret) as a plain string attribute on the "Spring Boo=
t DevTools Client" launch configuration. Eclipse persists launch configurat= ion attributes as cleartext XML, either to workspace metadata or, if the us=
er marks the configuration as a shared file, directly into the project tree=
where it can be committed to version control. This secret is the sole cred= ential protecting the DevTools remote restart/reload endpoint, which accept=
s and executes arbitrary class bytes on the target application. Anyone able=
to read the .launch file (via filesystem access, a workspace backup, or a = shared VCS repository) can extract the secret and use it to achieve remote = code execution against the associated Spring Boot application. Affected Spr= ing Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier 2026= -07-30 4.4 CVE-2026-59327 [ https://www.cve.org/CVERecord?id=3DCVE-2026-593=
27 ] Spring--Spring Tools for Eclipse Spring Tools for Eclipse renders Spri=
ng Boot starter wizard dependency tooltips in a native embedded browser (SW=
T Browser) with JavaScript enabled. Using untrusted and compromised Initial= izr endpoints for the Spring Boot starter wizard can result in arbitrary sc= ript execution inside the embedded browser when a developer hovers a depend= ency checkbox in the New Spring Starter Project wizard. Impact is limited t=
o in-IDE UI spoofing and outbound network beaconing rather than full code e= xecution. Affected Spring Products and Versions: Spring Tools for Eclipse: = 5.2.0 and earlier 2026-07-30 4.2 CVE-2026-59328 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-59328 ] stellarwp--Kadence Blocks Page Builder Toolkit f=
or Gutenberg Editor The Kadence Blocks - Page Builder Toolkit for Gutenberg=
Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting v=
ia Identity Block Inner Image Content in all versions up to, and including,=
3.7.8.1 due to insufficient input sanitization and output escaping. This m= akes it possible for authenticated attackers, with contributor-level access=
and above, to inject arbitrary web scripts in pages that will execute when= ever a user accesses an injected page. This vulnerability is only triggerab=
le when the block's urlTransparent attribute is set to a non-empty value, a=
s this is a required precondition for the vulnerable code path in build_htm= l() to be reached. 2026-08-01 6.4 CVE-2026-18062 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-18062 ] stellarwp--Kadence Blocks Page Builder Toolkit = for Gutenberg Editor The Kadence Blocks - Page Builder Toolkit for Gutenber=
g Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting = via 'toggleIcon' Block Attribute in all versions up to, and including, 3.7.=
8 due to insufficient input sanitization and output escaping. This makes it=
possible for authenticated attackers, with contributor-level access and ab= ove, to inject arbitrary web scripts in pages that will execute whenever a = user accesses an injected page. 2026-08-01 6.4 CVE-2026-18435 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-18435 ] stiofansisland--Payment forms, Buy=
now buttons, and Invoicing System | GetPaid The Payment forms, Buy now but= tons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to = Local File Inclusion in all versions up to, and including, 2.8.56 via the g= etpaid_payment_form_element function. This makes it possible for authentica= ted attackers, with administrator-level access and above, to include and ex= ecute arbitrary .php files on the server, allowing the execution of any PHP=
code in those files. This can be used to bypass access controls, obtain se= nsitive data, or achieve code execution in cases where .php file types can =
be uploaded and included. 2026-08-01 6.6 CVE-2026-17605 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-17605 ] strangerstudios--Paid Memberships Pro Co= ntent Restriction, User Registration, & Paid Subscriptions The Paid Members= hips Pro - Content Restriction, User Registration, & Paid Subscriptions plu= gin for WordPress is vulnerable to Stored Cross-Site Scripting via Readonly=
User Field via [pmpro_member_profile_edit] Shortcode in all versions up to=
, and including, 3.8.1 due to insufficient input sanitization and output es= caping. This makes it possible for authenticated attackers, with subscriber= -level access and above, to inject arbitrary web scripts in pages that will=
execute whenever a user accesses an injected page. 2026-07-28 6.4 CVE-2026= -15016 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15016 ] stylemix--Mast= erStudy LMS WordPress Plugin for Online Courses and Education The MasterStu=
dy LMS WordPress Plugin - for Online Courses and Education plugin for WordP= ress is vulnerable to Insecure Direct Object Reference in all versions up t=
o, and including, 3.7.14. This is due to the `stm_lms_delete_cover()` funct= ion lacking ownership validation on the `file_id` parameter before passing =
it to `wp_delete_attachment()`. This makes it possible for authenticated at= tackers, with Instructor-level access and above, to delete arbitrary attach= ments belonging to any user by enumerating sequential attachment IDs. 2026-= 07-29 6.5 CVE-2026-5060 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5060 =
] StylemixThemes--MasterStudy LMS Insufficient Verification of Data Authent= icity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating U= ser State. This issue affects MasterStudy LMS: from n/a through 3.7.39. 202= 6-07-31 5.3 CVE-2026-28145 [ https://www.cve.org/CVERecord?id=3DCVE-2026-28= 145 ] superplanehq--superplane SuperPlane before 0.30.0 contains an SMTP he= ader injection vulnerability that allows unauthenticated attackers to injec=
t arbitrary SMTP headers by including CRLF sequences in the event payload t= itle field delivered via webhook. Attackers can manipulate the unsanitized = title field passed to the SMTP DATA command to add Bcc recipients for conte=
nt exfiltration, forge the From address to bypass SPF and DKIM checks, or i= nject Content-Type and MIME boundary headers to corrupt message bodies for = phishing. 2026-07-28 5.4 CVE-2026-57511 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-57511 ] svarshavchik--Courier IMAP Courier IMAP before 6.0.1 an=
d Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash = the imapd process via deeply nested parenthesized SEARCH queries. The SEARC=
H command parser (alloc_search_key in searchinfo.C) recursively descends on=
nested parenthesized groups through a mutual recursion chain with alloc_se= arch_andlist() and alloc_search_notkey(), with no depth limit. Courier IMAP=
has no overall command line length limit, making exploitation trivial. A s= ingle IMAP command with ~2500 nested parentheses overflows the 8MB default = stack, causing SIGSEGV. 2026-07-29 6.5 CVE-2026-67194 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-67194 ] Syed Balkhi--Easy Digital Downloads Admini= strator Arbitrary File Deletion in Easy Digital Downloads <=3D 3.6.9 versio= ns. 2026-07-27 4.9 CVE-2026-66476 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-66476 ] Sylius--MolliePlugin Sylius Mollie Plugin provides Mollie paym= ent integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, = Sylius Mollie Plugin's GET /{_locale}/thank-you PageRedirectController::tha= nkYouAction and GET /{_locale}/get-code QrCodeAction::fetchQrCodeFromOrder = endpoints look up sequential orderId values without ownership or session ch= ecks, exposing order tokenValue values that can be used with GET /{_locale}= /register-after-checkout/{tokenValue} to view customer first name, last nam=
e, and email. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1. 2026-07-30 6.=
5 CVE-2026-68501 [ https://www.cve.org/CVERecord?id=3DCVE-2026-68501 ] Syst= erel--S2OPC Improper validity period check for root issuer certificate in C= ycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by = this root issuer to be considered trusted 2026-07-29 5.6 CVE-2026-18257 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-18257 ] Tanium--Patch Tanium add= ressed a SQL injection vulnerability in Patch. 2026-07-28 6.3 CVE-2026-1139=
1 [ https://www.cve.org/CVERecord?id=3DCVE-2026-11391 ] taskbuilder--Taskbu= ilder Project Management & Task Management Tool With Kanban Board The Taskb= uilder - Project Management & Task Management Tool With Kanban Board plugin=
for WordPress is vulnerable to SQL Injection via the 'wppm_proj_filter' pa= rameter in versions up to, and including, 5.0.9. This is due to insufficien=
t escaping on the user-supplied parameter and the lack of sufficient prepar= ation on the existing SQL query - the value is re-read at line 144 using on=
ly sanitize_text_field() (overwriting the earlier absint() result), then co= ncatenated into the SQL WHERE clause as an unquoted numeric operand using o= nly esc_sql(), which does not protect against injection in that context, an=
d finally string-interpolated into the $wpdb->prepare() format string, bypa= ssing parameterization entirely. This makes it possible for authenticated a= ttackers, with subscriber-level access and above, to append additional SQL = queries into already existing queries that can be used to extract sensitive=
information from the database. 2026-07-28 6.5 CVE-2026-15267 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-15267 ] Themeisle--Feedzy Contributor Serv=
er Side Request Forgery (SSRF) in Feedzy <=3D 5.2.4 versions. 2026-07-27 4.=
9 CVE-2026-66437 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66437 ] Them= eisle--Orbit Fox by ThemeIsle Author Cross Site Scripting (XSS) in Orbit Fo=
x by ThemeIsle <=3D 3.0.7 versions. 2026-07-27 5.9 CVE-2026-65563 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-65563 ] Themeum--Kirki Editor Arbitrar=
y File Deletion in Kirki <=3D 6.0.13 versions. 2026-07-27 6.8 CVE-2026-6543=
6 [ https://www.cve.org/CVERecord?id=3DCVE-2026-65436 ] themeum--Kirki Free= form Page Builder, Website Builder & Customizer The Kirki - Freeform Page B= uilder, Website Builder & Customizer plugin for WordPress is vulnerable to = Path Traversal (Zip Slip) in all versions up to, and including, 6.0.13 via = the extract_zip_file function. This makes it possible for authenticated att= ackers, with custom-level access and above, to write arbitrary files on the=
server, which can allow for remote code execution. The install_app, update= _app, and get_kirki_template_from_zip code paths accept a user-supplied app=
src value to construct the download URL, and no sanitization is applied to=
prevent a crafted ZIP from being fetched and extracted with path-traversin=
g entry names that escape the intended destination directory. 2026-08-01 4.=
9 CVE-2026-15601 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15601 ] them= eum--Tutor LMS eLearning and online course solution The Tutor LMS - eLearni=
ng and online course solution plugin for WordPress is vulnerable to generic=
SQL Injection via the 'coupon_code' parameter in all versions up to, and i= ncluding, 4.0.1 due to insufficient escaping on the user supplied parameter=
and lack of sufficient preparation on the existing SQL query. This makes i=
t possible for authenticated attackers, with administrator-level access and=
above, to append additional SQL queries into already existing queries that=
can be used to extract sensitive information from the database. 2026-07-28=
4.9 CVE-2026-15444 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15444 ] t= hemewant--RT Mega Menu Mega Menu Builder for Elementor & Gutenberg Subscrib=
er Cross Site Scripting (XSS) in RT Mega Menu - Mega Menu Builder for Eleme= ntor &amp; Gutenberg <=3D 1.5.1 versions. 2026-07-27 6.5 CVE-2026-59559 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-59559 ] themewant--RT Mega Menu = Mega Menu Builder for Elementor & Gutenberg Subscriber Broken Access Contro=
l in RT Mega Menu - Mega Menu Builder for Elementor &amp; Gutenberg <=3D 1.= 5.1 versions. 2026-07-27 6.5 CVE-2026-65433 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-65433 ] THEWP Digital Solutions--News Theme V8 Improper neut= ralization of input during web page generation ('cross-site scripting') vul= nerability in THEWP Digital Solutions News Theme V8 allows Reflected XSS. T= his issue affects News Theme V8: through 16.06.2026. 2026-07-28 6.1 CVE-202= 6-8167 [ https://www.cve.org/CVERecord?id=3DCVE-2026-8167 ] thorsten--phpMy= FAQ phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in = GroupController::updateMembers() that allows administrators with only group= -management permissions to join privileged groups without verification of r= equired rights. Attackers can add themselves to pre-existing groups holding=
user-management rights and immediately inherit those permissions to modify=
or delete user accounts. 2026-07-27 6.5 CVE-2026-66399 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-66399 ] Three Learning--Koollab LMS An authentic= ation bypass vulnerability in Koollab LMS allowed an unauthenticated attack=
er to take over any account, including administrator accounts, by supplying=
a valid user UUID without providing primary credentials via the 2FA valida= tion endpoint. 2026-07-29 6.5 CVE-2026-63238 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-63238 ] Three Learning--Koollab LMS A hard-coded AWS IAM cr= edentials vulnerability in Koollab LMS allowed an attacker to access shared=
multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabli=
ng malicious content injection, job manipulation, or email interception. 20= 26-07-29 5.4 CVE-2026-63239 [ https://www.cve.org/CVERecord?id=3DCVE-2026-6= 3239 ] Three Learning--Koollab LMS A TOTP two-factor authentication bypass = vulnerability in Koollab LMS allowed an attacker to supply a client-control= led seed to generate a matching one-time password and bypass the second aut= hentication factor, potentially enabling unauthorised access to administrat=
or accounts. 2026-07-29 4.8 CVE-2026-63237 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-63237 ] Three Learning--Koollab LMS An information disclosure=
vulnerability in Koollab LMS allowed an authenticated learner to obtain co= rrect quiz answers from the course status endpoint without completing the a= ssessment legitimately, compromising the integrity of assessments. 2026-07-=
29 4.3 CVE-2026-63240 [ https://www.cve.org/CVERecord?id=3DCVE-2026-63240 ]=
Three Learning--Koollab LMS A business logic vulnerability in Koollab LMS = allowed an authenticated learner to set their lesson completion status to c= ompleted via the SCORM commit endpoint without viewing the lesson material,=
compromising training and completion records. 2026-07-29 4.3 CVE-2026-6324=
2 [ https://www.cve.org/CVERecord?id=3DCVE-2026-63242 ] Thrive Themes Coupo= n--Thrive Leads Version Unauthenticated Broken Access Control in Thrive Lea=
ds Version <=3D 10.9.2 versions. 2026-07-27 6.5 CVE-2026-65435 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-65435 ] tigroumeow--Media Cleaner: Clean = your WordPress! The Media Cleaner: Clean your WordPress! plugin for WordPre=
ss is vulnerable to Server-Side Request Forgery in all versions up to, and = including, 7.0.3. This is due to the `get_urls_from_html()` function using = `DOMDocument::loadHTMLFile()` to fetch iframe source URLs with an insuffici= ent hostname validation check that relies on a substring match against the = site's server name. This makes it possible for authenticated attackers, wit=
h Administrator-level access and above, to make web requests to arbitrary l= ocations originating from the web application, which can be used to query a=
nd interact with internal services. 2026-07-28 4.1 CVE-2026-4912 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-4912 ] Tim Strifler--Exclusive Addons E= lementor Unauthenticated Sensitive Data Exposure in Exclusive Addons Elemen= tor <=3D 2.8.0 versions. 2026-07-27 5.3 CVE-2026-66438 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-66438 ] timstrifler--Exclusive Addons for Element=
or The Exclusive Addons for Elementor plugin for WordPress is vulnerable to=
Stored Cross-Site Scripting via the ' exad_infobox_image' parameter in all=
versions up to, and including, 2.7.9.8 due to insufficient input sanitizat= ion and output escaping. This makes it possible for authenticated attackers=
, with Contributor-level access and above, to inject arbitrary web scripts =
in pages that will execute whenever a user accesses an injected page. 2026-= 08-02 6.4 CVE-2026-12231 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1223=
1 ] tiny-http--tiny-http tiny-http through 0.12.0 contains an HTTP request = smuggling vulnerability that allows remote attackers to desynchronize reque=
st framing by sending a Transfer-Encoding header with any value, including = non-chunked codings, which causes the library to unconditionally apply chun= k-decoding and discard Content-Length. Attackers can exploit the discrepanc=
y between tiny_http's improper Transfer-Encoding parsing and a correctly-im= plemented front-end proxy to produce two distinct interpretations of a sing=
le byte stream, enabling request smuggling, and can additionally send non-c= hunked bodies with non-chunked Transfer-Encoding values to cause failed bod=
y reads that tie up connections and consume worker threads without signalin=
g errors to clients. 2026-07-28 5.4 CVE-2026-66752 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-66752 ] tomaka--rouille Rouille 0.4.0 through 3.6.2 c= ontains an HTTP response splitting vulnerability that allows remote attacke=
rs to inject arbitrary response headers by embedding carriage return (0x0D)=
or line feed (0x0A) bytes into attacker-controlled input. Attackers can ex= ploit percent-decoded query parameters reflected into response headers or i= nject bare LF characters into Cookie header values that are interpolated di= rectly into Set-Cookie response headers, enabling cache poisoning, session = fixation, and security header override attacks such as bypassing CSP or COR=
S policies. 2026-07-28 5.4 CVE-2026-66746 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-66746 ] tomaka--rouille Rouille 0.1.6 through 3.6.2 contains a=
reachable assertion vulnerability in the Request::remove_prefix function t= hat allows remote unauthenticated attackers to crash the server by sending =
a crafted percent-encoded URL. Attackers can send a request whose decoded p= ath matches a configured prefix while the raw percent-encoded path does not=
, causing the assert! to fail and triggering either a 500 error or full pro= cess termination depending on the panic configuration. 2026-07-28 5.9 CVE-2= 026-66754 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66754 ] tomaka--rou= ille Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnera= bility that allows remote attackers to desynchronize HTTP message boundarie=
s by exploiting improper header forwarding in the proxy implementation. The=
proxy in src/proxy.rs forwards the client's Transfer-Encoding header to up= stream backends unchanged while transmitting a body already de-chunked by t= iny_http, enabling CL.TE desynchronization attacks where attackers control = where the backend believes the request body ends. 2026-07-28 5.4 CVE-2026-6= 7181 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67181 ] Tychesoftwares--= Abandoned Cart Lite for WooCommerce Shop manager Cross Site Scripting (XSS)=
in Abandoned Cart Lite for WooCommerce <=3D 6.8.0 versions. 2026-07-27 5.9=
CVE-2026-65557 [ https://www.cve.org/CVERecord?id=3DCVE-2026-65557 ] uhop-= -node-re2 re2 provides Node.js bindings for Google's RE2 regular expression=
engine. Prior to 1.25.2, re2's String.prototype.match implementation with =
a global RE2 pattern that can match the empty string fails to advance its n= ative matching cursor in lib/match.cc, causing an infinite loop and unbound=
ed native memory growth that blocks the event loop and can exhaust host mem= ory. This issue is fixed in 1.25.2. 2026-07-30 6.2 CVE-2026-68499 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-68499 ] uhop--node-re2 re2 provides No= de.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2,=
re2 validates lastIndex against the UTF-8 byte length of a subject but use=
s it as a UTF-16 code-unit offset in exec, test, match, replace, and split,=
allowing an attacker-influenced lastIndex on a non-ASCII subject to trigge=
r an out-of-bounds heap read and an uncatchable process crash, with limited=
heap information disclosure in some cases. This issue is fixed in 1.25.2. = 2026-07-30 5.7 CVE-2026-67550 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -67550 ] undici--undici undici's cache interceptor mishandles optional whit= espace placed around the equals sign of a qualified no-cache or private Cac= he-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0=
.0 up to before 8.9.0, the parser either drops the directive or stores a fi= eld name with literal quote characters, so the cache decision fails to reco= gnize the qualification and the response is stored. In shared-cache mode, t= his lets a response containing one user's authenticated data be served from=
cache to a later caller, including an unauthenticated one, when both reque= sts resolve to the same cache key. It affects applications that enable the = cache interceptor in shared mode, forward Authorization headers upstream, a=
nd receive cacheable responses with qualified directives padded with whites= pace around the equals sign. This is the whitespace-around-equals variant t= hat the fix for CVE-2026-9678 did not normalize, and it is fixed in undici = 7.29.0 and 8.9.0. 2026-07-29 5.9 CVE-2026-14643 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-14643 ] undici--undici undici does not validate the type=
property of a duck-typed blob-like request body before using it as the Con= tent-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from = 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an applicatio=
n that passes a hand-rolled blob-like body (via request, stream, pipeline, =
or dispatch) whose type is derived from untrusted input allows an attacker =
to inject CRLF sequences and append arbitrary HTTP headers, potentially smu= ggling a second request past the upstream. Native Blob objects are safe bec= ause their constructor strips CRLF from the type, and fetch is unaffected b= ecause it validates headers, but ecosystem libraries that build duck-typed = blob shapes from user input can reach the vulnerable path. This is the same=
defect class as CVE-2022-35948 and CVE-2026-1527, on a header sink that th=
e earlier fixes did not cover. The issue is fixed in undici 6.28.0, 7.29.0,=
and 8.9.0. 2026-07-29 4.2 CVE-2026-15157 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-15157 ] undici--undici undici's retry interceptor can deliver =
a response whose body length does not match the Content-Length header expos=
ed to the application after a retry or resume of a partial response. In und= ici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to bef= ore 8.9.0, a malicious or faulty upstream can return a partial response wit=
h a mismatched framing header, close the socket early, and have the retry i= nterceptor assemble a body of a different length while the original Content= -Length stays attached. Applications that use the retry interceptor and for= ward upstream headers and bodies downstream, such as proxies or gateways, m=
ay then emit an invalid HTTP response with a stale Content-Length, leading =
to downstream response desynchronization, connection hangs, or response cor= ruption. Exploitation requires the retry interceptor enabled, an upstream r= eturning a mismatched partial response, and a downstream forwarder that doe=
s not remove or recalculate Content-Length. The issue is fixed in undici 6.= 28.0, 7.29.0, and 8.9.0. 2026-07-29 4.8 CVE-2026-16728 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-16728 ] undici--undici undici's setCookie functio=
n does not fully sanitize cookie attributes. In undici before 6.28.0, from = 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain valu=
e is not checked for semicolons and entries in the unparsed array are not s= anitized, so attacker-influenced input can inject additional cookie attribu= tes. For example, a domain value containing a semicolon can append attribut=
es such as SameSite, and an unparsed entry can inject attributes such as Ht= tpOnly, without the caller setting them. Applications that pass user-contro= lled input to these fields, such as multi-tenant or reverse-proxy servers t= hat scope session cookies to a tenant-supplied domain, can have SameSite CS=
RF protections bypassed, or the Secure, HttpOnly, and SameSite attributes f= orced, stripped, or overridden. The issue is fixed in undici 6.28.0, 7.29.0=
, and 8.9.0. 2026-07-29 4.8 CVE-2026-16729 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-16729 ] unitedbyai--droidclaw A weakness has been identified =
in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown=
functionality of the file server/src/routes/goals.ts of the component Unsi= gned Scheduled Callback. This manipulation causes authorization bypass. Rem= ote exploitation of the attack is possible. The attack is considered to hav=
e high complexity. The exploitation is known to be difficult. The exploit h=
as been made available to the public and could be used for attacks. The pro= ject was informed of the problem early through an issue report but has not = responded yet. 2026-07-27 5 CVE-2026-17531 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-17531 ] Vacron--VIN-DS783E-E6 VIN-DS783E-E6 developed by Vacr=
on has an Arbitrary File Read vulnerability, allowing authenticated remote = attackers to exploit Relative Path Traversal to download arbitrary system f= iles. 2026-07-29 6.5 CVE-2026-18192 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-18192 ] Veeam--Service Provider Console Improper handling of the ret= urnUrl parameter in the Forgot Password function of Veeam Service Provider = Console allows an unauthenticated attacker to control the domain of the gen= erated password reset link. When the targeted user clicks the link delivere=
d by email, the reset code is transmitted to an attacker-controlled host, a= llowing the attacker to take over the account. 2026-07-30 5.3 CVE-2026-6463=
5 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64635 ] vendurehq--vendure = Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel au= thorization bypass vulnerability in stock-location.service.ts and asset.ser= vice.ts update methods that allows channel-scoped administrators to modify = other tenants' data. Attackers can supply global IDs of StockLocation or As= set entities from different channels to overwrite inventory locations or ca= talog assets belonging to other tenants without proper channel isolation va= lidation. 2026-07-30 6.8 CVE-2026-67347 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-67347 ] veraPDF--veraPDF-validation veraPDF validation model is=
an implementation of the veraPDF validation model. From 1.25.73 until 1.30=
.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerab= ility in PDFAValidator.validate(...) and GFPDAcroForm.getdynamicRender(), w= here default DocumentBuilderFactory parsing of rich-text annotation or form= -field values and XFA configurations in untrusted PDFs can allow local file=
disclosure and outbound network requests. This issue is fixed in versions = 1.30.2 and 1.31.71. 2026-07-29 6.5 CVE-2026-54082 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-54082 ] Visual Composer--Visual Composer Website Build=
er Contributor Broken Access Control in Visual Composer Website Builder <=
=3D 45.15.0 versions. 2026-07-27 5 CVE-2026-65568 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-65568 ] Watchfire--BC550 The affected=C2=A0Watchfire C= ontroller Software=C2=A0contains self-signed hard-coded RSA private keys an=
d corresponding X.509 certificates used for authenticating and encrypting H= TTPS/TLS connections to the controller's built-in web management interface.=
These keys are embedded in plaintext within the application patch binaries=
in the firmware directly from Watchfire's Remote Support filestore. 2026-0= 7-30 5.7 CVE-2026-5846 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5846 ]=
wazuh--wazuh Wazuh 5.0.0-beta1 (fixed in 5.0.0-beta3) does not validate or=
override the cluster_name and cluster_node fields in inventory-sync Start = FlatBuffer messages, while validating only the agentid against the authenti= cated agent identity. This allows a low-privileged enrolled agent to spoof = cluster attribution in indexed inventory and vulnerability documents by for= ging wazuh.cluster.name values and influencing the document _id prefix, pot= entially tampering with inventory records or, in shared-indexer multi-clust=
er deployments, poisoning another cluster's records when numeric agent IDs = collide. 2026-08-01 6.3 CVE-2026-67307 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-67307 ] wedevs--StoreGrowth Upsell, BOGO, Quick View, Direct Ch= eckout & Side Cart for WooCommerce The Storegrowth Sales Booster plugin for=
WordPress is vulnerable to Missing Authorization in versions up to and inc= luding 2.1.0. This is due to a missing capability check on the bogo_categor= y_msg_create() AJAX handler, which is registered for both authenticated (wp= _ajax_) and unauthenticated (wp_ajax_nopriv_) users and only validates a no= nce ('ajd_protected') that is emitted publicly via wp_localize_script() on = every frontend page through front_scripts() . This makes it possible for un= authenticated attackers to modify the plugin's BOGO category-message config= uration stored in the spsg_bogo_general_settings option by reading the nonc=
e from any public page and POSTing attacker-controlled data to admin-ajax. = 2026-07-28 5.3 CVE-2026-13110 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -13110 ] wedevs--StoreGrowth Upsell, BOGO, Quick View, Direct Checkout & Si=
de Cart for WooCommerce The StoreGrowth: Smart Sales Booster for WooCommerc=
e | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPr= ess is vulnerable to authorization bypass in all versions up to, and includ= ing, 2.1.0. This is due to the plugin not properly verifying that a user is=
authorized to perform an action. This makes it possible for unauthenticate=
d attackers to overwrite the spsg_popup_products option with arbitrary atta= cker-controlled data. The 'ajd_protected' nonce used as the sole gate is ex= posed to unauthenticated visitors on every frontend page through the BoGo m= odule's wp_localize_script call, rendering it ineffective as an authorizati=
on barrier. 2026-07-28 5.3 CVE-2026-15411 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-15411 ] westerndeal--GSheetConnector CF7 Google Sheets Connect=
or The GSheetConnector - CF7 Google Sheets Connector with Real-Time Sync pl= ugin for WordPress is vulnerable to generic SQL Injection via the 's' param= eter in all versions up to, and including, 5.2.1 due to insufficient escapi=
ng on the user supplied parameter and lack of sufficient preparation on the=
existing SQL query. This makes it possible for authenticated attackers, wi=
th administrator-level access and above, to append additional SQL queries i= nto already existing queries that can be used to extract sensitive informat= ion from the database. wp_unslash() strips magic-quote protection and sanit= ize_text_field() does not escape SQL metacharacters, leaving single quotes = and other SQL metacharacters intact before the value is interpolated into t=
he query. 2026-08-01 4.9 CVE-2026-16614 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-16614 ] withastro--astro Astro is a web framework for content-d= riven websites. In versions 1.0.0 through 4.0.18, the source.title and encl= osure.type item fields in packages/astro-rss/src/index.ts are interpolated = directly into XML template strings without XML-character escaping before be= ing parsed by fast-xml-parser. Both fields are validated only as z.string()=
, placing no restriction on XML special characters. An attacker who control=
s these values can inject arbitrary XML into the generated RSS feed: a valu=
e containing " can break out of an attribute (as with enclosure.type), and =
a value containing </source> can close an element early and inject addition=
al nodes (as with source.title). This corrupts feed structure, injects fals=
e metadata (for example, a fake <link> pointing to a malicious URL), and ca=
n cause feed readers to misparse or display attacker-controlled content. In=
SSR mode (output: 'server'), the poisoned feed is served on every request =
to all subscribers. This issue has been fixed in version 4.0.19. 2026-07-27=
4.3 CVE-2026-59728 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59728 ] w= oocommerce--WooCommerce PayPal Payments The WooCommerce PayPal Payments plu= gin for WordPress is vulnerable to Sensitive Information Disclosure due to =
an Insecure Direct Object Reference in all versions up to, and including, 3= .3.2 via the `enqueue_paypal_insights_script_on_order_received()` function = due to missing validation on a user controlled key. This makes it possible = for unauthenticated attackers to obtain sensitive order information includi=
ng order keys, which can then be leveraged to access full customer billing = details (name, email, phone, address) via the WooCommerce Store API within =
a 10-minute grace period after order creation. 2026-08-01 5.3 CVE-2025-1407=
3 [ https://www.cve.org/CVERecord?id=3DCVE-2025-14073 ] WP Chill--Gallery P= hotoBlocks Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <=
=3D 1.3.3 versions. 2026-07-27 6.5 CVE-2026-66448 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-66448 ] wp-lab--WP-Lister Lite for eBay The WP-Lister = Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection v=
ia the 'orderby' parameter in all versions up to, and including, 3.8.8 due =
to insufficient escaping on the user supplied parameter and lack of suffici= ent preparation on the existing SQL query. This makes it possible for authe= nticated attackers, with administrator-level access and above, to append ad= ditional SQL queries into already existing queries that can be used to extr= act sensitive information from the database. 2026-07-29 4.9 CVE-2026-11973 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-11973 ] WPCenter--AffiliateX = Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <=3D 2.3.5=
versions. 2026-07-27 5.4 CVE-2026-65558 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-65558 ] wpclever--WPC Badge Management for WooCommerce The WPC = Badge Management for WooCommerce plugin for WordPress is vulnerable to Stor=
ed Cross-Site Scripting via the 'text' attribute of the `wpcbm_best_seller`=
shortcode in all versions up to, and including, 3.1.6 due to insufficient = input sanitization and output escaping on user supplied attributes. This ma= kes it possible for authenticated attackers, with Contributor-level access = and above, to inject arbitrary web scripts in pages that will execute whene= ver a user accesses an injected page. 2026-07-29 6.4 CVE-2026-7436 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-7436 ] WPDeveloper--BetterDocs Contri= butor Cross Site Scripting (XSS) in BetterDocs <=3D 4.6.2 versions. 2026-07= -27 6.5 CVE-2026-65562 [ https://www.cve.org/CVERecord?id=3DCVE-2026-65562 =
] wpeverest--PDFDraft Drag & Drop PDF Builder, PDF Viewer, Embed & Download=
PDF, Certificate & Invoice Designer The PDFDraft - Drag & Drop PDF Builder=
, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin f=
or WordPress is vulnerable to unauthorized access of data due to a missing = capability check on the serveTemplatePdfAjax() function and the serveTempla= tePdf() REST route (which is registered with `permission_callback =3D> '__r= eturn_true'`) in versions up to, and including, 1.1.0. This makes it possib=
le for unauthenticated attackers to download stored template PDFs - which m=
ay contain customer PII, invoice, order, and certificate data - by requesti=
ng the publicly registered admin-ajax action `pdfdraft_embed_pdf` or the RE=
ST endpoint `/wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf` with a kn= own or guessable design slug, bypassing the plugin's own . 2026-07-28 5.3 C= VE-2026-12124 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12124 ] wplakeo= rg--Advanced Views Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT a=
nd Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver The Advanced=
Views - Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Pro= ducts anywhere in Gutenberg, Elementor, Divi, Beaver plugin for WordPress i=
s vulnerable to Sensitive Information Exposure in all versions up to, and i= ncluding, 3.9.1 via the register_rest_routes. This makes it possible for au= thenticated attackers, with subscriber-level access and above, to extract s= ensitive admin-authored editor content - including template markup, CSS cod=
e, JavaScript code, and PHP controller variables - for any Layout or Post S= election post on the site. 2026-08-01 6.5 CVE-2026-17580 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-17580 ] wplegalpages--WPLP Cookie Consent Cooki=
e Banner & Consent Management for GDPR, CCPA & Google Consent Mode The Cook=
ie Banner for GDPR / CCPA - WPLP Cookie Consent plugin for WordPress is vul= nerable to Cross-Site Request Forgery in all versions up to, and including,=
4.3.7. This is due to missing or incorrect nonce validation on the process= _bulk_action function. This makes it possible for unauthenticated attackers=
to permanently delete or forcibly resolve arbitrary GDPR data request reco= rds stored in the wpl_data_req table via a forged request granted they can = trick a site administrator into performing an action such as clicking on a = link. 2026-07-28 4.3 CVE-2026-15136 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-15136 ] wpmanageninja--Fluent Forms Customizable Contact Forms, Surv= ey, Quiz, & Conversational Form Builder The Fluent Forms - Customizable Con= tact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPres=
s is vulnerable to Reflected Cross-Site Scripting via 'param' in all versio=
ns up to, and including, 6.2.8 due to insufficient input sanitization and o= utput escaping. This makes it possible for unauthenticated attackers to inj= ect arbitrary web scripts in pages that execute if they can successfully tr= ick a user into performing an action such as clicking on a link. 2026-08-01=
6.1 CVE-2026-17571 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17571 ] w= pmanageninja--Fluent Forms Customizable Contact Forms, Survey, Quiz, & Conv= ersational Form Builder The Fluent Forms - Customizable Contact Forms, Surv= ey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable =
to Insecure Direct Object Reference in all versions up to, and including, 6= .2.8 via the 'transaction' parameter due to missing validation on a user co= ntrolled key. This makes it possible for unauthenticated attackers to brute= -force valid transaction hashes and view sensitive payment receipt data inc= luding customer name, email address, billing address, order items, payment = method, and payment status belonging to other users. Because submission ID,=
form ID, and transaction creation time are either observable or guessable =
by an attacker, the effective brute-force space is bounded to approximately=
900 candidates per second per (submission, form) pair, making exploitation=
practical without any prior authentication or account. 2026-07-31 5.3 CVE-= 2026-17567 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17567 ] wpvividplu= gins--WPvivid Backup, Migration & Staging The WPvivid Backup & Migration pl= ugin for WordPress is vulnerable to SQL Injection via the export_data param= eter in versions up to, and including, 0.9.131. This is due to insufficient=
escaping on the user supplied parameter and lack of sufficient preparation=
on the existing SQL query. The values are received in prepare_export_post(=
), passed through sanitize_text_field() and stripslashes(), JSON-decoded, a=
nd the attacker-controlled JSON object keys are collected as $posts_ids wit= hout integer casting. They are stored in the export task options and later = joined with commas and interpolated directly into a `WHERE ID IN (...)` cla= use inside a $wpdb->get_results() call in export_post_to_xml() (unquoted, n= umeric context), with no $wpdb->prepare() or esc_sql(). This makes it possi= ble for authenticated attackers, with Administrator-level access and above,=
to append additional SQL queries into already existing queries that can be=
used to extract sensitive information from the database. 2026-08-01 4.9 CV= E-2026-17555 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17555 ] wpxpo--W= owStore Store Builder & Product Blocks for WooCommerce The WowStore - Store=
Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerabl=
e to Stored Cross-Site Scripting via 'filterMobileText' Block Attribute in = all versions up to, and including, 4.4.24 due to insufficient input sanitiz= ation and output escaping. This makes it possible for authenticated attacke= rs, with contributor-level access and above, to inject arbitrary web script=
s in pages that will execute whenever a user accesses an injected page. The=
save-time wp_kses_post sanitization is ineffective because the payload is = stored inside a Gutenberg block delimiter comment as JSON, which wp_kses_po=
st preserves, allowing an attribute-breakout string to survive to the serve= r-side render_callback. 2026-07-29 6.4 CVE-2026-17161 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-17161 ] wpxpo--WowStore Store Builder & Product Bl= ocks for WooCommerce The WowStore - Store Builder & Product Blocks for WooC= ommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting v=
ia 'currentPostId' Block Attribute in all versions up to, and including, 4.= 4.24 due to insufficient input sanitization and output escaping. This makes=
it possible for authenticated attackers, with contributor-level access and=
above, to inject arbitrary web scripts in pages that will execute whenever=
a user accesses an injected page. 2026-07-29 6.4 CVE-2026-17162 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-17162 ] xdan--jodit Jodit Editor is a W= YSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31=
, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normali=
ze javascript: href values before checking the scheme, allowing case varian= ts, control-byte prefixes, and embedded tabs or newlines to bypass filterin=
g and execute attacker-controlled script when a victim clicks a stored link=
rendered by an application. This issue is fixed in version 4.12.31. 2026-0= 7-31 5.4 CVE-2026-62324 [ https://www.cve.org/CVERecord?id=3DCVE-2026-62324=
] Xlight--Xlight FTP Server Xlight FTP Server before 3.9.5 contains an inf= ormation disclosure vulnerability that allows unauthenticated attackers to = obtain the server's current GetTickCount() value by sending a USER command = with a username ending in the :adm suffix. Attackers can trigger the admin = protocol path within the standard FTP listener pre-authentication to leak t= iming information from the FTP 331 response without requiring a separate po=
rt or configuration change. 2026-07-29 5.3 CVE-2026-67193 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-67193 ] YayCommerce--YayPricing Subscriber Bro= ken Access Control in YayPricing <=3D 3.5.6 versions. 2026-07-27 5.4 CVE-20= 26-66442 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66442 ] yoomoney--Ka= ssa WooCommerce Subscriber Sensitive Data Exposure in =C3=90=C2=AEKassa =C3= =90=C2=B4=C3=90=C2=BB=C3=91=C2=8F WooCommerce <=3D 2.16.1 versions. 2026-07= -27 6.5 CVE-2026-65434 [ https://www.cve.org/CVERecord?id=3DCVE-2026-65434 =
] zephyrproject--zephyr The userspace verifier z_vrfy_log_filter_set() for = the log_filter_set syscall in subsys/logging/log_mgmt.c performed a signed = comparison against the int16_t src_id parameter: src_id < (int16_t)log_src_= cnt_get(domain_id). Any negative value for src_id (e.g. -1) trivially satis= fied this check and was forwarded into z_impl_log_filter_set, where it prop= agated to filter_set() and ultimately to get_dynamic_filter(), which uses s= ource_id as an unsigned index into the linker-section array &TYPE_SECTION_S= TART(log_dynamic)[source_id].filters. After implicit conversion through uin= t32_t, an int16_t -1 becomes 0xFFFFFFFF, indexing log_dynamic far out of bo= unds and causing the kernel to perform an OOB read and an OOB read-modify-w= rite (LOG_FILTER_SLOT_GET/SET) against memory adjacent to the log_dynamic s= ection. The written value is a constrained 3-bit log level slot within the = targeted 32-bit word, but the target address is attacker-chosen (a small ne= gative offset from log_dynamic) and the write occurs in supervisor mode fol= lowing a syscall from an unprivileged user thread, providing a kernel memor= y-corruption / privilege-escalation primitive. The defect is reachable on a=
ny build with CONFIG_USERSPACE=3Dy and CONFIG_LOG_RUNTIME_FILTERING=3Dy. Pr= esent from Zephyr v3.3.0 through v4.4.1. The fix replaces the signed bound = check with an unsigned comparison: (uint32_t)src_id < log_src_cnt_get(domai= n_id), which correctly rejects negative inputs. 2026-07-27 6.6 CVE-2026-106=
82 [ https://www.cve.org/CVERecord?id=3DCVE-2026-10682 ] zephyrproject--zep= hyr Zephyr's Bluetooth host declares a GATT characteristic as two consecuti=
ve attributes: a Characteristic Declaration whose permission is hard-coded =
to BT_GATT_PERM_READ, and a Characteristic Value attribute that carries the=
application-specified security permissions (e.g. BT_GATT_PERM_READ_ENCRYPT=
/ READ_AUTHEN / READ_LESC). The public notify and indicate APIs explicitly=
accept either attribute, and passing the declaration is the documented, co= mmon idiom. Before sending each notification or indication, the host re-che= cks link security with bt_gatt_check_perm() against params->attr in gatt_no= tify(), gatt_indicate(), and gatt_notify_multiple_verify_params() (subsys/b= luetooth/host/gatt.c). When the application passed the Characteristic Decla= ration attribute, the host correctly redirected the value handle but left p= arams->attr pointing at the declaration, so the security check evaluated th=
e declaration's permissions (no security required) instead of the value's. =
As a result the encryption/authentication/LESC requirement configured on th=
e characteristic value was skipped. The Notify-Multiple path additionally u= sed a mask that omitted the LE Secure Connections requirement. A remote pee=
r triggers the disclosure by connecting (optionally without pairing or encr= yption) and writing the Client Characteristic Configuration descriptor to e= nable notifications or indications, causing the server to emit the protecte=
d value over a link that has not reached the required security level. The i= mpact is information disclosure / access-control bypass for characteristic = values the application intended to expose only over a secured link; exposur=
e depends on the application declaring encrypt/authen-required notify/indic= ate characteristics and on the CCC being writable at a lower security tier.=
There is no memory-safety or availability impact. The fix adds bt_gatt_att= r_resolve_value(), which maps a declaration attribute to the following valu=
e attribute before the permission check, and switches the Notify-Multiple p= ath to the full BT_GATT_PERM_READ_ENCRYPT_MASK so the LESC requirement is a= lso enforced. 2026-08-01 6.5 CVE-2026-2411 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-2411 ] zephyrproject--zephyr Zephyr's IPv6 forwarding path re= -sent routed unicast packets without ever decrementing the IPv6 hop limit. = Both routing branches of ipv6_route_packet() (subsys/net/ip) were affected:=
the explicit-route path (net_route_packet()) and the on-link cross-interfa=
ce path (net_route_packet_if()). Each set the packet forwarding flag and ca= lled net_send_data() with the hop limit untouched and no expiry check. Per = RFC 8200 the hop-limit decrement is the mechanism that bounds packet lifeti=
me and terminates routing loops; without it, a device acting as an IPv6 rou= ter relays looping packets indefinitely. An on-path attacker who can induce=
or exploit a transient L3 loop turns it into a permanent forwarding storm,=
causing CPU/bandwidth resource exhaustion (availability DoS) on the forwar= der and adjacent links; path-discovery and loop diagnostics that rely on ho= p-limit expiry are also defeated. Affected configurations. In every affecte=
d release the forwarding path is reached via CONFIG_NET_ROUTE (enabled by d= efault when CONFIG_NET_IPV6_NBR_CACHE is set), together with CONFIG_NET_ROU= TING for cross-interface routing. Note that CONFIG_NET_IPV6_FORWARDING and = CONFIG_NET_IPV4_FORWARDING - which appear in the fix and in this advisory's=
evidence notes - were introduced after v4.4.0, when the routing options we=
re split and renamed; they do not exist in any affected release. When audit= ing a v4.4.1-or-earlier configuration, look for CONFIG_NET_ROUTE and CONFIG= _NET_ROUTING. IPv4 is not affected in any release. The IPv4 forwarding path=
(net_route_ipv4_packet() in route_ipv4.c) was added after v4.4.0 and has n= ever shipped in a release. Its TTL decrement and IPv4 header-checksum recom= putation landed on main as part of the same fix, so the evidence notes belo=
w discuss it, but no released version is reachable by way of IPv4. Affected=
releases are v1.8.0 through v4.4.1: v1.8.0 introduced net_route_packet() a=
nd v2.2.0 added net_route_packet_if(), and neither decremented the hop limi=
t. v4.3.1 carries the explicit-route fix but not the on-link one, so it is = affected as well. Fixed on main by 7d8f1afa7345 (explicit-route path) and 5= 89eadc74efa (on-link path). 2026-07-31 5.8 CVE-2026-10686 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-10686 ] zephyrproject--zephyr The DHCPv4 clien=
t helper net_dhcpv4_msg_type_name() in subsys/net/lib/dhcpv4/dhcpv4.c index=
es a static 8-element const char * name table after a faulty bounds check. = The guard used msg_type <=3D sizeof(name) instead of msg_type <=3D ARRAY_SI= ZE(name); sizeof returns the byte size of the pointer array (32 on 32-bit, =
64 on 64-bit targets) rather than the element count of 8, so message-type v= alues from 9 up to that byte size pass the check and cause name[msg_type - =
1] to read past the end of the array. The msg_type value originates from th=
e DHCP MESSAGE TYPE option, which is read as an unchecked raw byte from a r= eceived packet (net_pkt_read_u8) and passed unmodified into the lookup. A D= HCP server, or any host able to inject a spoofed DHCP reply onto the client=
's link, can therefore drive the index out of bounds. The out-of-range slot=
yields a garbage const char * that is then dereferenced by a %s log conver= sion. The lookup is reached only from a debug log statement (NET_DBG / LOG_= DBG), so the out-of-bounds read is triggerable only when the DHCPv4 log mod= ule is built at DEBUG level (CONFIG_NET_DHCPV4_LOG_LEVEL_DBG), which is not=
the default configuration. When that condition holds, the result is an out= -of-bounds read and a wild-pointer dereference: most likely a crash of the = DHCP client (denial of service) and potentially disclosure of an adjacent p= ointer's contents through the log output. The fix replaces sizeof with ARRA= Y_SIZE, restoring the correct 1..8 acceptance window. 2026-08-01 5.4 CVE-20= 26-10773 [ https://www.cve.org/CVERecord?id=3DCVE-2026-10773 ] ZJONSSON--no= de-unzipper A vulnerability was determined in ZJONSSON node-unzipper up to = 0.12.3. Affected by this vulnerability is the function Extract of the file = lib/extract.js. This manipulation causes path traversal. The attack require=
s local access. The exploit has been publicly disclosed and may be utilized=
. The project was informed of the problem early through an issue report but=
has not responded yet. 2026-07-27 5.3 CVE-2026-17514 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-17514 ]=20

Back to top [ #top ]

Low Vulnerabilities

Primary
Vendor -- Product Description Published CVSS Score Source Info Apache Softw= are Foundation--Apache Traffic Server The Apache Traffic Server multiplexer=
plugin overruns its chunk-decode buffer on upstream input, enabling denial=
of service. This issue affects Apache Traffic Server: from 8.0.0 through 8= .1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are reco= mmended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. 2026-0= 7-29 3.7 CVE-2026-58187 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58187=
] better-auth--better-auth better-auth versions before 1.6.11 fail to dele=
te cached sessions when removing users via admin, anonymous, or SCIM endpoi= nts when secondaryStorage is configured and storeSessionInDatabase is false=
. Attackers can reuse deleted user session tokens to maintain authenticatio=
n for up to seven days after account deletion. 2026-08-01 3.8 CVE-2026-6733=
4 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67334 ] contao--contao Cont=
ao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated=
backend user who can access one job can request an attachment identifier c= ontaining ../ segments and make the job attachment download endpoint read a=
file from another job directory inside var/job-attachments. The controller=
authorizes only the jobUuid route parameter. The later attachment lookup j= oins that authorized job UUID with the attacker-controlled identifier, then=
passes the combined path to the virtual filesystem. VirtualFilesystem::res= olve() canonicalizes the whole path and only rejects paths that escape the = filesystem mount, so authorized-job/../victim-job/debug_log.csv becomes vic= tim-job/debug_log.csv. This is a cross-job authorization bypass for known j=
ob attachment paths. It is not a practical brute-force against unknown jobs=
because job directories are UUID v4 values. 2026-07-31 3.1 CVE-2026-55825 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-55825 ] contao--contao Contao=
is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 throu=
gh 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs = from FeedReaderController::getResponse() to feedIo->read() without scheme o=
r private-address validation, allowing a backend user with module-edit perm= issions to make the server request internal network services, loopback addr= esses, or cloud metadata endpoints. In core-bundle/src/Controller/FrontendM= odule/FeedReaderController.php, the getResponse() function iterates over th=
e configured feed URLs and passes each one directly to the HTTP client (via=
$this->feedIo->read($url, new Feed())) with no validation, while the DCA f= ield definition for rss_feed in tl_module.php carries no URL scheme or host=
validation and the HTTP client is wired as @psr18.http_client (Symfony Htt= pClient) with no SSRF protection configured, since NoPrivateNetworkHttpClie=
nt is not used. This issue is fixed in versions 5.3.48. 2026-07-31 3.1 CVE-= 2026-57232 [ https://www.cve.org/CVERecord?id=3DCVE-2026-57232 ] contao--co= ntao Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5= .7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external host=
s. Contao's crawler tries to prevent confidential HTTP client options from = being sent to external domains by creating a scoped client: full options fo=
r root page origins, cleaned options for everything else. The cleaner remov=
es Cookie and Authorization headers, but it removes the non-Symfony option = names basic_auth and bearer_auth instead of Symfony HttpClient's real auth_= basic and auth_bearer options. When contao.crawl.default_http_client_option=
s contains Basic or Bearer authentication for a protected staging/productio=
n site, those credentials remain in the "clean" client used for external li= nks or configured additional URIs. An attacker who can get an external URL = crawled, for example through a link on a crawled page while the broken-link=
checker is enabled, can receive the crawler credentials. This issue has be=
en fixed in versions 5.3.47 and 5.7.7. 2026-07-31 2.6 CVE-2026-55824 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-55824 ] EShare--ESharePro Successfu=
l exploitation of this vulnerability could allow an attacker with local net= work access to bypass the application's rate-limiting mechanism, enabling b= rute-forcing of the screen-sharing code and potentially displaying harmful = content on the affected screen. 2026-07-28 3.3 CVE-2026-55977 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-55977 ] FreeRDP--FreeRDP FreeRDP before 3.= 29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 ext= ension-unit parser that fails to validate descriptor length before accessin=
g the GUID field. A local attacker with a malicious USB video camera can tr= igger a heap read beyond allocated bounds during camera stream setup, causi=
ng denial of service. 2026-08-01 2.1 CVE-2026-66401 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-66401 ] ggml-org--whisper.cpp A vulnerability has be=
en found in ggml-org whisper.cpp 1.8.4-58. This impacts the function log_me= l_spectrogram of the file src/whisper.cpp. The manipulation leads to out-of= -bounds read. The attack needs to be performed locally. The pull request to=
fix this issue awaits acceptance. 2026-07-27 3.3 CVE-2026-17512 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-17512 ] ggml-org--whisper.cpp A vulnera= bility was found in ggml-org whisper.cpp 95ea8f9b. Affected is the function=
ggml_ftype_to_ggml_type of the file ggml/src/ggml.c. The manipulation of t=
he argument ftype results in reachable assertion. The attack requires a loc=
al approach. The project was informed of the problem early through an issue=
report but has not responded yet. 2026-07-27 3.3 CVE-2026-17513 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-17513 ] GitLab--GitLab GitLab has remed= iated an issue in GitLab CE/EE affecting all versions from 10.6 before 19.0= .5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain condition=
s could have allowed an authenticated user with developer-role permissions =
to commit changes to a project after being removed as a member, due to impr= oper authorization checks on merge request collaboration settings. 2026-07-=
29 3.1 CVE-2025-14562 [ https://www.cve.org/CVERecord?id=3DCVE-2025-14562 ]=
HCL Software--HCL iControl HCL iControl was affected by Information Exposu=
re Through Verbose Client-Side API Error Messages vulnerabilities. It invol= ves application displays raw server/API error messages to users instead of = generic error messages and exposes internal endpoint names, request paramet= ers, error codes, and authentication status 2026-07-31 3.7 CVE-2026-56568 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-56568 ] HCL Software--HCL iCon= trol HCL iControl was affected by Auto complete Enabled vulnerabilities. It=
involves expose sensitive information such as: Valid usernames, Email addr= esses used for login, Account identifiers If the system is accessed from sh= ared environments, attackers may enumerate valid usernames through browser = suggestions. 2026-07-31 3.7 CVE-2026-56570 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-56570 ] HCL Software--HCL iControl HCL iControl was affected =
by Improper Error Handling vulnerabilities. It involves Out of memory, null=
pointer exceptions, system call failure, database unavailable, network tim= eout, and hundreds of other common conditions can cause errors to be genera= ted. 2026-07-31 3.7 CVE-2026-56571 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-56571 ] HCLSoftware--Connections HCL Connections is vulnerable to inf= ormation disclosure which could allow a user to obtain sensitive informatio=
n they are not entitled to, caused by improper handling of request data.the=
y are not entitled to, caused by improper handling of request data. 2026-07= -27 3.5 CVE-2026-56537 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56537 =
] HCLSoftware--Connections An endpoint in HCL Connections is vulnerable to = information disclosure. In certain scenarios this might lead to disclosing = sensitive information to unauthorized users. 2026-07-27 3.5 CVE-2026-56538 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-56538 ] IBM--WebSphere Applic= ation Server - Liberty IBM WebSphere Application Server - Liberty 17.0.0.3 = through 26.0.0.8 is vulnerable to cross-site request forgery which could al= low an attacker to execute malicious and unauthorized actions transmitted f= rom a user that the website trusts. 2026-07-29 3.1 CVE-2026-2482 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-2482 ] koxudaxi--datamodel-code-generat=
or datamodel-code-generator generates Python data models from schema defini= tions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reuse=
s Authorization, Cookie, and Proxy-Authorization headers when following cro= ss-origin redirects while fetching remote schemas, allowing credentials sco= ped to one schema host to be leaked to another redirect target. This issue =
is fixed in version 0.63.0. 2026-07-28 3.7 CVE-2026-55403 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-55403 ] papra-hq--papra Papra is a minimalisti=
c document management and archiving platform. Prior to version 26.5.0, Papr= a's webhook delivery system contains an SSRF protection bypass that allows = any authenticated organisation member to cause the server to make HTTP requ= ests to internal addresses - loopback, link-local, and RFC-1918 ranges. The=
SSRF protection validates the registered webhook URL but ignores redirect = destinations. The HTTP client (ofetch) follows 3xx responses automatically,=
and the redirect target is never checked against the blocklist. An attacke=
r registers a webhook pointing to an attacker-controlled server, which redi= rects incoming POSTs to any internal address. Exploitation was confirmed by=
live test against the official Docker image. The fix is a single-line chan=
ge to the webhook HTTP client. This issue has been patched in version 26.5.=
0. 2026-07-27 3.5 CVE-2026-48051 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-48051 ] Red Hat--Red Hat Build of Keycloak A flaw was found in the keyc= loak-services component of Keycloak, which provides identity and access man= agement services. The issue occurs when a realm administrator uses a wildca=
rd domain (like *.example.com) to restrict which hosts can register or upda=
te clients. Due to improper validation, the system accepts any hostname tha=
t ends with the specified domain suffix, even if it is not a legitimate sub= domain. An attacker who can control the reverse DNS of their connection can=
bypass these host-based restrictions, potentially allowing unauthorized cl= ient modifications. 2026-07-31 3.7 CVE-2026-18206 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-18206 ] Red Hat--Red Hat Build of Keycloak A flaw was = found in the keycloak-services component of Keycloak, which handles OpenID = Connect (OIDC) authentication flows. The issue occurs because the security = check designed to prevent HTTP parameter pollution only inspects the query = portion of a redirect URL and ignores the fragment portion. When a client i=
s configured with a wildcard redirect URI, an attacker can use this to inje=
ct duplicate security parameters into the login response. If a client appli= cation is not configured correctly, it might trust the attacker's injected = data instead of the real security information from Keycloak, leading to ses= sion fixation or account confusion. 2026-07-31 3.4 CVE-2026-18209 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-18209 ] Red Hat--Red Hat Build of Keyc= loak A flaw was found in the SAML protocol implementation of Keycloak, an o= pen-source identity and access management solution. The issue occurs when K= eycloak handles SAML authentication requests using the HTTP-Redirect bindin=
g. If a client is configured with a wildcard redirect URL, an attacker can = craft a request that includes malicious parameters. When a user authenticat= es, Keycloak appends its legitimate response to the attacker's parameters. = This can cause some service providers to process the attacker's data instea=
d of the real login information, potentially leading to a user being logged=
into the wrong account. 2026-07-31 3.4 CVE-2026-18217 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-18217 ] Red Hat--Red Hat Enterprise Linux 10 A fl=
aw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds re=
ad of 4 bytes can occur when parsing FLAC audio stream headers embedded in =
a Matroska or WebM container file. The vulnerability is triggered by a boun= dary check that does not account for the full size of the data being copied=
, allowing a small read past the end of the allocated buffer. An attacker c= ould exploit this by crafting a malicious Matroska or WebM file and trickin=
g a user into opening it, potentially leaking a small amount of adjacent he=
ap memory. 2026-07-28 3.3 CVE-2026-17072 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-17072 ] sigstore--sigstore-go sigstore-go is a Go library for S= igstore signing and verification. Prior to 1.2.1, sigstore-go does not chec=
k a bundle signing timestamp against the validity window of an ExpiringKey = wrapping a self-managed long-lived signing key without a certificate, which=
can allow an attacker holding expired key material to sign accepted bundle=
s. This issue is fixed in version 1.2.1. 2026-07-31 3.1 CVE-2026-54787 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-54787 ] Spring--Spring Tools for = Eclipse The Spring Boot language server logs the raw value of the https_pro= xy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment variable at INFO level whe= never it creates an outbound HTTP client and no explicit http.proxy workspa=
ce setting is configured. Corporate proxy URLs frequently embed Basic-auth = credentials in the form http://user:pass@proxy:8080, and the language serve=
r writes this value to its log file without any redaction. Since language s= erver log files are often attached to bug reports or are readable by other = local users/processes, this can result in disclosure of proxy credentials. = Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and = earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier 2026-07= -30 3.3 CVE-2026-59326 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59326 =
] Three Learning--Koollab LMS An improper access control vulnerability in K= oollab LMS allowed an unauthenticated attacker to forcibly terminate the se= ssion of any user given their email address via the login kickout endpoint,=
resulting in a denial of service. 2026-07-29 3.7 CVE-2026-63235 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-63235 ] Three Learning--Koollab LMS An = improper access control vulnerability in Koollab LMS allowed an unauthentic= ated attacker to read another user's name, internal identifier, scores, les= son status, lesson position, and cached lesson state via the SCORM API endp= oint. 2026-07-29 3.7 CVE-2026-63236 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-63236 ] Three Learning--Koollab LMS An insecure direct object refere= nce vulnerability in Koollab LMS allowed an authenticated user to query the=
course completion progress of any other user without authorisation, disclo= sing private learning progress information. 2026-07-29 3.1 CVE-2026-63241 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-63241 ] Three Learning--Koolla=
b LMS An unrestricted image upload vulnerability in Koollab LMS allowed an = authenticated attacker to upload malicious content disguised as an image fi=
le via the feedback mail registration endpoint, potentially enabling furthe=
r attacks on the server. 2026-07-29 2.6 CVE-2026-63228 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-63228 ] tiny-http--tiny-http tiny-http through 0.= 12.0 contains an HTTP header injection vulnerability that allows attackers =
to inject carriage return (0x0D) and line feed (0x0A) bytes into HTTP heade=
r values on both request and response sides due to insufficient validation =
in header parsing and serialization. Attackers can exploit this injection p= rimitive to perform response splitting, cache poisoning, session fixation v=
ia Set-Cookie injection, security header override, and request smuggling ag= ainst line-feed-tolerant backends. 2026-07-28 3.7 CVE-2026-66753 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-66753 ] TryGhost--Ghost-CLI Ghost CLI b= efore 1.30.1 contains an IP spoofing vulnerability that allows unauthentica= ted remote attackers to bypass rate-limiting controls by manipulating the X= -Forwarded-For header through a misconfigured Nginx configuration. Attacker=
s can append attacker-controlled values to the header chain using the $prox= y_add_x_forwarded_for directive to present an arbitrary IP address, circumv= enting Ghost's rate-limiting mechanisms on self-hosted instances. 2026-07-3=
1 3.7 CVE-2026-25552 [ https://www.cve.org/CVERecord?id=3DCVE-2026-25552 ] = VMware--Cloud Foundation VMware ESX contains an insufficient logging vulner= ability.=C2=A0A malicious administrator could exploit this issue to perform=
certain operations without them being logged. 2026-07-30 2.7 CVE-2026-4170=
9 [ https://www.cve.org/CVERecord?id=3DCVE-2026-41709 ] zephyrproject--zeph=
yr In subsys/debug/coredump/coredump_shell.c, print_coredump_hdr() used the=
16-bit tgt_code field of a stored Zephyr coredump header directly as an in= dex into coredump_target_code2str[], a fixed 7-element array of string poin= ters, with no bounds check. A stored coredump whose tgt_code is >=3D 7 caus=
es an out-of-bounds read of a char* up to ~64K entries past the array; that=
value is passed as the %s argument to shell_print, which dereferences and = walks it as a string. The result is either disclosure of device memory cont= ents to the shell user or a crash when the out-of-bounds pointer is unmappe=
d. The defect is reached via the coredump print shell command (cmd_coredump= _print_stored_dump -> pretty_print_coredump -> parse_and_print_coredump -> = print_coredump_hdr). The tgt_code field is device-generated and in-range du= ring normal crash handling, so triggering requires local shell access plus = the ability to stage or corrupt the stored coredump in the flash/in-memory = backend. Introduced in v4.2.0 (commit 13abd7fe730) and present through v4.4= .0; fixed by clamping out-of-range codes to the 'unknown' (index 0) entry. = 2026-07-29 3 CVE-2026-10684 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1= 0684 ] zephyrproject--zephyr In the Synopsys DesignWare I2C driver (drivers= /i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handle=
r gates the write_requested() callback on dw->state !=3D CMD_SEND, and dw->= state is only reset to READY on a STOP interrupt. The START_DET interrupt, = whose handler in i2c_dw_slave_read_clear_intr_bits() would reset the state =
on every (re)START, was never added to the enabled interrupt mask in i2c_dw= _slave_register(), so that recovery path was dead code. As a result, if the=
STOP interrupt is lost (bus glitch/reset, or a concurrent master driving S= TOP) or the bus master issues a legal WRITE-repeated-START-WRITE sequence w= ith the same direction, the driver remains in CMD_SEND permanently and neve=
r invokes write_requested() again for the life of the target. An I2C master=
on the same physical bus can deliberately trigger this, causing the I2C ta= rget function to malfunction for all subsequent write transactions and desy= nchronizing consumer framing state (e.g. MCTP-over-I2C), a recoverable-by-r= eset denial of service of the target peripheral. The fix unmasks START_DET =
so the state is reset at every bus (re)START. Impact is availability-only o= ver a local board-level bus; no memory corruption results in the in-tree co= nsumer, whose per-byte buffer write is independently bounds-checked. 2026-0= 7-27 2.4 CVE-2026-10683 [ https://www.cve.org/CVERecord?id=3DCVE-2026-10683=
] zephyrproject--zephyr Zephyr's Bluetooth Mesh subnet key management leak=
s one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth= /mesh/subnet.c, net_keys_create() imports the Private Beacon Key into a PSA=
key slot under CONFIG_BT_MESH_PRIV_BEACONS (enabled by default), but subne= t_keys_destroy() guarded the matching psa_destroy_key() with CONFIG_BT_MESH= _V1d1. That Kconfig symbol was removed when explicit Mesh 1.0.1 support was=
dropped, so the destroy branch became permanently dead code and the import=
is never balanced by a destroy. The imbalanced teardown is reached every t= ime subnet keys are destroyed: deleting a subnet (Config Server NetKey Dele= te), completing a Key Refresh Procedure (which retires the old key set), an=
d resetting/re-provisioning the node. The over-the-air triggers are process=
ed only under the node's device key, so they are exercisable by the provisi= oner or network administrator that owns the node, reachable over the Blueto= oth Mesh network. With the default CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT of 16,=
repeated add/delete or key-refresh cycles exhaust the shared PSA key-slot = pool after roughly a dozen rounds. Once exhausted, bt_mesh_private_beacon_k= ey() and thus subnet creation fail: the node can no longer add subnets or c= omplete key refresh, and other PSA crypto consumers on the device may be st= arved, until the device is rebooted. The fix aligns the destroy guard with = the import guard (CONFIG_BT_MESH_PRIV_BEACONS) so each slot is freed. 2026-= 08-02 2.4 CVE-2026-10774 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1077=
4 ] ZTE--Blade A75 5G The Activity zte.com.cn.filer/zte.com.cn.filer.FilePr= eViewActivity within ZTE File Manager is designed to preview compressed fil= es. Third-party applications can launch this Activity and supply arbitrary = file paths (e.g., content://zte.com.cn.filer.fileprovider/root_path), enabl= ing file access with the privilege level of ZTE File Manager. This allows u= nrooted devices to read files under certain system directories such as /dat= a/data and /data/local/tmp. If access restrictions do not block untrusted a= pplications, additional directories may also be accessible. 2026-07-27 1.8 = CVE-2026-40000 [ https://www.cve.org/CVERecord?id=3DCVE-2026-40000 ]=20

Back to top [ #top ]

WPBot

Severity Not Yet Assigned

Primary
Vendor -- Product Description Published CVSS Score Source Info 1Panel-dev--= MaxKB MaxKB is an open-source AI assistant for enterprise. In versions 2.0.=
0 through 2.10.4-lts, UpdateStoreTool.update_tool passes caller-supplied do= wnload_url and download_callback_url values to requests.get without equival= ent trusted-host and redirect validation, allowing an authenticated workspa=
ce user to make the server request internal, loopback, link-local, or cloud=
metadata URLs. A fix is present on the v2 branch but has not yet been incl= uded in a published release. 2026-07-30 not yet calculated CVE-2026-64870 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-64870 ] 7-Zip--7-Zip 7-Zip XZ = Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerabilit=
y. This vulnerability allows remote attackers to execute arbitrary code on = affected installations of 7-Zip. User interaction is required to exploit th=
is vulnerability in that the target must visit a malicious page or open a m= alicious file. The specific flaw exists within the processing of XZ chunked=
data. Crafted XZ-compressed data can trigger an overflow of a heap-based b= uffer. An attacker can leverage this vulnerability to execute code in the c= ontext of the current process. Was ZDI-CAN-30169. 2026-07-29 not yet calcul= ated CVE-2026-14266 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14266 ] A= cademy LMS--Academy LMS The Academy LMS WordPress plugin through 3.8.2 does=
not restrict access to quiz attempt records to their owner, allowing any a= uthenticated user with subscriber-level access and above (enrolled in any s= ingle course) to read every user's quiz attempts across the whole site, inc= luding personal data such as IP addresses, names, registration dates and qu=
iz results. 2026-07-31 not yet calculated CVE-2026-12376 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-12376 ] activepieces--activepieces Activepieces=
is an open source AI workflow automation platform. Prior to 0.84.0, an uns= anitized path segment in the Code piece sandbox can let an authenticated fl=
ow author reach read-write cached flow and code files belonging to other te= nants on the same worker, exposing embedded data and allowing modified code=
to execute on a victim tenant's next flow run. This issue is fixed in vers= ion 0.84.0. 2026-07-30 not yet calculated CVE-2026-48499 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-48499 ] AcyMailing--AcyMailing ## Summary 2026-= 08-02 not yet calculated CVE-2026-14920 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-14920 ] Admin Columns for ACF Fields--Admin Columns for ACF Fie= lds The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does no=
t escape Advanced Custom Fields values before outputting them in the WordPr= ess admin list-table columns, allowing users with contributor-level access =
or above to store a payload that executes as JavaScript in the session of h= igher-privileged users who view the affected post-list screen. 2026-08-01 n=
ot yet calculated CVE-2026-15262 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-15262 ] Advanced Ads--Advanced Ads The Advanced Ads WordPress plugin be= fore 2.0.23 does not sanitize and escape a shortcode parameter before outpu= tting it in the page, allowing users with the Contributor role and above to=
inject arbitrary web scripts that execute when the affected content is vie= wed, including by higher-privileged users. 2026-07-27 not yet calculated CV= E-2026-10082 [ https://www.cve.org/CVERecord?id=3DCVE-2026-10082 ] AI ChatB=
ot for WooCommerce--AI ChatBot for WooCommerce The AI ChatBot for WooCommer=
ce WordPress plugin before 4.8.4 does not perform any authorization or nonc=
e check on one of its AJAX actions, allowing unauthenticated users to abuse=
the site owner's stored third-party API key to send requests billed to the=
owner's account and, when an optional feature is enabled, to retrieve inde= xed knowledge-base content. 2026-08-02 not yet calculated CVE-2026-15241 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-15241 ] aimy-extensions.com--Ai=
my Captcha-Less Form Guard plugin for Joomla Joomla Extension - aimy-extens= ions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.=
0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby = remote code execution. 2026-07-29 not yet calculated CVE-2026-65883 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-65883 ] aio-libs--aiohttp AIOHTTP is=
an asynchronous HTTP client/server framework for asyncio and Python. Prior=
to 3.14.2, the WebSocket client accepts and decompresses frames with the R= SV1 bit set even when the permessage-deflate extension was not negotiated, = allowing a malicious server to cause unexpected CPU and memory consumption.=
This issue is fixed in version 3.14.2. 2026-07-30 not yet calculated CVE-2= 026-59881 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59881 ] allinurl--g= oaccess GoAccess is a real-time web log analyzer and interactive viewer tha=
t runs in a terminal in *nix systems or through the browser. In version 1.1= 0.2, parse_browser assumes the matched browser token begins with Opera and = moves a trailing version substring to match plus five, allowing a crafted U= ser-Agent in a processed access log to write one to four attacker-influence=
d bytes beyond the heap allocation and corrupt or crash GoAccess. This issu=
e is fixed in version 1.11. 2026-07-30 not yet calculated CVE-2026-54715 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-54715 ] allinurl--goaccess GoAc= cess is a real-time web log analyzer and interactive viewer that runs in a = terminal in *nix systems or through the browser. Prior to version 1.11, the=
built-in WebSocket server narrows a 64-bit extended frame length into the = signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame s= ize, allowing an unauthenticated remote client to bypass the guard and forc=
e an approximately 18-exabyte allocation request that terminates the proces=
s. This issue is fixed in version 1.11. 2026-07-30 not yet calculated CVE-2= 026-55768 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55768 ] allinurl--g= oaccess GoAccess is a real-time web log analyzer and interactive viewer tha=
t runs in a terminal in *nix systems or through the browser. Prior to 1.11,=
the parse_ios() function uses an attacker-controlled keyword-to-OS offset =
as both the source offset and copy length for memmove, allowing a crafted U= ser-Agent in a processed access log to read up to approximately 4 KB beyond=
the heap allocation and conditionally crash GoAccess. This issue is fixed =
in version 1.11. 2026-07-30 not yet calculated CVE-2026-55777 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-55777 ] Animation Addons for Elementor--An= imation Addons for Elementor The Animation Addons for Elementor WordPress p= lugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds=
to the list of allowed upload types, allowing users with the upload_files = capability (Author and above) to upload files containing malicious JavaScri= pt, leading to Stored Cross-Site Scripting. 2026-07-30 not yet calculated C= VE-2026-13330 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13330 ] Apache = Software Foundation--Apache ActiveMQ AMQP Improper Input Validation vulnera= bility in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A rem= ote unauthenticated peer that can reach an exposed AMQP NIO connector can t= rigger denial-of-service behavior by sending a frame size value. This cause=
the NIO threads to die and if done rapidly enough can lead to exhaustion o=
f the NIO thread pool denying service to other connections. This issue affe= cts Apache ActiveMQ AMQP: before 5.19.9, from 6.0.0 before 6.2.8; Apache Ac= tiveMQ: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ All: before=
5.19.9, from 6.0.0 before 6.2.8. Users are recommended to upgrade to versi=
on 5.19.9, 6.2.8, or 6.3.0 which fixes the issue. 2026-07-28 not yet calcul= ated CVE-2026-59878 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59878 ] A= pache Software Foundation--Apache ActiveMQ Broker Improper Authorization vu= lnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ=
. An authenticated low-privilege user can bypass a per-destination write AC=
L by sending to an ActiveMQ temporary composite destination whose physical = name is a comma-separated composite of real queues.=C2=A0This allows publis= hing messages to any of the destinations in the list without proper write A=
CL permissions because the authorization check is bypassed due to the compo= site destination being marked as temporary. This issue affects Apache Activ= eMQ Broker: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ All: be= fore 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ: before 5.19.9, from = 6.0.0 before 6.2.8. Users are recommended to upgrade to version 5.19.9, 6.2=
.8 or 6.3.0, which fixes the issue. 2026-07-28 not yet calculated CVE-2026-= 61487 [ https://www.cve.org/CVERecord?id=3DCVE-2026-61487 ] Apache Software=
Foundation--Apache Airflow FAB provider The FAB auth manager's Azure AD OA= uth login defaulted `verify_signature=3DFalse` when decoding the ID token, =
so an attacker able to present a forged or unsigned (`alg:none`) ID token t=
o the OAuth callback could bypass authentication and log in as an arbitrary=
user, including one holding the Admin role (CWE-347). Deployments running = the FAB auth manager with the Azure AD OAuth login path under its default c= onfiguration are affected; the Authentik path already defaulted to `True`. = This issue affects `apache-airflow-providers-fab` before 3.7.3. Users are a= dvised to upgrade to `apache-airflow-providers-fab` 3.7.3, which defaults `= verify_signature=3DTrue`. 2026-07-29 not yet calculated CVE-2026-59243 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-59243 ] Apache Software Foundatio= n--Apache Atlas Description: Missing Authorization=C2=A0in Apache Atlas. A = missing authorization vulnerability in Apache Atlas's admin endpoints allow=
s any authenticated user, regardless of their assigned role, to perform adm= inistrative operations. Affect Version: This issue affects Apache Atlas: fr=
om 0.8 through 2.5.0. Mitigation: Users are recommended to upgrade to versi=
on 2.6.0, which fixes the issue. 2026-07-29 not yet calculated CVE-2026-506=
22 [ https://www.cve.org/CVERecord?id=3DCVE-2026-50622 ] Apache Software Fo= undation--Apache Axis2/Java Deserialization of Untrusted Data (CWE-502) in = the Tribes-based clustering component =C2=A0in Apache Software Foundation A= pache Axis2/Java through 2.0.0 on Apache Tomcat =C2=A0(only when Tribes clu= stering is enabled, which is off by default) allows an =C2=A0unauthenticate=
d remote attacker with network access to the clustering port to =C2=A0execu=
te arbitrary code via a crafted serialized Java object delivered to the clu= ster =C2=A0channel and deserialized in =C2=A0org.apache.axis2.clustering.tr= ibes.Axis2ChannelListener#messageReceived. Users are =C2=A0recommended to u= pgrade to version 2.0.1, which fixes this issue by removing the =C2=A0clust= ering feature entirely. 2026-07-28 not yet calculated CVE-2026-66713 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-66713 ] Apache Software Foundation-= -Apache HttpComponents Client HttpClient based on the classic i/o model fai=
ls to correctly release the underlying connection back to the connection ma= nager if it encounters an invalid or unsupported `Content-Encoding` header = value in the response message.=C2=A0Please note this defect does not affect=
HttpClient based on the async i/o model. This issue affects Apache HttpCom= ponents Client: from 5.0-alpha1 through 5.6.2. 2026-07-31 not yet calculate=
d CVE-2026-64607 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64607 ] Apac=
he Software Foundation--Apache JSPWiki Debug Messages Revealing Unnecessary=
Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgra=
de to version 2.12.4, which fixes this issue. 2026-07-30 not yet calculated=
CVE-2026-28811 [ https://www.cve.org/CVERecord?id=3DCVE-2026-28811 ] Apach=
e Software Foundation--Apache JSPWiki UserManager lack of checks allows imp= ersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to esca= late privileges. Users are recommended to upgrade to version 2.12.4 or newe=
r which fixes this issue. 2026-07-30 not yet calculated CVE-2026-28812 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-28812 ] Apache Software Foundatio= n--Apache JSPWiki Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijac= king, which leads to csrf vulnerabilities. Users are recommended to upgrade=
to version 2.12.4, which fixes this issue. 2026-07-30 not yet calculated C= VE-2026-28813 [ https://www.cve.org/CVERecord?id=3DCVE-2026-28813 ] Apache = Software Foundation--Apache JSPWiki Arbitrary Wiki Markup rendering due to = lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to ob= tain sensitive data stored in JSPWiki variables. Users are recommended to u= pgrade to version 2.12.4 or 3.0.0, which fixes this issue. 2026-07-30 not y=
et calculated CVE-2026-28814 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 28814 ] Apache Software Foundation--Apache JSPWiki A carefully crafted edit= ing request could trigger an XSS vulnerability on Apache JSPWiki when parsi=
ng errors on the markdown renderer, which could allow the attacker to execu=
te javascript in the victim's browser and get some sensitive information ab= out the victim. This issue affects Apache JSPWiki: through 2.12.3. Users ar=
e recommended to upgrade to version 2.12.4, which fixes the issue. 2026-07-=
30 not yet calculated CVE-2026-48910 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-48910 ] Apache Software Foundation--Apache Kyuubi Kyuubi Engine UI = proxy accepts a host and port from the request path and proxies HTTP reques=
ts to that destination.=C2=A0A remote requester with network access to the = proxy can cause the Kyuubi server to send HTTP requests to arbitrary reacha= ble hosts, resulting in SSRF or open-proxy behavior. This issue affects Apa= che Kyuubi: from 1.8.0 before 1.12.0. Users are recommended to upgrade to v= ersion 1.12.0, which disables the proxy by default.=C2=A0To restore proxied=
Engine UI, set kyuubi.frontend.rest.engine.ui.proxy.enabled=3Dtrue and con= figure allowed target hosts with kyuubi.frontend.rest.engine.ui.proxy.hosts=
. 2026-07-29 not yet calculated CVE-2026-23904 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-23904 ] Apache Software Foundation--Apache Kyuubi Apache = Kyuubi REST batch multipart upload handling uses the client-supplied multip= art filename when creating a temporary uploaded resource. A remote attacker=
who can access the REST batch upload endpoint can provide path traversal s= equences in the filename and cause the Kyuubi server process to write contr= olled content outside the intended upload directory, subject to filesystem = permissions. This issue affects Apache Kyuubi: from 1.7.0 through 1.11.1. U= sers are recommended to upgrade to version 1.12.0, which fixes the issue. 2= 026-07-30 not yet calculated CVE-2026-52680 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-52680 ] Apache Software Foundation--Apache Kyuubi The securi=
ty fix for CVE-2025-66518 is incomplete.=C2=A0Any client who can access to = Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side c= onfig=C2=A0kyuubi.session.local.dir.allowlist via unprefixed Spark config a= liases. This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0. Users a=
re recommended to upgrade to version 1.12.0, which fixes the issue. 2026-07= -31 not yet calculated CVE-2026-62391 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-62391 ] Apache Software Foundation--Apache Superset An Improper Au= thorization vulnerability exists in Apache Superset allowing an authenticat=
ed user with permissions to update charts to modify dashboards they do not = own. When updating a chart's properties via the REST API, a user can provid=
e a list of dashboard IDs (dashboards) to associate the chart with. The val= idation logic in the UpdateChartCommand failed to verify that the user had = write permissions for the target dashboards specified in the request body. = This issue affects Apache Superset: before 6.0.0. Users are recommended to = upgrade to version 6.0.0, which fixes the issue. 2026-07-30 not yet calcula= ted CVE-2026-23981 [ https://www.cve.org/CVERecord?id=3DCVE-2026-23981 ] Ap= ache Software Foundation--Apache Superset A Regular Expression Denial of Se= rvice (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 throug=
h 5.0.0. The vulnerability is located in the sql_parse.py component, specif= ically within the SQL_REGEX used for parsing SQL statements in the sqlparse=
library integration. The affected regular expression contains overlapping = disjunctions that share a common outer quantifier. An authenticated attacke=
r can exploit this by sending a maliciously crafted input string (specifica= lly a long sequence of backslashes or similar characters) to endpoints that=
process SQL queries This issue affects Apache Superset: before 6.0.0. User=
s are recommended to upgrade to version 6.0.0, which fixes the issue.=C2=A0=
Workarounds: =C3=A2=E2=80=94=C2=8F WAF Rules: Implement Web Application Fi= rewall (WAF) rules to detect and block requests containing excessively long=
sequences of backslashes or suspicious repeated patterns in the queries.ex= tras.where parameter. =C3=A2=E2=80=94=C2=8F Rate Limiting: Ensure strict ra=
te limiting is applied to the /api/v1/chart/data endpoint to reduce the imp= act of potential attacks. 2026-07-30 not yet calculated CVE-2026-23985 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-23985 ] Apache Software Foundatio= n--Apache Thrift Improper Handling of Highly Compressed Data (Data Amplific= ation) vulnerability in Apache Thrift Python bindings. This issue affects A= pache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.= 24.0, which fixes the issue. 2026-07-27 not yet calculated CVE-2026-41608 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-41608 ] Apache Software Founda= tion--Apache Thrift Loop with Unreachable Exit Condition ('Infinite Loop') = vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue=
affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to = version 0.24.0, which fixes the issue. 2026-07-27 not yet calculated CVE-20= 26-43871 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43871 ] Apache Softw= are Foundation--Apache Thrift Allocation of Resources Without Limits or Thr= ottling vulnerability in Apache Thrift Java bindings. This issue affects Ap= ache Thrift: from 0.19.0 before 0.24.0. Users are recommended to upgrade to=
version 0.24.0, which fixes the issue. 2026-07-27 not yet calculated CVE-2= 026-45112 [ https://www.cve.org/CVERecord?id=3DCVE-2026-45112 ] Apache Soft= ware Foundation--Apache Thrift Improper Validation of Certificate with Host=
Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affect=
s Apache Thrift: before 0.24.0. Users are recommended to upgrade to version=
0.24.0, which fixes the issue. 2026-07-27 not yet calculated CVE-2026-4814=
4 [ https://www.cve.org/CVERecord?id=3DCVE-2026-48144 ] Apache Software Fou= ndation--Apache Thrift Improper Validation of Certificate with Host Mismatc=
h vulnerability in Apache Thrift C++ bindings. This issue affects Apache Th= rift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, wh= ich fixes the issue. 2026-07-27 not yet calculated CVE-2026-48145 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-48145 ] Apache Software Foundation--Ap= ache Thrift Improper Handling of Highly Compressed Data (Data Amplification=
) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings.=
This issue affects Apache Thrift: before 0.24.0. Users are recommended to = upgrade to version 0.24.0, which fixes the issue. 2026-07-27 not yet calcul= ated CVE-2026-48586 [ https://www.cve.org/CVERecord?id=3DCVE-2026-48586 ] A= pache Software Foundation--Apache Thrift Inefficient Algorithmic Complexity=
, Allocation of Resources Without Limits or Throttling vulnerability in Apa= che Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.=
0. Users are recommended to upgrade to version 0.24.0, which fixes the issu=
e. 2026-07-27 not yet calculated CVE-2026-55968 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-55968 ] Apache Software Foundation--Apache Thrift Intege=
r Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, ne= tstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.= 24.0. Users are recommended to upgrade to version 0.24.0, which fixes the i= ssue. 2026-07-27 not yet calculated CVE-2026-55969 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-55969 ] Apache Software Foundation--Apache Thrift Buf= fer Over-read vulnerability in Apache Thrift C++ bindings. This issue affec=
ts Apache Thrift: before 0.24.0. Users are recommended to upgrade to versio=
n 0.24.0, which fixes the issue. 2026-07-27 not yet calculated CVE-2026-559=
70 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55970 ] Apache Software Fo= undation--Apache Thrift Heap-based Buffer Overflow vulnerability in Apache = Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users=
are recommended to upgrade to version 0.24.0, which fixes the issue. 2026-= 07-27 not yet calculated CVE-2026-55971 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-55971 ] Apache Software Foundation--Apache Thrift Out-of-bounds=
Read vulnerability in Apache Thrift c_glib bindings. This issue affects Ap= ache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.2= 4.0, which fixes the issue. 2026-07-27 not yet calculated CVE-2026-58023 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-58023 ] Apache Software Foundat= ion--Apache Thrift Allocation of Resources Without Limits or Throttling vul= nerability in Apache Thrift Rust bindings. This issue affects Apache Thrift=
: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which = fixes the issue. 2026-07-27 not yet calculated CVE-2026-58389 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-58389 ] Apache Software Foundation--Apache=
Thrift Improper Validation of Specified Quantity in Input, Out-of-bounds R= ead vulnerability in Apache Thrift C++ bindings. This issue affects Apache = Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, = which fixes the issue. 2026-07-27 not yet calculated CVE-2026-58662 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-58662 ] Apache Software Foundation--= Apache Tika Relative Path Traversal in the ISA-Tab parser in Apache Softwar=
e Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows =
an attacker who can place files in a directory that the application subsequ= ently parses to read arbitrary files accessible to the Tika process and hav=
e their contents emitted into the extracted text output, via a "Study Assay=
File Name" value in the ISA-Tab investigation file that traverses outside = the dataset directory. Users are recommended to upgrade to version 3.3.2 or=
4.0.0-beta-1, which fixes this issue. 2026-07-30 not yet calculated CVE-20= 26-66755 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66755 ] Apache Softw= are Foundation--Apache Tika Improper Protection of Alternate Path vulnerabi= lity in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 bef= ore 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1,=
which fixes the issue. 2026-07-30 not yet calculated CVE-2026-66756 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-66756 ] Apache Software Foundation-= -Apache Tomcat Uncontrolled Resource Consumption vulnerability in Apache To= mcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.= 0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.= 0.120. Users who have followed the security guidance to remove the examples=
web application are not affected by this issue. Users are recommended to r= emove the examples web application or to upgrade to version 11.0.25, 10.1.5=
8 or 9.0.121 (when released), which fix the issue. 2026-07-28 not yet calcu= lated CVE-2026-66299 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66299 ] = Apache Software Foundation--Apache Wicket Improper Neutralization of Input = During Web Page Generation ('Cross-site Scripting') vulnerability in Apache=
Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from = 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0,=
which fixes the issue. 2026-07-27 not yet calculated CVE-2026-66390 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-66390 ] Apache Software Foundation-= -Apache Wicket Use of Insufficiently Random Values, Protection Mechanism Fa= ilure vulnerability in Apache Wicket. This issue affects Apache Wicket: fro=
m 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended t=
o upgrade to version 10.10.0, which fixes the issue. 2026-07-27 not yet cal= culated CVE-2026-66391 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66391 =
] Apache Software Foundation--Apache Zeppelin Cross-Site Request Forgery (C= SRF) vulnerability in Apache Zeppelin. The default CORS configuration allow=
ed cross-origin state-changing requests and accepted text/plain request bod= ies, allowing an attacker who lures an authenticated user to a =C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0malicious site to perform actions on the user's behalf=
through REST and WebSocket endpoints. This issue affects Apache Zeppelin v= ersions 0.6.0 through 0.12.0. Users are recommended to upgrade to version 0= .12.1, which fixes this issue. 2026-07-30 not yet calculated CVE-2026-44613=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-44613 ] Apache Software Foun= dation--Apache Zeppelin Path traversal vulnerability in Apache Zeppelin. Wh=
en FileSystemNotebookRepo is configured, an authenticated attacker with per= mission to rename a note, or access to folder operations, could supply trav= ersal segments in note or folder paths. =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= Zeppelin composed these values into filesystem paths using the server's fil= esystem or Hadoop identity without ensuring that the result remained under = the configured notebook directory. This could allow notebook files or direc= tories to be moved, =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0written, or deleted o= utside the notebook root. This issue affects Apache Zeppelin versions 0.9.0=
through 0.12.0. Users are recommended to upgrade to version 0.12.1, which = fixes this issue. 2026-07-31 not yet calculated CVE-2026-44615 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-44615 ] Apache Software Foundation--Apach=
e Zeppelin LDAP injection vulnerability in Apache Zeppelin. ActiveDirectory= GroupRealm constructed LDAP search filters without escaping user-controlled=
input, allowing an authenticated attacker to inject LDAP filter syntax thr= ough the user-search endpoint =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0and potentia= lly expose directory information. The role-lookup path was also affected af= ter successful LDAP authentication. This issue affects Apache Zeppelin vers= ions 0.6.0 through 0.12.0. Users are recommended to upgrade to version 0.12= .1, which =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0fixes this issue. 2026-07-30 n=
ot yet calculated CVE-2026-44616 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-44616 ] Apache Software Foundation--Apache Zeppelin LDAP filter injecti=
on vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-= name escaping when constructing LDAP search filters instead of RFC 4515 fil= ter escaping, leaving special filter characters insufficiently escaped. =C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0This is an incomplete fix of CVE-2024-31867. = This issue affects Apache Zeppelin versions 0.11.1, 0.11.2, and 0.12.0. Use=
rs are recommended to upgrade to version 0.12.1, which fixes this issue. 20= 26-07-30 not yet calculated CVE-2026-44617 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-44617 ] Apple--iOS and iPadOS A use after free issue was addr= essed with improved memory management. This issue is fixed in iOS 26.6 and = iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6. An app may be able =
to cause unexpected system termination. 2026-07-27 not yet calculated CVE-2= 026-28928 [ https://www.cve.org/CVERecord?id=3DCVE-2026-28928 ] Apple--iOS = and iPadOS A buffer overflow was addressed with improved bounds checking. T= his issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6=
, watchOS 26.6. Connecting to a malicious NFS server may lead to kernel mem= ory corruption. 2026-07-27 not yet calculated CVE-2026-28931 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-28931 ] Apple--iOS and iPadOS An integer ov= erflow was addressed with improved input validation. This issue is fixed in=
iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS=
Tahoe 26.6, watchOS 26.6. A malicious app may be able to break out of its = sandbox. 2026-07-27 not yet calculated CVE-2026-28973 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-28973 ] Apple--iOS and iPadOS The issue was addres= sed with improved memory handling. This issue is fixed in iOS 26.6 and iPad=
OS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS = 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted audio f= ile may corrupt process memory. 2026-07-27 not yet calculated CVE-2026-4367=
3 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43673 ] Apple--iOS and iPad=
OS A memory corruption issue was addressed with improved memory handling. T= his issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS=
Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. P= rocessing a maliciously crafted video file may lead to unexpected app termi= nation. 2026-07-27 not yet calculated CVE-2026-43711 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-43711 ] Apple--iOS and iPadOS The issue was address=
ed with improved input sanitization. This issue is fixed in iOS 26.6 and iP= adOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, vis= ionOS 26.6, watchOS 26.6. A malicious app may be able to access protected u= ser data. 2026-07-27 not yet calculated CVE-2026-43714 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-43714 ] Apple--iOS and iPadOS A path handling iss=
ue was addressed with improved validation. This issue is fixed in iOS 26.6 = and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.=
6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to gain root = privileges. 2026-07-27 not yet calculated CVE-2026-43723 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-43723 ] Apple--iOS and iPadOS The issue was add= ressed with improved memory handling. This issue is fixed in iOS 26.6 and i= PadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.=
6. Processing a maliciously crafted image may corrupt process memory. 2026-= 07-27 not yet calculated CVE-2026-43729 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-43729 ] Apple--iOS and iPadOS A permissions issue was addressed=
with additional restrictions. This issue is fixed in iOS 26.6 and iPadOS 2= 6.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may b=
e able to fingerprint the user. 2026-07-27 not yet calculated CVE-2026-4373=
0 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43730 ] Apple--iOS and iPad=
OS The issue was addressed with improved memory handling. This issue is fix=
ed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6. Pro= cessing a maliciously crafted image may corrupt process memory. 2026-07-27 = not yet calculated CVE-2026-43733 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-43733 ] Apple--iOS and iPadOS An out-of-bounds write issue was address=
ed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadO=
S 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app ma=
y be able to cause unexpected system termination. 2026-07-27 not yet calcul= ated CVE-2026-43739 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43739 ] A= pple--iOS and iPadOS An out-of-bounds write issue was addressed with improv=
ed bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS = Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS = 26.6, watchOS 26.6. Processing an audio stream in a maliciously crafted med=
ia file may terminate the process. 2026-07-27 not yet calculated CVE-2026-4= 3744 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43744 ] Apple--iOS and i= PadOS An out-of-bounds read was addressed with improved bounds checking. Th=
is issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS = Sonoma 14.8.8, macOS Tahoe 26.6. An attacker with physical access to a lock=
ed device may be able to view sensitive user information. 2026-07-27 not ye=
t calculated CVE-2026-43753 [ https://www.cve.org/CVERecord?id=3DCVE-2026-4= 3753 ] Apple--iOS and iPadOS An integer overflow was addressed with improve=
d input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS = Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS = 26.6, watchOS 26.6. An app may be able to cause unexpected system terminati= on. 2026-07-27 not yet calculated CVE-2026-43769 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-43769 ] Apple--iOS and iPadOS A buffer overflow was add= ressed with improved bounds checking. This issue is fixed in iOS 26.6 and i= PadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6. Processing a maliciousl=
y crafted file may lead to unexpected app termination or arbitrary code exe= cution. 2026-07-27 not yet calculated CVE-2026-43776 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-43776 ] Apple--iOS and iPadOS A use after free issu=
e was addressed with improved memory management. This issue is fixed in iOS=
26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tah=
oe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to caus=
e unexpected system termination or corrupt kernel memory. 2026-07-27 not ye=
t calculated CVE-2026-43778 [ https://www.cve.org/CVERecord?id=3DCVE-2026-4= 3778 ] Apple--iOS and iPadOS An integer overflow was addressed with improve=
d input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS = Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS = 26.6, watchOS 26.6. Processing a maliciously crafted texture may lead to un= expected app termination. 2026-07-27 not yet calculated CVE-2026-43780 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-43780 ] Apple--iOS and iPadOS Thi=
s issue was addressed with improved data protection. This issue is fixed in=
iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS=
Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to = access sensitive user data. 2026-07-27 not yet calculated CVE-2026-43796 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-43796 ] Apple--iOS and iPadOS T= his issue was addressed with improved checks. This issue is fixed in iOS 26=
.6 and iPadOS 26.6, macOS Tahoe 26.6. An app may be able to access informat= ion about a user's contacts. 2026-07-27 not yet calculated CVE-2026-43797 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-43797 ] Apple--iOS and iPadOS =
A use after free issue was addressed with improved memory management. This = issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Son= oma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An ap=
p may be able to cause unexpected system termination. 2026-07-27 not yet ca= lculated CVE-2026-43799 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43799=
] Apple--iOS and iPadOS An information disclosure issue was addressed by r= emoving the vulnerable code. This issue is fixed in iOS 26.6 and iPadOS 26.=
6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6. An app may be able to access = sensitive user data. 2026-07-27 not yet calculated CVE-2026-43800 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-43800 ] Apple--iOS and iPadOS This iss=
ue was addressed with improved checks. This issue is fixed in iOS 26.6 and = iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, t= vOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to access sensiti=
ve user data. 2026-07-27 not yet calculated CVE-2026-43801 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-43801 ] Apple--iOS and iPadOS An out-of-bound=
s write issue was addressed with improved bounds checking. This issue is fi= xed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8,=
macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A remote attacke=
r may be able to cause unexpected system termination. 2026-07-27 not yet ca= lculated CVE-2026-43803 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43803=
] Apple--iOS and iPadOS A race condition was addressed with improved state=
handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 1= 5.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, watchOS 26.6. An app may be a= ble to cause unexpected system termination or write kernel memory. 2026-07-=
27 not yet calculated CVE-2026-43805 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-43805 ] Apple--iOS and iPadOS A buffer overflow was addressed with = improved bounds checking. This issue is fixed in iOS 26.5.2 and iPadOS 26.5= .2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.2, tvOS 26.=
6, visionOS 26.6, watchOS 26.6. A malicious accessory may be able to cause = unexpected app termination. 2026-07-27 not yet calculated CVE-2026-43807 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-43807 ] Apple--iOS and iPadOS T=
he issue was addressed with improved memory handling. This issue is fixed i=
n iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macO=
S Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A remote user may be = able to cause unexpected system termination or corrupt kernel memory. 2026-= 07-27 not yet calculated CVE-2026-43810 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-43810 ] Apple--iOS and iPadOS A race condition was addressed wi=
th improved checks. This issue is fixed in iOS 26.6 and iPadOS 26.6. An app=
may be able to modify protected parts of the file system. 2026-07-27 not y=
et calculated CVE-2026-43811 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 43811 ] Apple--iOS and iPadOS A use after free issue was addressed with imp= roved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, m= acOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. An app may=
be able to cause unexpected system termination. 2026-07-27 not yet calcula= ted CVE-2026-43812 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43812 ] Ap= ple--iOS and iPadOS A validation issue was addressed with improved input sa= nitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26= .6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A maliciously crafted app may b=
e able to bypass code signing enforcement. 2026-07-27 not yet calculated CV= E-2026-43813 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43813 ] Apple--i=
OS and iPadOS A use after free issue was addressed with improved memory man= agement. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6,=
tvOS 26.6, watchOS 26.6. An app may be able to cause unexpected system ter= mination. 2026-07-27 not yet calculated CVE-2026-43814 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-43814 ] Apple--iOS and iPadOS An out-of-bounds wr= ite issue was addressed with improved bounds checking. This issue is fixed =
in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, wa= tchOS 26.6. An app may be able to cause unexpected system termination. 2026= -07-27 not yet calculated CVE-2026-43816 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-43816 ] Apple--iOS and iPadOS An out-of-bounds read was address=
ed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadO=
S 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app ma=
y be able to cause unexpected system termination. 2026-07-27 not yet calcul= ated CVE-2026-43817 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43817 ] A= pple--iOS and iPadOS An integer overflow was addressed with improved input = validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia = 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Processing a maliciously cra= fted image may lead to arbitrary code execution. 2026-07-27 not yet calcula= ted CVE-2026-43818 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43818 ] Ap= ple--iOS and iPadOS A use after free issue was addressed with improved memo=
ry management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequo=
ia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6,=
watchOS 26.6. An app may be able to cause unexpected system termination. 2= 026-07-27 not yet calculated CVE-2026-43822 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-43822 ] Apple--iOS and iPadOS An out-of-bounds read was addr= essed with improved bounds checking. This issue is fixed in iOS 26.6 and iP= adOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvO=
S 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause a denial-o= f-service. 2026-07-27 not yet calculated CVE-2026-64692 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-64692 ] Apple--iOS and iPadOS A type confusion i= ssue was addressed with improved checks. This issue is fixed in iOS 26.6 an=
d iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6,=
tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted i= mage may lead to a denial-of-service. 2026-07-27 not yet calculated CVE-202= 6-64693 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64693 ] Apple--iOS an=
d iPadOS A use after free issue was addressed with improved memory manageme= nt. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, = macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26= .6. An app may be able to cause unexpected system termination. 2026-07-27 n=
ot yet calculated CVE-2026-64700 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-64700 ] Apple--iOS and iPadOS A permissions issue was addressed with im= proved validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS S= equoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, visionOS 26.6. An app=
may be able to delete files for which it does not have permission. 2026-07= -27 not yet calculated CVE-2026-64707 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-64707 ] Apple--iOS and iPadOS The issue was addressed with improve=
d memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS S= equoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 2= 6.6, watchOS 26.6. An app may be able to disclose kernel memory. 2026-07-27=
not yet calculated CVE-2026-64709 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-64709 ] Apple--iOS and iPadOS This issue was addressed with additiona=
l entitlement checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macO=
S Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able=
to leak sensitive user information. 2026-07-27 not yet calculated CVE-2026= -64711 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64711 ] Apple--iOS and=
iPadOS The issue was addressed with improved memory handling. This issue i=
s fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.= 8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a=
maliciously crafted image may corrupt process memory. 2026-07-27 not yet c= alculated CVE-2026-64716 [ https://www.cve.org/CVERecord?id=3DCVE-2026-6471=
6 ] Apple--iOS and iPadOS A race condition was addressed with improved stat=
e handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26= .6, tvOS 26.6, watchOS 26.6. An app may be able to cause unexpected system = termination. 2026-07-27 not yet calculated CVE-2026-64720 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-64720 ] Apple--iOS and iPadOS This issue was a= ddressed through improved state management. This issue is fixed in iOS 26.6=
and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26= .6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to access se= nsitive user data. 2026-07-27 not yet calculated CVE-2026-64721 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-64721 ] Apple--iOS and iPadOS A buffer o= verflow issue was addressed with improved memory handling. This issue is fi= xed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6. Pr= ocessing a 3D model may result in disclosure of process memory. 2026-07-27 = not yet calculated CVE-2026-64722 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-64722 ] Apple--iOS and iPadOS The issue was addressed with improved me= mory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequo=
ia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6,=
watchOS 26.6. An attacker on the local network may be able to cause a deni= al-of-service. 2026-07-27 not yet calculated CVE-2026-64724 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-64724 ] Apple--iOS and iPadOS An out-of-boun=
ds write issue was addressed with improved bounds checking. This issue is f= ixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8=
, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be a= ble to cause a denial-of-service. 2026-07-27 not yet calculated CVE-2026-64= 725 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64725 ] Apple--iOS and iP= adOS The issue was addressed with improved memory handling. This issue is f= ixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.=
6, watchOS 26.6. An attacker in physical proximity may be able to corrupt p= rocess memory. 2026-07-27 not yet calculated CVE-2026-64726 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-64726 ] Apple--iOS and iPadOS A use after fr=
ee issue was addressed with improved memory management. This issue is fixed=
in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, w= atchOS 26.6. An app may be able to cause unexpected system termination. 202= 6-07-27 not yet calculated CVE-2026-64729 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-64729 ] Apple--iOS and iPadOS This issue was addressed through=
improved state management. This issue is fixed in iOS 26.6 and iPadOS 26.6=
. An attacker with physical access may be able to access sensitive user dat=
a during iPhone Mirroring. 2026-07-27 not yet calculated CVE-2026-64732 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-64732 ] Apple--iOS and iPadOS Th=
is issue was addressed with improved data protection. This issue is fixed i=
n iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, wat= chOS 26.6. An app may be able to fingerprint the user. 2026-07-27 not yet c= alculated CVE-2026-64733 [ https://www.cve.org/CVERecord?id=3DCVE-2026-6473=
3 ] Apple--iOS and iPadOS The issue was addressed with improved checks. Thi=
s issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS S= onoma 14.8.8, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. Processing a m= aliciously crafted contact may leak sensitive data. 2026-07-27 not yet calc= ulated CVE-2026-64734 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64734 ]=
Apple--iOS and iPadOS An inconsistent user interface issue was addressed w= ith improved state management. This issue is fixed in iOS 26.6 and iPadOS 2= 6.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6=
, visionOS 26.6, watchOS 26.6. A remote attacker may be able to bypass netw= ork filters. 2026-07-27 not yet calculated CVE-2026-64735 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-64735 ] Apple--iOS and iPadOS An out-of-bounds=
write issue was addressed with improved bounds checking. This issue is fix=
ed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, = macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An attacker may b=
e able to cause unexpected app termination. 2026-07-27 not yet calculated C= VE-2026-64739 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64739 ] Apple--= iOS and iPadOS A parsing issue in the handling of directory paths was addre= ssed with improved path validation. This issue is fixed in iOS 26.6 and iPa= dOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS=
26.6. A malicious app may be able to break out of its sandbox. 2026-07-27 = not yet calculated CVE-2026-64740 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-64740 ] Apple--iOS and iPadOS A permissions issue was addressed with a= dditional restrictions. This issue is fixed in iOS 26.6 and iPadOS 26.6, tv=
OS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to read a persiste=
nt device identifier. 2026-07-27 not yet calculated CVE-2026-64741 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-64741 ] Apple--iOS and iPadOS This is= sue was addressed by using HTTPS when sending information over the network.=
This issue is fixed in iOS 26.6 and iPadOS 26.6, tvOS 26.6, visionOS 26.6,=
watchOS 26.6. An app may be able to access sensitive user data. 2026-07-27=
not yet calculated CVE-2026-64742 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-64742 ] Apple--iOS and iPadOS An authorization issue was addressed wi=
th improved state management. This issue is fixed in iOS 26.6 and iPadOS 26= .6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be=
able to access sensitive user data. 2026-07-27 not yet calculated CVE-2026= -64743 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64743 ] Apple--iOS and=
iPadOS An authorization issue was addressed with improved validation. This=
issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.=
6, watchOS 26.6. An app may be able to add contacts without user authorizat= ion. 2026-07-27 not yet calculated CVE-2026-64746 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-64746 ] Apple--iOS and iPadOS A buffer overflow was ad= dressed with improved size validation. This issue is fixed in iOS 26.6 and = iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, t= vOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to execute arbitr= ary code with kernel privileges. 2026-07-27 not yet calculated CVE-2026-647=
47 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64747 ] Apple--iOS and iPa= dOS The issue was addressed with improved memory handling. This issue is fi= xed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, vi= sionOS 26.6. An app may be able to cause unexpected system termination or c= orrupt kernel memory. 2026-07-27 not yet calculated CVE-2026-64749 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-64749 ] Apple--iOS and iPadOS A use a= fter free issue was addressed with improved memory management. This issue i=
s fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS = 26.6, watchOS 26.6. An app may be able to cause unexpected system terminati=
on or write kernel memory. 2026-07-27 not yet calculated CVE-2026-64751 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-64751 ] Apple--iOS and iPadOS An=
out-of-bounds write issue was addressed with improved bounds checking. Thi=
s issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS S= onoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Pro= cessing a maliciously crafted file may lead to a denial-of-service. 2026-07= -27 not yet calculated CVE-2026-64754 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-64754 ] Apple--iOS and iPadOS An authorization issue was addressed=
with improved state management. This issue is fixed in iOS 26.6 and iPadOS=
26.6. An app may be able to access sensitive user data. 2026-07-27 not yet=
calculated CVE-2026-64755 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64= 755 ] Apple--iOS and iPadOS The issue was addressed with improved bounds ch= ecks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tv=
OS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file=
may lead to unexpected app termination. 2026-07-27 not yet calculated CVE-= 2026-64758 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64758 ] Apple--iOS=
and iPadOS An out-of-bounds write issue was addressed by removing the vuln= erable code. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia=
15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, w= atchOS 26.6. Processing a maliciously crafted file may lead to unexpected a=
pp termination or arbitrary code execution. 2026-07-27 not yet calculated C= VE-2026-64763 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64763 ] Apple--= iOS and iPadOS An out-of-bounds write issue was addressed with improved bou= nds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoi=
a 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, = watchOS 26.6. Processing a maliciously crafted file may lead to unexpected = app termination or arbitrary code execution. 2026-07-27 not yet calculated = CVE-2026-64764 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64764 ] Apple-= -iOS and iPadOS An integer overflow was addressed with improved input valid= ation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.=
8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS=
26.6. Processing a maliciously crafted file may lead to unexpected app ter= mination or arbitrary code execution. 2026-07-27 not yet calculated CVE-202= 6-64765 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64765 ] Apple--iOS an=
d iPadOS An integer overflow was addressed with improved input validation. = This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macO=
S Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. = Processing a maliciously crafted file may lead to unexpected app terminatio=
n or arbitrary code execution. 2026-07-27 not yet calculated CVE-2026-64766=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-64766 ] Apple--iOS and iPadO=
S An out-of-bounds read issue was addressed with improved input validation.=
This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, mac=
OS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote atta= cker may cause an unexpected app termination. 2026-07-27 not yet calculated=
CVE-2026-64768 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64768 ] Apple= --iOS and iPadOS An out-of-bounds write issue was addressed with improved b= ounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequ= oia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6=
. A remote attacker may be able to cause unexpected application termination=
or heap corruption. 2026-07-27 not yet calculated CVE-2026-64769 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-64769 ] Apple--iOS and iPadOS An out-o= f-bounds write issue was addressed with improved bounds checking. This issu=
e is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma = 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may b=
e able to cause unexpected application termination or heap corruption. 2026= -07-27 not yet calculated CVE-2026-64770 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-64770 ] Apple--iOS and iPadOS A buffer overflow was addressed w= ith improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26= .6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A rem= ote attacker may be able to cause unexpected application termination or hea=
p corruption. 2026-07-27 not yet calculated CVE-2026-64771 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-64771 ] Apple--iOS and iPadOS An out-of-bound=
s write issue was addressed with improved input validation. This issue is f= ixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, t= vOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected = application termination or heap corruption. 2026-07-27 not yet calculated C= VE-2026-64772 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64772 ] Apple--= iOS and iPadOS An integer overflow was addressed with improved input valida= tion. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8=
, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote=
attacker may be able to cause unexpected application termination or heap c= orruption. 2026-07-27 not yet calculated CVE-2026-64774 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-64774 ] Apple--iOS and iPadOS A memory initializ= ation issue was addressed with improved memory handling. This issue is fixe=
d in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, m= acOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able=
to cause unexpected system termination. 2026-07-27 not yet calculated CVE-= 2026-64775 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64775 ] Apple--mac=
OS An information disclosure issue was addressed with improved privacy cont= rols. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An = app may be able to access sensitive user data. 2026-07-27 not yet calculate=
d CVE-2026-20672 [ https://www.cve.org/CVERecord?id=3DCVE-2026-20672 ] Appl= e--macOS The issue was addressed with improved checks. This issue is fixed =
in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A maliciously crafted ZIP arc= hive may bypass Gatekeeper checks. 2026-07-27 not yet calculated CVE-2026-2= 8849 [ https://www.cve.org/CVERecord?id=3DCVE-2026-28849 ] Apple--macOS The=
issue was addressed with improved memory handling. This issue is fixed in = macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An attacker may be able to cause=
unexpected system termination or read kernel memory. 2026-07-27 not yet ca= lculated CVE-2026-28896 [ https://www.cve.org/CVERecord?id=3DCVE-2026-28896=
] Apple--macOS A file quarantine bypass was addressed with additional chec= ks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A mal= iciously crafted ZIP archive may bypass Gatekeeper checks. 2026-07-27 not y=
et calculated CVE-2026-28900 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 28900 ] Apple--macOS The issue was addressed with improved memory handling.=
This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious = app may be able to corrupt memory of a system process. 2026-07-27 not yet c= alculated CVE-2026-28911 [ https://www.cve.org/CVERecord?id=3DCVE-2026-2891=
1 ] Apple--macOS A logic issue was addressed with improved restrictions. Th=
is issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A user may be = able to elevate privileges. 2026-07-27 not yet calculated CVE-2026-28912 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-28912 ] Apple--macOS A race con= dition was addressed with improved state handling. This issue is fixed in m= acOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An app may be able to elevate pri= vileges. 2026-07-27 not yet calculated CVE-2026-28926 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-28926 ] Apple--macOS A logic issue existed resulti=
ng in memory corruption. This was addressed with improved state management.=
This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Ta= hoe 26.6. An app may be able to cause a denial of service. 2026-07-27 not y=
et calculated CVE-2026-28932 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 28932 ] Apple--macOS A permissions issue was addressed with additional sand= box restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma=
14.8.8, macOS Tahoe 26.6. An app may be able to bypass network restriction=
s. 2026-07-27 not yet calculated CVE-2026-28945 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-28945 ] Apple--macOS A buffer overflow was addressed wit=
h improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, ma= cOS Sonoma 14.8.8, macOS Tahoe 26.6. Processing a maliciously crafted image=
may lead to arbitrary code execution. 2026-07-27 not yet calculated CVE-20= 26-28981 [ https://www.cve.org/CVERecord?id=3DCVE-2026-28981 ] Apple--macOS=
A race condition was addressed with improved locking. This issue is fixed =
in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote us=
er may be able to cause unexpected system termination or corrupt kernel mem= ory. 2026-07-27 not yet calculated CVE-2026-28982 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-28982 ] Apple--macOS The issue was addressed with impr= oved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS So= noma 14.8.8, macOS Tahoe 26.6. Connecting to a malicious SMB server may lea=
d to unexpected system termination. 2026-07-27 not yet calculated CVE-2026-= 39873 [ https://www.cve.org/CVERecord?id=3DCVE-2026-39873 ] Apple--macOS A = permissions issue was addressed with additional restrictions. This issue is=
fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A ma= licious app may be able to gain root privileges. 2026-07-27 not yet calcula= ted CVE-2026-39874 [ https://www.cve.org/CVERecord?id=3DCVE-2026-39874 ] Ap= ple--macOS A permissions issue was addressed with additional restrictions. = This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tah=
oe 26.6. A malicious app may be able to gain root privileges. 2026-07-27 no=
t yet calculated CVE-2026-39875 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-39875 ] Apple--macOS A memory corruption issue was addressed with improv=
ed memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sono=
ma 14.8.8. An app may be able to disclose kernel memory. 2026-07-27 not yet=
calculated CVE-2026-39877 [ https://www.cve.org/CVERecord?id=3DCVE-2026-39= 877 ] Apple--macOS This issue was addressed with additional entitlement che= cks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A lo= cal attacker may be able to determine the legacy VNC password configured fo=
r Screen Sharing. 2026-07-27 not yet calculated CVE-2026-43665 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-43665 ] Apple--macOS An authorization iss=
ue was addressed with improved state management. This issue is fixed in mac=
OS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious appli= cation may be able to bypass Privacy preferences. 2026-07-27 not yet calcul= ated CVE-2026-43672 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43672 ] A= pple--macOS A buffer overflow was addressed with improved bounds checking. = This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tah=
oe 26.6. A local user may be able to read kernel memory. 2026-07-27 not yet=
calculated CVE-2026-43681 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43= 681 ] Apple--macOS The issue was addressed with improved memory handling. T= his issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Taho=
e 26.6. A remote user may be able to cause unexpected system termination or=
corrupt kernel memory. 2026-07-27 not yet calculated CVE-2026-43682 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-43682 ] Apple--macOS A race conditi=
on was addressed with improved state handling. This issue is fixed in macOS=
Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able =
to gain root privileges. 2026-07-27 not yet calculated CVE-2026-43693 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-43693 ] Apple--macOS The issue was=
addressed with improved memory handling. This issue is fixed in macOS Sequ= oia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to ca= use unexpected system termination or write kernel memory. 2026-07-27 not ye=
t calculated CVE-2026-43694 [ https://www.cve.org/CVERecord?id=3DCVE-2026-4= 3694 ] Apple--macOS An injection issue was addressed with improved validati= on. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An ap=
p may be able to gain root privileges. 2026-07-27 not yet calculated CVE-20= 26-43698 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43698 ] Apple--macOS=
The issue was addressed with improved memory handling. This issue is fixed=
in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An attacke=
r may be able to cause unexpected system termination or corrupt kernel memo= ry. 2026-07-27 not yet calculated CVE-2026-43710 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-43710 ] Apple--macOS This issue was addressed through i= mproved state management. This issue is fixed in macOS Tahoe 26.6. An attac= ker may be able to modify the state of the Keychain. 2026-07-27 not yet cal= culated CVE-2026-43728 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43728 =
] Apple--macOS The issue was addressed with improved memory handling. This = issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. Processing a m= aliciously crafted asset catalog may result in disclosure of process memory=
. 2026-07-27 not yet calculated CVE-2026-43738 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-43738 ] Apple--macOS An out-of-bounds read was addressed = with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8,=
macOS Sonoma 14.8.8, macOS Tahoe 26.6. Parsing a maliciously crafted file = may lead to an unexpected app termination. 2026-07-27 not yet calculated CV= E-2026-43747 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43747 ] Apple--m= acOS An out-of-bounds write issue was addressed with improved bounds checki= ng. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. An app m=
ay be able to cause unexpected system termination. 2026-07-27 not yet calcu= lated CVE-2026-43748 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43748 ] = Apple--macOS A parsing issue in the handling of directory paths was address=
ed with improved path validation. This issue is fixed in macOS Sequoia 15.7= .8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to gain root = privileges. 2026-07-27 not yet calculated CVE-2026-43749 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-43749 ] Apple--macOS A buffer overflow was addr= essed with improved bounds checking. This issue is fixed in macOS Sequoia 1= 5.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to execute=
arbitrary code out of its sandbox or with certain elevated privileges. 202= 6-07-27 not yet calculated CVE-2026-43750 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-43750 ] Apple--macOS This issue was addressed with improved re= daction of sensitive information. This issue is fixed in macOS Sequoia 15.7= .8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to leak sensi= tive kernel state. 2026-07-27 not yet calculated CVE-2026-43754 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-43754 ] Apple--macOS A race condition wa=
s addressed with improved state management. This issue is fixed in macOS So= noma 14.8.8, macOS Tahoe 26.6. An app may be able to gain root privileges. = 2026-07-27 not yet calculated CVE-2026-43755 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-43755 ] Apple--macOS A logic issue was addressed with impro= ved validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 1= 4.8.8, macOS Tahoe 26.6. An app may be able to access user-sensitive data. = 2026-07-27 not yet calculated CVE-2026-43756 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-43756 ] Apple--macOS An out-of-bounds read was addressed wi=
th improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, m= acOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpecte=
d system termination. 2026-07-27 not yet calculated CVE-2026-43757 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-43757 ] Apple--macOS An authorization=
issue was addressed with improved state management. This issue is fixed in=
macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, watchOS 26.6.=
An app may be able to access sensitive user data. 2026-07-27 not yet calcu= lated CVE-2026-43758 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43758 ] = Apple--macOS An authorization issue was addressed with improved state manag= ement. This issue is fixed in macOS Tahoe 26.6, watchOS 26.6. An app may be=
able to access sensitive user data. 2026-07-27 not yet calculated CVE-2026= -43759 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43759 ] Apple--macOS A=
n access issue was addressed with improved access restrictions. This issue =
is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to ac= cess user-sensitive data. 2026-07-27 not yet calculated CVE-2026-43760 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-43760 ] Apple--macOS A permission=
s issue was addressed by removing the vulnerable code. This issue is fixed =
in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may =
be able to read files outside of its sandbox. 2026-07-27 not yet calculated=
CVE-2026-43763 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43763 ] Apple= --macOS An integer overflow was addressed with improved input validation. T= his issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Taho=
e 26.6. An app may be able to cause unexpected system termination. 2026-07-=
27 not yet calculated CVE-2026-43764 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-43764 ] Apple--macOS This issue was addressed with improved handlin=
g of symlinks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14= .8.8, macOS Tahoe 26.6. An app may be able to modify protected parts of the=
file system. 2026-07-27 not yet calculated CVE-2026-43765 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-43765 ] Apple--macOS An authorization issue w=
as addressed with improved state management. This issue is fixed in macOS S= equoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An attacker with phys= ical access to a locked device may be able to view sensitive user informati= on. 2026-07-27 not yet calculated CVE-2026-43766 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-43766 ] Apple--macOS The issue was addressed with impro= ved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Son= oma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system=
termination. 2026-07-27 not yet calculated CVE-2026-43767 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-43767 ] Apple--macOS The issue was addressed = with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8,=
macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpec= ted system termination. 2026-07-27 not yet calculated CVE-2026-43768 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-43768 ] Apple--macOS A race conditi=
on was addressed with additional validation. This issue is fixed in macOS S= equoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6. An app may=
be able to access sensitive user data. 2026-07-27 not yet calculated CVE-2= 026-43770 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43770 ] Apple--macO=
S A stack overflow was addressed with improved input validation. This issue=
is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A=
n app may be able to cause a denial-of-service. 2026-07-27 not yet calculat=
ed CVE-2026-43771 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43771 ] App= le--macOS A path traversal issue was addressed with improved input validati= on. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS=
Tahoe 26.6. An app may be able to break out of its sandbox. 2026-07-27 not=
yet calculated CVE-2026-43772 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-43772 ] Apple--macOS An out-of-bounds read was addressed with improved bo= unds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14= .8.8, macOS Tahoe 26.6. Mounting a maliciously crafted disk image may cause=
unexpected system termination or corrupt kernel memory. 2026-07-27 not yet=
calculated CVE-2026-43773 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43= 773 ] Apple--macOS An out-of-bounds read was addressed with improved bounds=
checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8=
, macOS Tahoe 26.6. An app may be able to access sensitive user data. 2026-= 07-27 not yet calculated CVE-2026-43774 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-43774 ] Apple--macOS An authorization issue was addressed with = improved state management. This issue is fixed in macOS Sequoia 15.7.8, mac=
OS Tahoe 26.6. An app may be able to access sensitive user data. 2026-07-27=
not yet calculated CVE-2026-43775 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-43775 ] Apple--macOS This issue was addressed with improved input val= idation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, = macOS Tahoe 26.6. A remote attacker may be able to cause a denial of servic=
e. 2026-07-27 not yet calculated CVE-2026-43777 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-43777 ] Apple--macOS A logic issue was addressed with im= proved restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Son= oma 14.8.8, macOS Tahoe 26.6. An app may be able to intercept network conne= ctions intended for another process. 2026-07-27 not yet calculated CVE-2026= -43779 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43779 ] Apple--macOS A=
race condition was addressed with improved state handling. This issue is f= ixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app=
may be able to access sensitive user data. 2026-07-27 not yet calculated C= VE-2026-43781 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43781 ] Apple--= macOS This issue was addressed with improved checks. This issue is fixed in=
macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be=
able to access sensitive user data. 2026-07-27 not yet calculated CVE-2026= -43782 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43782 ] Apple--macOS A=
n issue existed in the handling of environment variables. This issue was ad= dressed with improved validation. This issue is fixed in macOS Sequoia 15.7= .8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unex= pected system termination. 2026-07-27 not yet calculated CVE-2026-43793 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-43793 ] Apple--macOS An out-of-b= ounds write issue was addressed with improved bounds checking. This issue i=
s fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An = app may be able to cause unexpected system termination. 2026-07-27 not yet = calculated CVE-2026-43802 [ https://www.cve.org/CVERecord?id=3DCVE-2026-438=
02 ] Apple--macOS A denial of service issue was addressed by removing the v= ulnerable code. This issue is fixed in macOS Tahoe 26.6. A local attacker m=
ay be able to cause a denial of service. 2026-07-27 not yet calculated CVE-= 2026-43806 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43806 ] Apple--mac=
OS An out-of-bounds read was addressed with improved bounds checking. This = issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26= .6. An app may be able to cause unexpected system termination. 2026-07-27 n=
ot yet calculated CVE-2026-43809 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-43809 ] Apple--macOS An access issue was addressed with additional sand= box restrictions. This issue is fixed in macOS Tahoe 26.6. An app may be ab=
le to access sensitive user data. 2026-07-27 not yet calculated CVE-2026-43= 819 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43819 ] Apple--macOS A bu= ffer overflow was addressed with improved size validation. This issue is fi= xed in macOS Tahoe 26.6. An app may be able to cause unexpected system term= ination. 2026-07-27 not yet calculated CVE-2026-64691 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-64691 ] Apple--macOS An integer overflow was addre= ssed with improved input validation. This issue is fixed in macOS Sequoia 1= 5.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause u= nexpected system termination. 2026-07-27 not yet calculated CVE-2026-64694 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-64694 ] Apple--macOS The issu=
e was addressed with improved memory handling. This issue is fixed in macOS=
Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote user may b=
e able to cause unexpected system termination or corrupt kernel memory. 202= 6-07-27 not yet calculated CVE-2026-64695 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-64695 ] Apple--macOS The issue was addressed with improved mem= ory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.= 8.8, macOS Tahoe 26.6. A remote user may be able to cause unexpected system=
termination or corrupt kernel memory. 2026-07-27 not yet calculated CVE-20= 26-64696 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64696 ] Apple--macOS=
The issue was addressed with improved memory handling. This issue is fixed=
in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may=
be able to cause unexpected system termination or corrupt kernel memory. 2= 026-07-27 not yet calculated CVE-2026-64697 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-64697 ] Apple--macOS The issue was addressed with improved m= emory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 1= 4.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system term= ination or read kernel memory. 2026-07-27 not yet calculated CVE-2026-64698=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-64698 ] Apple--macOS A memor=
y initialization issue was addressed with improved memory handling. This is= sue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6=
. An app may be able to disclose kernel memory. 2026-07-27 not yet calculat=
ed CVE-2026-64699 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64699 ] App= le--macOS An access issue was addressed with additional sandbox restriction=
s. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS = Tahoe 26.6. An app may be able to break out of its sandbox. 2026-07-27 not = yet calculated CVE-2026-64702 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -64702 ] Apple--macOS A use after free issue was addressed with improved me= mory management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma = 14.8.8, macOS Tahoe 26.6. An app may be able to cause a denial-of-service. = 2026-07-27 not yet calculated CVE-2026-64703 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-64703 ] Apple--macOS A type confusion issue was addressed w= ith improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, = macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpect=
ed system termination. 2026-07-27 not yet calculated CVE-2026-64704 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-64704 ] Apple--macOS A file quaranti=
ne bypass was addressed with additional checks. This issue is fixed in macO=
S Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may bypass = Gatekeeper checks. 2026-07-27 not yet calculated CVE-2026-64708 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-64708 ] Apple--macOS A privacy issue was=
addressed by removing sensitive data. This issue is fixed in macOS Sequoia=
15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to leak = sensitive user information. 2026-07-27 not yet calculated CVE-2026-64710 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-64710 ] Apple--macOS A logic is= sue was addressed with improved checks. This issue is fixed in macOS Sequoi=
a 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to acce=
ss sensitive user data. 2026-07-27 not yet calculated CVE-2026-64723 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-64723 ] Apple--macOS A type confusi=
on issue was addressed with improved memory handling. This issue is fixed i=
n macOS Tahoe 26.6, tvOS 26.6. An app may be able to cause unexpected syste=
m termination. 2026-07-27 not yet calculated CVE-2026-64727 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-64727 ] Apple--macOS A path handling issue w=
as addressed with improved validation. This issue is fixed in macOS Sequoia=
15.7.8, macOS Tahoe 26.6. A malicious app may be able to break out of its = sandbox. 2026-07-27 not yet calculated CVE-2026-64731 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-64731 ] Apple--macOS An authorization issue was ad= dressed with improved state management. This issue is fixed in macOS Sequoi=
a 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be abl=
e to break out of its sandbox. 2026-07-27 not yet calculated CVE-2026-64737=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-64737 ] Apple--macOS A permi= ssions issue was addressed with additional restrictions. This issue is fixe=
d in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicio=
us app may be able to break out of its sandbox. 2026-07-27 not yet calculat=
ed CVE-2026-64738 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64738 ] App= le--macOS An information leakage was addressed with additional validation. = This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tah=
oe 26.6. An app may be able to disclose kernel memory. 2026-07-27 not yet c= alculated CVE-2026-64744 [ https://www.cve.org/CVERecord?id=3DCVE-2026-6474=
4 ] Apple--macOS This issue was addressed with additional restrictions on t=
he lock screen. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26= .6. A person with physical access to a locked device may be able to access = contacts and photos. 2026-07-27 not yet calculated CVE-2026-64745 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-64745 ] Apple--macOS An out-of-bounds = read was addressed with improved bounds checking. This issue is fixed in ma= cOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be ab=
le to cause unexpected system termination. 2026-07-27 not yet calculated CV= E-2026-64762 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64762 ] Apple--m= acOS A buffer overflow was addressed with improved bounds checking. This is= sue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6=
. A remote attacker may be able to cause unexpected system termination or c= orrupt kernel memory. 2026-07-27 not yet calculated CVE-2026-64767 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-64767 ] Apple--macOS The issue was ad= dressed with improved bounds checks. This issue is fixed in macOS Sequoia 1= 5.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to disclos=
e kernel memory. 2026-07-27 not yet calculated CVE-2026-64776 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-64776 ] Apple--Safari An authorization iss=
ue was addressed with improved state management. This issue is fixed in Saf= ari 26.6, macOS Tahoe 26.6. An app may be able to access sensitive user dat=
a. 2026-07-27 not yet calculated CVE-2026-43792 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-43792 ] Apple--Safari This issue was addressed through i= mproved state management. This issue is fixed in Safari 26.6, iOS 26.6 and = iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6. Visiting a website may lead t=
o an app denial-of-service. 2026-07-27 not yet calculated CVE-2026-43804 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-43804 ] Apple--Safari An access=
issue was addressed with improved access restrictions. This issue is fixed=
in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, vis= ionOS 26.6, watchOS 26.6. An app may be able to read files outside of its s= andbox. 2026-07-27 not yet calculated CVE-2026-43821 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-43821 ] Apple--Safari This issue was addressed with=
improved checks. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 2= 6.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Websites may=
know if the user has visited a given link. 2026-07-27 not yet calculated C= VE-2026-64713 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64713 ] Apple--= Safari A use-after-free issue was addressed with improved memory management=
. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe=
26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously craft=
ed web content may lead to an unexpected Safari crash. 2026-07-27 not yet c= alculated CVE-2026-64718 [ https://www.cve.org/CVERecord?id=3DCVE-2026-6471=
8 ] Apple--Safari An out-of-bounds access issue was addressed with improved=
bounds checking. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 2= 6.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing m= aliciously crafted web content may lead to an unexpected Safari crash. 2026= -07-27 not yet calculated CVE-2026-64719 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-64719 ] Apple--Safari A permissions issue was addressed with im= proved validation. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS = 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Maliciously=
crafted web content may violate iframe sandboxing policy. 2026-07-27 not y=
et calculated CVE-2026-64728 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 64728 ] Apple--Safari The issue was addressed with improved UI. This issue =
is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 2= 6.6, visionOS 26.6, watchOS 26.6. Visiting a website that frames malicious = content may lead to UI spoofing. 2026-07-27 not yet calculated CVE-2026-647=
30 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64730 ] Apple--Safari A me= mory corruption issue was addressed with improved state management. This is= sue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, vi= sionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may l= ead to an unexpected Safari crash. 2026-07-27 not yet calculated CVE-2026-6= 4757 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64757 ] Apple--Safari A = use-after-free issue was addressed with improved memory management. This is= sue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, vi= sionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may l= ead to an unexpected Safari crash. 2026-07-27 not yet calculated CVE-2026-6= 4783 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64783 ] Appointment Book= ing--Appointment Booking Plugin The Appointment Booking Plugin WordPress pl= ugin before 5.6.8 does not restrict which booking fields an unauthenticated=
visitor can set through its public booking funnel, allowing an unauthentic= ated user to assign a privileged booking field such as the approval status = and thereby bypass the site's booking approval workflow. 2026-07-30 not yet=
calculated CVE-2026-15250 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15= 250 ] Asseco--proCertum SmartSign proCertum SmartSign opens Certificate Pra= ctice Statement (CPS) URI without schema validation. An attacker can prepar=
e arbitrary certificate with CPS URI pointing to a local executable file or=
any URL, sign a document with it, and send it to the victim.=C2=A0When the=
victim opens the document in the application, the specified file will be e= xecuted (or webpage will be opened). This issue was fixed in version 9.4.3.= 90. 2026-07-27 not yet calculated CVE-2026-57916 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-57916 ] Asseco--proCertum SmartSign proCertum SmartSign= =C2=A0parses external XML entities from arbitrary crafted signature files, = enabling SSRF and potentially allowing the reading of local files, dependin=
g on the parser's configuration. The XML External Entity (XXE) vulnerabilit=
y is triggered simply by previewing a file in the file selection window, be= fore the victim clicks "Open". This issue was fixed in version 9.4.3.90. 20= 26-07-27 not yet calculated CVE-2026-57917 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-57917 ] ASUS--Armoury Crate Concurrent Execution using Shared=
Resource with Improper Synchronization ("Race Condition") in ASUS Armoury = Crate allows a local user to execute arbitrary code with elevated privilege=
s via a crafted file replacement. Refer to the '=C2=A0Security Update for A= SUS Armoury Crate=C2=A0' section on the ASUS Security Advisory for more inf= ormation. 2026-07-30 not yet calculated CVE-2026-16727 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-16727 ] ASUSTOR Inc.--ADM A stored format string = vulnerability was found in the FTP Backup on the ADM. The vulnerability occ= urs because user-controlled backup configuration data may be written into a=
task log and later processed through an unsafe format string operation. An=
authenticated attacker can exploit this issue to disclose memory informati=
on or cause denial of service of the affected CGI process. Affected product=
s and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as fr=
om ADM 5.0.0 through ADM 5.1.3.RI81. 2026-07-30 not yet calculated CVE-2026= -18186 [ https://www.cve.org/CVERecord?id=3DCVE-2026-18186 ] ASUSTOR Inc.--= ADM A format string vulnerability was found in the Internal Backup on the A= DM. The vulnerability occurs because user-controlled task input may be incl= uded in an error response and processed through an unsafe format string ope= ration. An authenticated attacker can exploit this issue to disclose memory=
information or cause denial of service of the affected CGI process. Affect=
ed products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as = well as from ADM 5.0.0 through ADM 5.1.3.RI81. 2026-07-30 not yet calculate=
d CVE-2026-18187 [ https://www.cve.org/CVERecord?id=3DCVE-2026-18187 ] ASUS= TOR Inc.--ADM A format string vulnerability was found in the Rsync Backup o=
n the ADM. The vulnerability occurs because user-controlled rsync backup co= nfiguration or log data may be processed through an unsafe format string op= eration. An authenticated attacker can exploit this issue to disclose memor=
y information or cause denial of service of the affected backup component. = Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RU=
N1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81. 2026-07-30 not yet cal= culated CVE-2026-18188 [ https://www.cve.org/CVERecord?id=3DCVE-2026-18188 =
] ASUSTOR Inc.--ADM A format string vulnerability was found in the Notifica= tion OAuth settings of ADM. The vulnerability occurs because user-controlle=
d notification configuration input may be processed through an unsafe forma=
t string operation. An authenticated administrator can exploit this issue t=
o disclose memory information or cause denial of service of the affected co= mponent. Affected products and versions include: from ADM 4.1.0 through ADM=
4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81. 2026-07-30 no=
t yet calculated CVE-2026-67244 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-67244 ] ASUSTOR Inc.--ADM A path traversal vulnerability was found in th=
e VPN Clients on the ADM. The vulnerability occurs because user-controlled = certificate name input is not sufficiently validated before being used to c= onstruct the upload destination path. An authenticated attacker can exploit=
this issue to write an uploaded certificate file outside the intended VPN = certificate directory, subject to process privileges and filesystem permiss= ions. Affected products and versions include: from ADM 4.1.0 through ADM 4.= 3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81. 2026-07-30 not y=
et calculated CVE-2026-67245 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 67245 ] ASUSTOR Inc.--ADM A path traversal vulnerability was found in the W= allpaper component of ADM. The vulnerability occurs because user-controlled=
wallpaper path input is not sufficiently validated before being used for f= ile access. An authenticated attacker can exploit this issue to access or m= anipulate files outside the intended wallpaper directory, subject to user p= ermissions and filesystem restrictions. Affected products and versions incl= ude: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 throug=
h ADM 5.1.3.RI81. 2026-07-30 not yet calculated CVE-2026-67246 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-67246 ] ASUSTOR Inc.--ADM A path traversa=
l vulnerability was found in the IHM Log handling of ADM. The vulnerability=
occurs because user-controlled disk serial input is not sufficiently valid= ated before being used to construct the path of an IHM log database file. A=
n authenticated attacker can exploit this issue to cause the affected compo= nent to access an unintended filesystem path or log database file. Affected=
products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as we=
ll as from ADM 5.0.0 through ADM 5.1.3.RI81. 2026-07-30 not yet calculated = CVE-2026-67247 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67247 ] ASUSTO=
R Inc.--ADM A stack-based buffer overflow vulnerability was found in the Fi=
le Explorer on the ADM. The vulnerability occurs because user-controlled in= put is not properly validated before being decoded and copied into a fixed-= size stack buffer. An authenticated attacker can exploit this issue to caus=
e denial of service of the affected CGI process. Further impact may be poss= ible depending on exploitability and runtime protections. Affected products=
and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as fro=
m ADM 5.0.0 through ADM 5.1.3.RI81. 2026-07-30 not yet calculated CVE-2026-= 67248 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67248 ] AT&T--Arris BGW= 210700 In firmware versions 2.7.7 and earlier, the Arris BGW210 700 gateway=
fails to enforce any server side authentication on its /cgi-bin/*.ha manag= ement endpoints, relying solely on client side CSS/JavaScript gating that c=
an be bypassed by any HTTP client. This allows unauthenticated attackers on=
the LAN to read sensitive configuration data, modify persistent device set= tings, or trigger backend diagnostic operations. The issue appears systemic=
across the CGI handler chain. 2026-07-28 not yet calculated CVE-2026-16771=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-16771 ] ATEN--Unizon ATEN Un= izon RpcProvider Missing Authentication Denial-of-Service Vulnerability. Th=
is vulnerability allows remote attackers to create a denial-of-service cond= ition on affected installations of ATEN Unizon. Authentication is not requi= red to exploit this vulnerability. The specific flaw exists within the RpcP= rovider class. The issue results from the lack of authentication prior to a= llowing access to functionality. An attacker can leverage this vulnerabilit=
y to create a denial-of-service condition on the system. Was ZDI-CAN-29041.=
2026-07-29 not yet calculated CVE-2026-5057 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-5057 ] Autel--MaxiCharger AC Elite Home Autel MaxiCharger A=
C Elite Home Software Update Improper Verification of Cryptographic Signatu=
re Arbitrary Code Execution Vulnerability. This vulnerability allows physic= ally present attackers to execute arbitrary code on affected installations =
of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not requi= red to exploit this vulnerability. The specific flaw exists within the hand= ling of software updates. The issue results from the lack of proper validat= ion of a user-supplied software update image. An attacker can leverage this=
vulnerability to execute code in the context of the device. Was ZDI-CAN-29= 062. 2026-07-29 not yet calculated CVE-2026-13305 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-13305 ] Autel--MaxiCharger AC Elite Home Autel MaxiCha= rger AC Elite Home USB Authentication Bypass Vulnerability. This vulnerabil= ity allows physically present attackers to bypass authentication on affecte=
d installations of Autel MaxiCharger AC Elite Home EV chargers. Authenticat= ion is not required to exploit this vulnerability. The specific flaw exists=
within the exposed USB interface. The issue results from the lack of authe= ntication prior to allowing access to functionality. An attacker can levera=
ge this vulnerability to bypass authentication on the system. Was ZDI-CAN-2= 9046. 2026-07-29 not yet calculated CVE-2026-13306 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-13306 ] Autel--MaxiCharger AC Elite Home Autel MaxiCh= arger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code Execution=
Vulnerability. This vulnerability allows physically present attackers to e= xecute arbitrary code on affected installations of Autel MaxiCharger AC Eli=
te Home EV chargers. Authentication is not required to exploit this vulnera= bility. The specific flaw exists within the handling of custom USB packets.=
The issue results from the lack of proper validation of the length of user= -supplied data prior to copying it to a fixed-length, heap-based buffer. An=
attacker can leverage this vulnerability to execute code in the context of=
the device. Was ZDI-CAN-29048. 2026-07-29 not yet calculated CVE-2026-1330=
7 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13307 ] Autel--MaxiCharger =
AC Elite Home Autel MaxiCharger AC Elite Home WebSockets Integer Underflow = Remote Code Execution Vulnerability. This vulnerability allows remote attac= kers to execute arbitrary code on affected installations of Autel MaxiCharg=
er AC Elite Home EV chargers. Authentication is not required to exploit thi=
s vulnerability. The specific flaw exists within the handling of WebSocket = messages related to the OCPP service. The issue results from the lack of pr= oper validation of user-supplied data, which can result in an integer under= flow before allocating a buffer. An attacker can leverage this vulnerabilit=
y to execute code in the context of the device. Was ZDI-CAN-29113. 2026-07-=
29 not yet calculated CVE-2026-13308 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-13308 ] Autel--MaxiCharger AC Elite Home Autel MaxiCharger AC Elite=
Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerabilit=
y. This vulnerability allows physically present attackers to execute arbitr= ary code on affected installations of Autel MaxiCharger AC Elite Home EV ch= argers. Authentication is not required to exploit this vulnerability. The s= pecific flaw exists within the handling of card responses via the NFC inter= face. A crafted card response can trigger an overflow of a fixed-length sta= ck-based buffer. An attacker can leverage this vulnerability to execute cod=
e in the context of the device. Was ZDI-CAN-29044. 2026-07-29 not yet calcu= lated CVE-2026-13309 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13309 ] = authlib--joserfc joserfc is a Python library that provides an implementatio=
n of several JSON Object Signing and Encryption (JOSE) standards. in versio=
ns 1.7.1 and prior, joserfc accepts JWTs with trailing padding (=3D=3D) whi=
ch are not conforming to the JOSE specifications. This leads to malleabilit=
y of the JWTs when consumed by joserfc. Depending on this application this = might or not be an issue. This could lead to bypass of token revocation or = anti-replay protection when implemented as a deny list of tokens or a deny = list of token hashes. Note that ECDSA JWS are always malleable because of t=
he malleability of ECDSA signatures (first test case in the code bellow). T= his makes a scheme which assumes that JWTs are not malleable brittle. Howev=
er for other signatures (or MAC) schemes it might make sense to assume non = malleability of the token. This issue has been fixed in version 1.7.2. 2026= -07-29 not yet calculated CVE-2026-62995 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-62995 ] Authora--Authora : Easy login with mobile number The Au= thora : Easy login with mobile number WordPress plugin before 1.7.7 does no=
t keep its one-time login code confidential, returning the code and a valid=
verification token in the response of an unauthenticated action, allowing = unauthenticated attackers to log in as any user whose registered mobile num= ber they know (including administrators) or to create arbitrary accounts. 2= 026-08-01 not yet calculated CVE-2026-14561 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-14561 ] axios--axios axios versions from 0.28.0 before 0.33.=
0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataTo= JSON (exposed as axios.formToJSON() and used internally when serializing Fo= rmData with Content-Type: application/json). When an application passes att= acker-controlled FormData field names, a field name with thousands of neste=
d bracket-delimited segments causes unbounded recursion in buildPath(), exh= austing the JavaScript call stack (RangeError: Maximum call stack size exce= eded) and causing denial of service for that request, or process terminatio=
n in applications without appropriate error handling. 2026-08-01 not yet ca= lculated CVE-2026-67312 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67312=
] axios--axios axios versions 0.28.0 and later contain uncontrolled recurs= ion in formDataToJSON when processing FormData field names with deeply nest=
ed bracket segments. Attackers can supply FormData with field names contain= ing thousands of nested brackets to exhaust the JavaScript call stack and t= rigger RangeError, causing request failure or process termination in applic= ations that do not handle the exception. 2026-08-01 not yet calculated CVE-= 2026-67313 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67313 ] axios--axi=
os axios versions >=3D1.15.2 and <1.18.0 contain prototype-pollution read-s= ide gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/h= elpers/resolveConfig.js). When an application is already affected by a sepa= rate prototype-pollution primitive and makes an axios request with an own a= uth object that omits the username and/or password properties, axios reads = the inherited Object.prototype.username and Object.prototype.password value=
s and uses them to construct an outbound 'Authorization: Basic ...' header.=
axios itself does not pollute prototypes. The practical impact is outbound=
request tampering: an attacker who controls the polluted prototype values = can inject attacker-chosen Basic auth credentials or replace an existing Au= thorization header. Credential disclosure is only possible under additional=
application-specific conditions. 2026-08-01 not yet calculated CVE-2026-67= 314 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67314 ] axios--axios axio=
s versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize = 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to=
0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to rou=
te requests through configured proxies, potentially exposing local services=
when the proxy can reach the destination. 2026-08-01 not yet calculated CV= E-2026-67315 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67315 ] axios--a= xios axios is vulnerable to read-side prototype-pollution gadgets that can = alter request construction when Object.prototype has already been polluted =
by a separate vulnerability or dependency. In the bodyless method aliases (= axios.get(), axios.delete(), axios.head(), axios.options()), inherited data=
is read via (config || {}).data before config normalization, causing an at= tacker-controlled body to be sent on requests that did not set one. Additio= nal low-level paths, only reachable when calling exported adapters/helpers = (e.g. lib/adapters/http.js, unsafe/helpers/resolveConfig.js) directly with = plain configs and no own proxy or paramsSerializer, can inherit polluted pr= oxy values (routing requests through an attacker-controlled proxy) or param= sSerializer values (attacker-controlled URL serialization). These low-level=
gadgets do not reproduce through normal high-level axios calls on 1.15.2+.=
The issue is fixed in axios 1.18.0 and 0.33.0. 2026-08-01 not yet calculat=
ed CVE-2026-67316 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67316 ] axi= os--axios axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength = for WHATWG ReadableStream request bodies in the fetch adapter when Content-= Length cannot be determined. Attackers can supply unknown-length stream dat=
a to bypass upload size limits and cause uncontrolled network egress or res= ource exhaustion. 2026-08-01 not yet calculated CVE-2026-67317 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-67317 ] axios--axios axios versions >=3D1= .13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength l= imit on streamed request bodies when requests are sent with httpVersion: 2.=
Because Node's HTTP/2 request API does not honor the maxBodyLength option = and axios's byte-counting stream wrapper is gated on maxRedirects =3D=3D=3D=
0, an attacker who controls a stream passed to axios can cause the applica= tion to transmit outbound data exceeding the configured finite maxBodyLengt=
h. Impact is limited to resource consumption and policy bypass (excess egre= ss, upstream quota consumption, limited availability); it does not enable c= ode execution, credential disclosure, or request-destination control. Calls=
using the default maxBodyLength: -1 and browser adapters are not affected.=
2026-08-01 not yet calculated CVE-2026-67318 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-67318 ] axios--axios axios before 0.33.0 (and 1.x before 1= .18.0) can consume inherited properties from nested request option objects = when the JavaScript process's Object.prototype has already been polluted by=
another component. While the top-level merged config uses a null prototype=
, nested plain objects such as auth and paramsSerializer are cloned into or= dinary objects and read without own-property checks. When an application pa= sses placeholder nested objects such as auth: {} or paramsSerializer: {}, i= nherited username/password values can cause silent injection of an Authoriz= ation: Basic header, and inherited encode/serialize values can alter query-= string serialization (full serializer replacement requires a function-value=
d pollution primitive). This is exploitable only in the presence of pre-exi= sting prototype pollution. 2026-08-01 not yet calculated CVE-2026-67319 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-67319 ] axios--axios axios in a = Node.js deployment using the HTTP adapter can route requests through an att= acker-controlled proxy. axios hardens merged request configuration by creat= ing a null-prototype object, but request interceptors run after the merge; =
a common immutable interceptor pattern such as {...config} or Object.assign= ({}, config) converts the hardened config back into a regular object. axios=
then dispatches that object without re-hardening it, and the Node HTTP ada= pter reads config.proxy through the prototype chain. If an attacker can pol= lute Object.prototype.proxy, affected requests can be routed through an att= acker-controlled proxy. For plaintext HTTP requests, the proxy can observe = Authorization headers, Basic auth from config.auth, method, absolute URL, H= ost, and request body, and can return its own response. This does not estab= lish browser impact or HTTPS header/body disclosure under normal TLS valida= tion. Affected versions are >=3D0.31.1 (fixed in 0.33.0) and >=3D1.15.2 (fi= xed in 1.18.0). 2026-08-01 not yet calculated CVE-2026-67320 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-67320 ] axios--axios axios versions 0.31.1 = before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit by= pass in toFormData.js when serializing objects with top-level keys ending i=
n '{}'. Attackers who control object keys and nested values passed to axios=
form or parameter serialization can trigger a RangeError from JSON.stringi= fy, causing denial of service in the affected request path. 2026-08-01 not = yet calculated CVE-2026-67321 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -67321 ] Axway--SecureTransport A Server-Side Template Injection (SSTI) vul= nerability was identified in the mail template functionality of the Axway S= ecureTransport product in version 5.5-20260326. This flaw allows an attacke=
r with admin privileges to inject arbitrary Java code expressions, which ar=
e executed server-side when the template is rendered (i.e., during email se= nding). Successful exploitation of this flaw allows an attacker to execute = arbitrary code on the server that results in full host compromise. This iss=
ue affects all Axway SecureTransport versions prior 5.5-20260528 update. 20= 26-07-29 not yet calculated CVE-2026-9177 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-9177 ] balbooa.com--Balbooa Forms component for Joomla Joomla = Extension - balbooa.com - Unauthenticated remote code execution in Balbooa = Forms < 2.4.3 - An insecure form processing logic allowed code execution fo=
r forms that include the signature field type. 2026-07-28 not yet calculate=
d CVE-2026-65880 [ https://www.cve.org/CVERecord?id=3DCVE-2026-65880 ] balb= ooa.com--Gridbox extension for Joomla Joomla Extension - balbooa.com - Priv= ilege Escalation in Gridbox < 2.20.2 - The registration method allows users=
provided usergroup IDs, allowing unauthenticated actors to register new ac= counts with administrative permissions. 2026-07-29 not yet calculated CVE-2= 026-65884 [ https://www.cve.org/CVERecord?id=3DCVE-2026-65884 ] balbooa.com= --Gridbox extension for Joomla Joomla Extension - balbooa.com - Authenticat=
ed arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows a= uthenticated attackers to upload arbitrary files. Turns into an authenticat=
ed RCE if combined with CVE-2026-65884 as the required account can be creat=
ed by the attacker. 2026-07-29 not yet calculated CVE-2026-65885 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-65885 ] balbooa.com--Gridbox extension = for Joomla Joomla Extension - balbooa.com - Unauthenticated arbitrary file = read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attacker=
s to view arbitrary files. 2026-07-29 not yet calculated CVE-2026-65886 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-65886 ] balbooa.com--Gridbox ext= ension for Joomla Joomla Extension - balbooa.com - Unauthenticated arbitrar=
y password reset in Gridbox < 2.20.2 - The resetPassword method allows acto=
rs to reset any user password, allowing to login and act as these users - e= xcluding super admins. 2026-07-29 not yet calculated CVE-2026-65887 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-65887 ] balbooa.com--Gridbox extensi=
on for Joomla Joomla Extension - balbooa.com - Account takeover vulnerabili=
ty in Gridbox < 2.20.2 - The socialLogin method allows actors to login as a=
ny given user on the target site. 2026-07-29 not yet calculated CVE-2026-65= 888 [ https://www.cve.org/CVERecord?id=3DCVE-2026-65888 ] balbooa.com--Grid= box extension for Joomla Joomla Extension - balbooa.com - Unauthenticated r= ecursive directory deletion < 2.20.2 - The generateNewApp method allows act= ors to recursively delete directories. 2026-07-29 not yet calculated CVE-20= 26-65889 [ https://www.cve.org/CVERecord?id=3DCVE-2026-65889 ] balbooa.com-= -Gridbox extension for Joomla Joomla Extension - balbooa.com - Unauthentica= ted SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthe= nticated actors to inject SQL in queries. 2026-07-29 not yet calculated CVE= -2026-65890 [ https://www.cve.org/CVERecord?id=3DCVE-2026-65890 ] balbooa.c= om--Gridbox extension for Joomla Joomla Extension - balbooa.com - Various C= SRF vectors in the admin interface in Gridbox < 2.20.2 2026-07-29 not yet c= alculated CVE-2026-65947 [ https://www.cve.org/CVERecord?id=3DCVE-2026-6594=
7 ] balbooa.com--Gridbox extension for Joomla Joomla Extension - balbooa.co=
m - Payment bypass in Gridbox < 2.20.2 2026-07-29 not yet calculated CVE-20= 26-66488 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66488 ] balbooa.com-= -Gridbox extension for Joomla Joomla Extension - balbooa.com - Various unau= thenticated file system disclosure in Gridbox < 2.20.2 2026-07-29 not yet c= alculated CVE-2026-66489 [ https://www.cve.org/CVERecord?id=3DCVE-2026-6648=
9 ] balbooa.com--Gridbox extension for Joomla Joomla Extension - balbooa.co=
m - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2 20= 26-07-29 not yet calculated CVE-2026-66490 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-66490 ] beaugunderson--ip-address ip-address is a library for=
parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 1= 0.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IP= v4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies an address by=
matching it against a table of known IPv6 special-use prefixes, returning = Global unicast when nothing matches. That table had no entry for the IPv4-m= apped range (::ffff:0:0/96), so every mapped address fell through to Global=
unicast; NAT64 addresses matched their own NAT64 labels. The boolean check=
s isLoopback, isUnspecified, and isMulticast compared getType() against a f= ixed label and so returned false, while isLinkLocal and isULA checked only = the native IPv6 ranges. The library already exposed isMapped4() and to4(), = but did not apply them inside these checks, so a mapped or NAT64 address wa=
s never normalized to its embedded IPv4 address before classification. For = IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclass= ification is reachable on any dual-stack host. For NAT64, the classificatio=
n bypass is unconditional but end-to-end reachability additionally requires=
a NAT64/DNS64 gateway in the deployment network.This issue has been fixed =
in version 10.2.1. 2026-07-27 not yet calculated CVE-2026-54272 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-54272 ] better-auth--better-auth better-= auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability =
in the multi-session plugin's /sign-out after-hook, which trusts raw multi-= session cookies and forwards extracted values to internalAdapter.deleteSess= ions without verifying the cookie signature (e.g., via getSignedCookie). An=
attacker can supply a forged _multi-* cookie to trigger deletion of arbitr= ary session tokens. 2026-08-01 not yet calculated CVE-2025-71402 [ https://= www.cve.org/CVERecord?id=3DCVE-2025-71402 ] better-auth--better-auth better= -auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-sit=
e scripting (XSS) vulnerability on the /api/auth/error page, where the valu=
e of the 'error' URL parameter is reflected as HTML without proper neutrali= zation. An attacker who coerces a user into visiting a specially-crafted UR=
L can execute arbitrary JavaScript in the context of the user's browser. Th=
e issue is fixed in version 1.1.16. 2026-08-01 not yet calculated CVE-2025-= 71404 [ https://www.cve.org/CVERecord?id=3DCVE-2025-71404 ] Bit Form--Bit F= orm The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its=
conversational-form display settings before rendering it on the public-fac= ing form, allowing high-privilege users (such as administrators, who do not=
hold the unfiltered_html capability on multisite) to store JavaScript that=
executes in the browser of any visitor who views the form. 2026-08-01 not = yet calculated CVE-2025-15669 [ https://www.cve.org/CVERecord?id=3DCVE-2025= -15669 ] Bit Form--Bit Form The Bit Form WordPress plugin before 3.1.2 does=
not enforce a form's active/published status on its public form-submission=
handlers, allowing unauthenticated users to submit entries to, and fire th=
e configured workflows (such as email notifications) of forms the site owne=
r has deactivated or unpublished. 2026-07-30 not yet calculated CVE-2026-15= 054 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15054 ] Black Duck--Cover= ity Connect A Spring Security authentication and authorization bypass exist=
s in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenti= cated malicious threat actor that can send a specially crafted HTTP request=
is able to bypass authentication and authorization controls on certain API=
endpoints to access data within Coverity. 2026-07-29 not yet calculated CV= E-2026-8338 [ https://www.cve.org/CVERecord?id=3DCVE-2026-8338 ] Black Duck= --Coverity Connect A SQL injection vulnerability exists in the Coverity Con= nect SOAP API for versions between 2024.6.0 and 2026.3.0 (inclusive). A mal= icious, authenticated threat actor who sends a specially crafted payload ca=
n achieve full read access to database contents and other unauthorized comm= ands. 2026-07-29 not yet calculated CVE-2026-8339 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-8339 ] BlackBerry--UEM Improper Neutralization of Inpu=
t During Web Page Generation vulnerability in BlackBerry UEM Management Con= sole of BlackBerry UEM allows Cross-Site Scripting (XSS). This issue affect=
s UEM: 12.23.0 QF8 or earlier. 2026-07-28 not yet calculated CVE-2026-18084=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-18084 ] BlackBerry--UEM An I= mproper Input Validation in the BlackBerry UEM=C2=A0Management=C2=A0Console= =C2=A0of=C2=A0BlackBerry UEM=C2=A012.23.0 QF8 and earlier allows Arbitrary = File Download and Potential Denial of Service. 2026-07-28 not yet calculate=
d CVE-2026-18085 [ https://www.cve.org/CVERecord?id=3DCVE-2026-18085 ] Book= ing for Appointments and Events Calendar--Booking for Appointments and Even=
ts Calendar The Booking for Appointments and Events Calendar WordPress plug=
in before 2.4.4 does not restrict which fields can be written through its c= ustomer import, allowing a user with the Amelia Manager role to modify arbi= trary columns of any stored user record by supplying them in the import req= uest. 2026-08-01 not yet calculated CVE-2026-14214 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-14214 ] bookingpress-appointment-booking-pro--booking= press-appointment-booking-pro The bookingpress-appointment-booking-pro Word= Press plugin before 5.7.3 does not correctly invoke its REST permission cal= lback, leaving every route in one of its API namespaces reachable without a= uthentication and allowing unauthenticated attackers to read customer booki=
ng data and modify other users' bookings. 2026-07-27 not yet calculated CVE= -2026-9830 [ https://www.cve.org/CVERecord?id=3DCVE-2026-9830 ] Brizy--Briz=
y The Brizy WordPress plugin before 2.8.18 does not properly verify authori= zation on a request handler before returning post content, allowing users w= ith the Contributor role or higher to read the content of arbitrary posts, = including other users' private, pending, and draft posts. 2026-08-01 not ye=
t calculated CVE-2026-14195 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1= 4195 ] Buckaroo Woocommerce Payments Plugin--Buckaroo Woocommerce Payments = Plugin The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9=
.0 does not perform any capability check or nonce validation on an AJAX act= ion that processes payment capture refunds, allowing any authenticated user=
, including Subscribers, to trigger refunds against captured orders. 2026-0= 8-01 not yet calculated CVE-2026-13329 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-13329 ] BuddyPress--BuddyPress The BuddyPress WordPress plugin = before 14.5.0 does not properly enforce authorization on its private messag= ing endpoints, allowing any authenticated user (Subscriber+) to read, modif=
y, or delete other users' private messages. 2026-07-31 not yet calculated C= VE-2026-8155 [ https://www.cve.org/CVERecord?id=3DCVE-2026-8155 ] Builderal=
l for WordPress--Builderall for WordPress The Builderall for WordPress plug=
in before 3.0.2 does not bind the state value of its public OAuth authentic= ation routes to the initiating user session, allowing unauthenticated attac= kers to complete the connection flow and overwrite the stored third-party i= ntegration access token. A durable overwrite requires the site to already b=
e connected to a paid account. 2026-08-01 not yet calculated CVE-2026-11882=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-11882 ] Calendar--Calendar T=
he Calendar WordPress plugin before 1.3.18 does not properly escape a user-= supplied event field before outputting it inside an HTML attribute on a pub= lic-facing page, allowing users with the Contributor role to inject arbitra=
ry JavaScript that executes in the browser of anyone viewing the calendar. = 2026-07-27 not yet calculated CVE-2026-14827 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-14827 ] CasfID Servicios Tecnolgicos--NFC Wristbands Use of=
an insecure cryptographic algorithm in the cashless payment system using N=
FC wristbands from CasfID Servicios Tecnol=C3=83=C2=B3gicos S.L.U. (version=
used at Resurrection Fest 2025), which employs cards based on MIFARE Class=
ic technology (FM11RF08S). The cryptographic weakness of the authentication=
algorithm allows an attacker to retrieve access keys using techniques know=
n as Backdoored Nested Attack, read the wristband's entire contents, and cl= one its credentials onto a compatible rewritable card. Exploitation of this=
vulnerability could enable the impersonation of other attendees, the fraud= ulent use of the balance associated with their wristbands, and financial lo= sses for both the affected users and the event organizers. 2026-07-28 not y=
et calculated CVE-2026-4648 [ https://www.cve.org/CVERecord?id=3DCVE-2026-4= 648 ] ccyl13--Pentestify Server-Side Request Forgery in the PDF export comp= onent in maalfer Pentestify before 1.1.0 allows authenticated users to caus=
e outbound HTTP GET requests from the server to arbitrary attacker-chosen d= estinations via unvalidated URLs stored in the finding images field or the = report client_logo field, which the server-side headless browser fetches wh= ile rendering the report. 2026-07-31 not yet calculated CVE-2026-59231 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-59231 ] CERT.PL--MWDB Core MWDB C= ore versions >=3D2.2.0 and <2.19.0 contain a missing authorization vulnerab= ility in the Remote Instances proxy API. The proxy API does not verify auth= entication for incoming requests, allowing an unauthenticated remote attack=
er to send arbitrary requests to a remote MWDB instance using the identity = and permissions associated with the configured API key. This can result in = unauthorized actions being performed on the remote instance as if executed =
by the user whose API key was used to set up the remote instance. The vulne= rability is limited to deployments where Remote Instances have been configu= red.This issue has been fixed in version=C2=A02.19.0 2026-07-29 not yet cal= culated CVE-2026-66723 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66723 =
] CERT.PL--MWDB Core MWDB Core versions >=3D2.0.0 and <2.19.0 contain a mis= sing authorization vulnerability in the deprecated config and blob upload e= ndpoints. These endpoints accept the undocumented POST method, which bypass=
es the capability checks applied to the documented PUT method. This allows = any authenticated user without the adding_configs or adding_blobs capabilit= ies to upload config and text blob objects to the system. The impact is lim= ited to adding new config and blob objects. This issue has been fixed in ve= rsion 2.19.0 2026-07-29 not yet calculated CVE-2026-66724 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-66724 ] Charitable--Charitable The Charitable = WordPress plugin before 1.8.5.3 does not sanitise and escape one of its cam= paign image text fields before outputting it in an HTML attribute, allowing=
users with a high-privilege campaign-management role to perform Stored Cro= ss-Site Scripting attacks that execute on the front-end campaign page. 2026= -08-02 not yet calculated CVE-2025-15675 [ https://www.cve.org/CVERecord?id= =3DCVE-2025-15675 ] Chat On --Chat On Desk Order Notifications The Chat On = Desk Order Notifications WordPress plugin before 1.0.9 does not verify that=
the one-time password has been validated before processing a password-rese=
t request, allowing unauthenticated attackers to reset the password of arbi= trary users, including administrators, and take over their accounts when SM=
S one-time-password password reset is enabled. 2026-08-01 not yet calculate=
d CVE-2026-14309 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14309 ] Chec=
k & Log Email--Check & Log Email The Check & Log Email WordPress plugin bef= ore 2.0.15 does not properly sanitize and escape parameters before using th=
em in SQL queries, allowing users with administrator privileges to perform = SQL injection attacks. 2026-07-31 not yet calculated CVE-2026-14554 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-14554 ] Checkmk GmbH--Checkmk Missin=
g authorization in Checkmk <2.5.0p10, <2.4.0p35, <2.3.0p49, and 2.2.0 (EOL)=
allows an authenticated user lacking the "Edit foreign Reports" permission=
to modify reports owned by other users. 2026-07-31 not yet calculated CVE-= 2026-15227 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15227 ] Clever Meg=
a Menu for Visual Composer--Clever Mega Menu for Visual Composer The Clever=
Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perf= orm a nonce or capability check in an AJAX action that updates navigation m= enu item metadata, allowing any authenticated user, including Subscribers, =
to overwrite menu item content and settings that are rendered in the site's=
public navigation. 2026-08-02 not yet calculated CVE-2026-11872 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-11872 ] CleverTap--Web SDK CleverTap We=
b SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application = does not sanitize untrusted data received via window.postMessage before inj= ecting it into the page DOM. An attacker can craft a malicious message that=
, when processed by renderCustomHtml, results in execution of arbitrary Jav= aScript in the context of the hosting site. 2026-07-30 not yet calculated C= VE-2025-51684 [ https://www.cve.org/CVERecord?id=3DCVE-2025-51684 ] ClickHo= use--ClickHouse SQL Injection vulnerability in ClickHouse Server Versions <= =3D 26.3.9.8 allows a remote attacker to execute arbitrary code via the cre= ate dictionaries function. 2026-07-29 not yet calculated CVE-2026-51992 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-51992 ] Clover Payment Gateway b=
y Zaytech for WooCommerce--Clover Payment Gateway by Zaytech for WooCommerc=
e The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin be= fore 1.3.6 does not verify that an approved external payment record actuall=
y belongs to the WooCommerce order being completed, nor that the paid amoun=
t matches the order total, allowing unauthenticated users to mark arbitrary=
orders as paid by replaying a single genuinely-approved payment reference = (for example one obtained from their own minimal purchase). 2026-07-27 not = yet calculated CVE-2026-12493 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -12493 ] code-projects--Blood System 1.0 code-projects Blood System 1.0 is = vulnerable to Cross Site Scripting (XSS) in /don.php via the city field. 20= 26-07-30 not yet calculated CVE-2025-65342 [ https://www.cve.org/CVERecord?= id=3DCVE-2025-65342 ] CodeAstro--Membership Management System CodeAstro Mem= bership Management System 1.0 is vulnerable to SQL Injection in /print_memb= ership_card.php?id=3D1. 2026-07-30 not yet calculated CVE-2025-69930 [ http= s://www.cve.org/CVERecord?id=3DCVE-2025-69930 ] CodeAstro--Membership Manag= ement System CodeAstro Membership Management System 1.0 is vulnerable to SQ=
L Injection in /delete_membership.php?id=3D1. 2026-07-30 not yet calculated=
CVE-2025-69931 [ https://www.cve.org/CVERecord?id=3DCVE-2025-69931 ] CodeA= stro--Membership Management System CodeAstro Membership Management System 1=
.0 is vulnerable to SQL Injection in /memberProfile.php?id=3D1. 2026-07-30 = not yet calculated CVE-2025-69933 [ https://www.cve.org/CVERecord?id=3DCVE-= 2025-69933 ] CodeAstro--Membership Management System CodeAstro Membership M= anagement System 1.0 is vulnerable to SQL Injection in /delete_members.php?= id=3D1. 2026-07-30 not yet calculated CVE-2025-69934 [ https://www.cve.org/= CVERecord?id=3DCVE-2025-69934 ] CodeAstro--Membership Management System Cod= eAstro Membership Management System 1.0 is vulnerale to SQL Injection in th=
e report.php and revenue_report.php via the fromDate parameter. 2026-07-30 = not yet calculated CVE-2025-69935 [ https://www.cve.org/CVERecord?id=3DCVE-= 2025-69935 ] CodeAstro--Membership Management System CodeAstro Membership M= anagement System 1.0 is vulnerable to SQL Injection in /edit_member.php?id= =3D1. 2026-07-30 not yet calculated CVE-2025-69936 [ https://www.cve.org/CV= ERecord?id=3DCVE-2025-69936 ] CodeAstro--Membership Management System CodeA= stro Membership Management System 1.0 is vulnerable to SQL Injection in the=
edit_type.php endpoint via the Parameter id. 2026-07-30 not yet calculated=
CVE-2025-69937 [ https://www.cve.org/CVERecord?id=3DCVE-2025-69937 ] CodeA= stro--Membership Management System CodeAstro Membership Management System 1=
.0 is vulnerable to SQL Injection in renew.php via the parameter membership= Type. 2026-07-30 not yet calculated CVE-2025-69938 [ https://www.cve.org/CV= ERecord?id=3DCVE-2025-69938 ] Codeless Page Builder--Codeless Page Builder = The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize =
or validate a shortcode attribute before using it as an HTML tag name when = rendering content, allowing users with contributor-level access and above t=
o inject arbitrary HTML and JavaScript that executes in the session of any = higher-privileged user (such as an administrator) who views the content. 20= 26-08-01 not yet calculated CVE-2026-15234 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-15234 ] Contact Form 7--Contact Form 7 The Contact Form 7 Wor= dPress plugin before 2.5 does not validate the host of a user-supplied retu=
rn URL before using it as the success and cancel redirect targets of a Stri=
pe checkout, allowing an unauthenticated attacker to redirect a victim, via=
a crafted link, to an arbitrary external site after the checkout flow. 202= 6-07-27 not yet calculated CVE-2026-14236 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-14236 ] containers--fuse-overlayfs fuse-overlayfs is an implem= entation of overlayfs in FUSE for rootless containers. Prior to 1.17, the r= elease-1.x C branch preserves SUID and SGID mode bits in main.c during open= (O_TRUNC) and truncate handling on a copied-up file, allowing a low-privile= ged process to leave the upper-layer file with mode 4777. This issue is fix=
ed in version 1.17. 2026-07-29 not yet calculated CVE-2026-52791 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-52791 ] coturn--coturn Coturn is a free=
open source implementation of TURN and STUN Server. From 4.5.2 through 4.1= 4.0, when Coturn is started with --acme-redirect <URL> and exposes a plaint= ext-TCP listener, an unauthenticated remote client can send a single ordina=
ry HTTP GET request and receive a 301 response whose Location header contai=
ns up to ~870 bytes of adjacent process heap memory. The leaked region is a=
recycled network receive buffer that is reused without being zeroed, so on=
a busy server it can contain data from other clients' requests (TURN crede= ntials, OAuth tokens, relayed payloads). Root cause is a signed=C3=A2=E2=80= =A0=E2=80=99unsigned conversion. This issue is fixed in version 4.15.0. 202= 6-07-31 not yet calculated CVE-2026-62959 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-62959 ] CP-Plus--EZ-P21 IP Camera This vulnerability exists in=
CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the f= irmware. An attacker with physical access could exploit this vulnerability =
by placing arbitrary code on removable media and triggering their execution=
through the debug mechanism. Successful exploitation of this vulnerability=
could allow an attacker to execute arbitrary code with elevated privileges=
on the targeted device. 2026-07-27 not yet calculated CVE-2026-65893 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-65893 ] CP-Plus--EZ-P21 IP Camera = This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authe= ntication of HTTP endpoints. A remote attacker could exploit this vulnerabi= lity by conducting brute-force attacks against HTTP endpoint on the targete=
d device. Successful exploitation of this vulnerability could allow an atta= cker to gain unauthorized access to live video snapshots from the targeted = device. 2026-07-27 not yet calculated CVE-2026-65894 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-65894 ] Cudy--Cudy TR1200 v2.4.15, TR3000 v2.4.21, = WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.= 19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command=
injection vulnerability in the system.setclock interface. This vulnerabili=
ty allows attackers to execute arbitrary commands as root via a crafted inp= ut. 2026-07-31 not yet calculated CVE-2026-38708 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-38708 ] Cudy--Cudy TR1200 v2.4.15, TR3000 v2.4.21, WR30=
0 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, = WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command inj= ection vulnerability in the net.set_wan interface. This vulnerability allow=
s attackers to execute arbitrary commands as root via a crafted input. 2026= -07-30 not yet calculated CVE-2026-38709 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-38709 ] Cudy--Cudy TR1200 v2.4.15 and TR3000 v2.4.21 were disco= vered to contain a command injection vulnerability in the system.setclock i= nterface. This vulnerability allows attackers to execute arbitrary commands=
as root via a crafted input. 2026-07-31 not yet calculated CVE-2026-38710 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-38710 ] Cudy--Cudy TR1200 v2.= 4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500=
v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovere=
d to contain a command injection vulnerability in the system.upgrade_check = interface. This vulnerability allows attackers to execute arbitrary command=
s as root via a crafted input. 2026-07-31 not yet calculated CVE-2026-38711=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-38711 ] Cudy--Cudy TR1200 v2= .4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR150=
0 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discover=
ed to contain a command injection vulnerability in the ipsec_conn interface=
. This vulnerability allows attackers to execute arbitrary commands as root=
via a crafted input. 2026-07-31 not yet calculated CVE-2026-38713 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-38713 ] Custom Fields Account Registr= ation For Woocommerce--Custom Fields Account Registration For Woocommerce T=
he Custom Fields Account Registration For Woocommerce WordPress plugin befo=
re 1.4 does not prevent its custom registration fields from writing to the = user capabilities meta key on sites that use a non-default database table p= refix, so an unauthenticated user who registers an account can be granted t=
he administrator role when a correspondingly named field has been configure=
d. 2026-07-27 not yet calculated CVE-2026-13152 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-13152 ] Customer Switching--Customer Switching The Custo= mer Switching WordPress plugin before 2.1.3 does not securely bind an activ=
e user-switching session to the operator who initiated it, allowing a lower= -privileged account that an operator is currently switched into to be resol= ved as that operator and to switch into any permitted account, including an=
administrator, resulting in full account takeover. 2026-07-30 not yet calc= ulated CVE-2026-15240 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15240 ]=
Database--Database for Contact Form 7, WPforms, Elementor forms The Databa=
se for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5=
.3 does not properly sanitise and escape a parameter before reflecting it b= ack in an admin page, leading to a Reflected Cross-Site Scripting which cou=
ld be used against high privilege users such as admin. 2026-07-28 not yet c= alculated CVE-2026-14870 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1487=
0 ] DaveGamble--cJSON cJSON library is vulnerable to an integer overflow in=
the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape= _characters counter, a 32-bit size_t, can wrap around when processing strin=
gs containing approximately 858,993,460 or more control characters, causing=
the output buffer to be allocated based on an underestimated length. When = cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent w= rite loop overflows the heap allocation. An attacker supplying a crafted JS=
ON string to an application using cJSON on a 32-bit platform can cause a he=
ap buffer overflow, potentially leading to remote code execution, informati=
on disclosure, or denial of service. Because project creator contact attemp=
ts were unsuccessful, the vulnerability has only been confirmed in version = 1.7.19 but may also affect other versions. 2026-07-27 not yet calculated CV= E-2026-16554 [ https://www.cve.org/CVERecord?id=3DCVE-2026-16554 ] ddnexus-= -pagy Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, = Pagy::I18n.locale=3D in gem/lib/pagy/modules/i18n/i18n.rb stored locale val= ues verbatim and later used them as <locale>.yml path components, allowing = untrusted params[:locale] values with absolute paths or ../ sequences to cr= eate a file existence and readability oracle for YAML files. This issue is = fixed in version 43.5.6. 2026-07-28 not yet calculated CVE-2026-54659 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-54659 ] DedeCMS--DeceCMS SQL injec= tion vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain=
sensitive information via the sqlquery parameter of the sys_sql_query.php = component 2026-07-27 not yet calculated CVE-2026-51077 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-51077 ] DedeCMS--DedeCMS An issue in Dede CMS v.5= .7.118 allows a remote attacker to obtain sensitive information via the str=
parameter of the file_manage_control.php component 2026-07-27 not yet calc= ulated CVE-2026-51078 [ https://www.cve.org/CVERecord?id=3DCVE-2026-51078 ]=
Demi--Demi The Demi WordPress plugin before 0.0.7 stores its full-site bac= kup archives in a publicly accessible location under a predictable filename=
and without access protection, allowing unauthenticated attackers to downl= oad complete backups including the site database and its user password hash= es. 2026-07-31 not yet calculated CVE-2026-14333 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-14333 ] Develar--app-builder A vulnerability in the `zi= px.Unzip` extraction routine of Develar's app-builder allows an attacker to=
overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalizat= ion Collision combined with symlink following behavior. APFS treats certain=
Unicode equivalent filenames as identical (e.g., =C3=83=C5=B8 =C3=A2=E2=80= =A0=E2=80=9D ss), while app builder performs no canonical normalization bef= ore validating or writing paths. As a result, a crafted ZIP archive contain= ing: =C2=A2 a symlink entry named ss pointing to a target file, and =C2=A2 =
a regular file named =C3=83=C5=B8 containing attacker controlled data, will=
cause the second write to follow the symlink and overwrite the target file=
. 2026-07-29 not yet calculated CVE-2026-13723 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-13723 ] Devolutions--Password Manager Improper certificat=
e validation in the Devolutions Server connection handling in Devolutions P= assword Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an=
adjacent-network attacker to intercept and modify sensitive information vi=
a a forged TLS certificate. 2026-07-29 not yet calculated CVE-2026-8497 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-8497 ] Devolutions--Server Impro= per access control in the role membership management endpoint in Devolution=
s Server allows an authenticated non-administrative user holding the user-g= roup membership management permission to escalate privileges to administrat=
or via a crafted API request. This issue affects : * Devolutions Server 202= 6.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier 20= 26-07-27 not yet calculated CVE-2026-17568 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-17568 ] Devolutions--Server Improper access control in the Ne= tBox synchronizer in Devolutions Server allows an authenticated user with v= iew-only permission on an entry to obtain a stored API token via the partia=
l connection endpoint. This issue affects : * Devolutions Server 2026.2.4.0=
through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier 2026-07-2=
7 not yet calculated CVE-2026-17569 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-17569 ] Devolutions--Server Improper access control in the PAM passw= ord history endpoints in Devolutions Server allows an authenticated low-pri= vileged user to disclose plaintext credential secrets via crafted API reque= sts. This issue affects : * Devolutions Server 2026.2.4.0 through 2026.2.12=
.0 * Devolutions Server 2026.1.23.0 and earlier 2026-07-27 not yet calculat=
ed CVE-2026-17570 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17570 ] Dir= ect Payments for WooCommerce--Direct Payments for WooCommerce The Direct Pa= yments for WooCommerce WordPress plugin before 2.5.3 does not verify that t=
he requester owns the targeted WooCommerce order in several unauthenticated=
AJAX handlers before changing its status and overwriting its payment metad= ata, allowing unauthenticated attackers to tamper with other customers' ord= ers, including forging a "payment sent" state, overwriting the payment-meth=
od label, and attaching forged payment-proof files. 2026-08-01 not yet calc= ulated CVE-2026-12966 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12966 ]=
dnsmgr--dnsmgr v.2.15 An issue in dnsmgr v.2.15 and before allows a local = attacker to execute arbitrary code via the ping function of the CheckUils.p=
hp file 2026-07-30 not yet calculated CVE-2026-35847 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-35847 ] Document Gallery--Document Gallery The Docu= ment Gallery WordPress plugin before 5.1.1 does not properly sanitise and e= scape user input before reflecting it back in the response of an unauthenti= cated AJAX action, leading to a Reflected Cross-Site Scripting vulnerabilit=
y which can be exploited against unauthenticated users. 2026-07-27 not yet = calculated CVE-2026-12982 [ https://www.cve.org/CVERecord?id=3DCVE-2026-129=
82 ] dompdf--dompdf Dompdf is an HTML to PDF converter for PHP. In versions=
3.15 and prior, the=C2=A0validateLocalUri()=C2=A0method enforces chroot bo= undaries with a=C2=A0strpos() prefix check after normalizing paths with =C2= =A0realpath()=C2=A0. Because normalization strips the trailing directory se= parator from =C2=A0$chrootPath=C2=A0, the check only verifies that =C2=A0$c= hrootPath=C2=A0 is a string prefix of=C2=A0$realfile, so a chroot of =C2=A0= /var/www=C2=A0 also matches sibling directories like /var/www2=C2=A0, /var/= www-admin, or=C2=A0/var/www_backup. An attacker who controls part of the re= ndered HTML could exploit this to escape the chroot and read sensitive file=
s outside the allowed directory. This issue has been fixed in version 3.16.=
2026-07-28 not yet calculated CVE-2026-55554 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-55554 ] dompdf--dompdf Dompdf is an HTML to PDF converter = for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle = attack through the manipulation of the CSS @font-face directive. By providi=
ng malicious HTML that references local files via the file:// protocol repe= atedly, an attacker can trigger PHP memory exhaustion. Because Dompdf behav=
es differently depending on whether a referenced local file exists (an exis= ting file is processed repeatedly until it triggers an "Allowed memory size=
exhausted" crash, whereas a missing file fails fast or is ignored and neve=
r hits the memory limit), an attacker can use this observable discrepancy a=
s an oracle to enumerate sensitive files on the server regardless of CHROOT=
restrictions. Exploitation requires the attacker to supply unrestricted or=
unsanitized HTML in a request that permits large data, plus a configuratio=
n where Dompdf's memory limit is low enough to be exhausted (with =C2=A0$_d= ompdf_show_warnings=3Dtrue=C2=A0 making the overflow easier to reach). This=
issue has been fixed in version 3.16. 2026-07-28 not yet calculated CVE-20= 26-55555 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55555 ] dompdf--domp=
df Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, = aAn attacker who controls the HTML input can bypass this restriction by emb= edding a target file path inside an SVG image delivered through a =C2=A0dat= a:=C2=A0 URI, because dompdf processes the SVG twice and the second pass do=
es not enforce the same protections as the first. When rendering, dompdf ha= nds the SVG to the separate =C2=A0php-svg-lib=C2=A0 library with external r= eferences forced on, and that library has no knowledge of the chroot direct= ory, blocks only the =C2=A0phar://=C2=A0 scheme, and ultimately reads the r= eferenced file with no path or protocol validation. This lets an external, = unauthenticated attacker read arbitrary image files from the server's file = system in the default configuration. This issue has been fixed in version 3= .16. 2026-07-28 not yet calculated CVE-2026-56722 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-56722 ] dompdf--dompdf Dompdf is an HTML to PDF conver= ter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF= -compatible PNG based only on its declared header dimensions and never boun=
ds width =C3=83=E2=80=94 height before the image is converted through GD. A=
58-byte BMP whose header declares e.g. 6000=C3=83=E2=80=946000 is accepted=
and later drives imagecreatetruecolor($width, $height) (and PHP's native B=
MP decoder) to allocate the full pixel canvas. A payload can fit in a singl=
e HTTP request: the BMP can be inlined as a data:image/bmp;base64, URI insi=
de attacker-controlled HTML, so no upload, no remote fetch, and no chroot-r= eachable file is required. I measured a 169-byte request driving a dompdf r= ender to ~412 MB peak RSS and ~4.8 s of CPU/wall time, versus ~34 MB for an=
identically-sized benign request - roughly a 12=C3=83=E2=80=94 memory ampl= ification per request, repeatable and unauthenticated. This issue has been = fixed in version 3.16. 2026-07-28 not yet calculated CVE-2026-59941 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-59941 ] dompdf--dompdf Dompdf is an = HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a = Denial of Service (DoS) attack via resource exhaustion. An attacker can cra=
sh the PHP process by providing a specially crafted HTML document containin=
g a single image with massive dimensions (e.g., 30,000x30,000 pixels). Whil=
e Dompdf implements internal checks to validate image dimensions, these can=
be bypassed by using a high-entropy image (such as random noise) encoded i=
n Base64 and wrapped in specific CSS containers. The vulnerability exists b= ecause the dimension validation happens early, but the resource allocation = for calculating the object's bounding box and internal buffers during the r= endering phase does not strictly limit the cumulative CPU time or memory us= age for a single object that has passed the initial check. An unauthenticat=
ed remote attacker can cause a complete Denial of Service on the web server=
by submitting a crafted HTML string. This affects any application that all= ows users to provide HTML content or URLs that are subsequently converted t=
o PDF using Dompdf. This issue has been fixed in version 3.16. 2026-07-28 n=
ot yet calculated CVE-2026-59942 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-59942 ] dompdf--dompdf Dompdf is an HTML to PDF converter for PHP. In v= ersions 3.15 and prior, if a malicious actor can supply unrestricted conten=
t for rendering by Dompdf they can utilize the SVG rendering functionality =
to leak filesystem information when rendering PDF files using image referen= ces within a data-URI encoded SVG document. Using an <image> element inside=
a data-URI embedded SVG, an attacker can attempt to embed other files via = the href or xlink:href attributes. When processing a file that does not exi=
st (e.g. file:///DOESNOTEXIST), dompdf behaves differently than it does whe=
n accessing a file or directory that actually exists on the filesystem. Thi=
s issue has been fixed in version 3.16. 2026-07-28 not yet calculated CVE-2= 026-59943 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59943 ] Download Ma= nager--Download Manager The Download Manager WordPress plugin before 3.3.62=
does not bind its temporary download token to the requesting session nor e= xpire it promptly, making the token a long-lived, multi-use, portable beare=
r token, so that an attacker who obtains one leaked download key can repeat= edly download a role- or password-protected package file without authorizat= ion. 2026-07-27 not yet calculated CVE-2026-14235 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-14235 ] Download Manager--Download Manager The Downloa=
d Manager WordPress plugin before 3.3.66 does not properly escape a package=
's title before outputting it in the front-end package templates, allowing = users with the Author role or above to store a title that results in arbitr= ary JavaScript execution in the browser of any user, including unauthentica= ted visitors, who views a page displaying the package. 2026-08-01 not yet c= alculated CVE-2026-14292 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1429=
2 ] DriveLock--DriveLock DriveLock Directory Traversal Information Disclosu=
re Vulnerability. This vulnerability allows remote attackers to disclose se= nsitive information on affected installations of DriveLock. Authentication =
is not required to exploit this vulnerability. The specific flaw exists wit= hin the web service, which listens on TCP port 4568 by default. The issue r= esults from the lack of proper validation of a user-supplied path prior to = using it in file operations. An attacker can leverage this vulnerability to=
disclose information in the context of the service account. Was ZDI-CAN-28= 746. 2026-07-29 not yet calculated CVE-2026-5487 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-5487 ] DriveLock--DriveLock DriveLock Directory Travers=
al Information Disclosure Vulnerability. This vulnerability allows remote a= ttackers to disclose sensitive information on affected installations of Dri= veLock. Authentication is not required to exploit this vulnerability. The s= pecific flaw exists within the web service, which listens on TCP port 4568 =
by default. The issue results from the lack of proper validation of a user-= supplied path prior to using it in file operations. An attacker can leverag=
e this vulnerability to disclose information in the context of the service = account. Was ZDI-CAN-28719. 2026-07-29 not yet calculated CVE-2026-5489 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-5489 ] DriveLock--DriveLock Driv= eLock SQL Injection Privilege Escalation Vulnerability. This vulnerability = allows remote attackers to escalate privileges on affected installations of=
DriveLock. Authentication is required to exploit this vulnerability. The s= pecific flaw exists within the web service, which listens on TCP port 4568 =
by default. The issue results from the lack of proper validation of a user-= supplied string before using it to construct SQL queries. An attacker can l= everage this vulnerability to escalate privileges to resources normally pro= tected from the user. . Was ZDI-CAN-28726. 2026-07-29 not yet calculated CV= E-2026-5490 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5490 ] DriveLock-= -DriveLock DriveLock Directory Traversal Information Disclosure Vulnerabili= ty. This vulnerability allows remote attackers to disclose sensitive inform= ation on affected installations of DriveLock. Authentication is not require=
d to exploit this vulnerability. The specific flaw exists within the web se= rvice, which listens on TCP port 6067 by default. The issue results from th=
e lack of proper validation of a user-supplied path prior to using it in fi=
le operations. An attacker can leverage this vulnerability to disclose info= rmation in the context of the service account. Was ZDI-CAN-28722. 2026-07-2=
9 not yet calculated CVE-2026-5491 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-5491 ] DriveLock--DriveLock DriveLock Directory Traversal Information=
Disclosure Vulnerability. This vulnerability allows remote attackers to di= sclose sensitive information on affected installations of DriveLock. Authen= tication is required to exploit this vulnerability. The specific flaw exist=
s within the web service, which listens on TCP port 4568 by default. The is= sue results from the lack of proper validation of a user-supplied path prio=
r to using it in file operations. An attacker can leverage this vulnerabili=
ty to disclose information in the context of the service account. Was ZDI-C= AN-28713. 2026-07-29 not yet calculated CVE-2026-5492 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-5492 ] Dynamic Pricing With Discount Rules for Woo= Commerce--Dynamic Pricing With Discount Rules for WooCommerce The Dynamic P= ricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 do=
es not validate a nonce or user capabilities on one of its AJAX actions and=
reflects unsanitised user input in the response, allowing unauthenticated = attackers to perform Reflected Cross-Site Scripting against a victim who is=
induced to send a crafted request. 2026-08-01 not yet calculated CVE-2026-= 13725 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13725 ] DynamicKit--Dyn= amicKit for Elementor The DynamicKit for Elementor WordPress plugin before = 1.0.3 does not validate the host of a user-supplied URL used as the base of=
the password-reset link it emails, allowing unauthenticated attackers to s= end a target user a legitimately-formatted reset email whose link points to=
an attacker-controlled host and carries a valid reset key, leading to acco= unt takeover when the victim clicks it. 2026-08-01 not yet calculated CVE-2= 026-14596 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14596 ] Easy Appoin= tments--Easy Appointments The Easy Appointments WordPress plugin through 3.= 12.26 does not perform a per-request capability or nonce check on one of it=
s customer-listing handlers, allowing authenticated users with contributor-= level access to read every stored customer's personal information. 2026-07-=
30 not yet calculated CVE-2026-14188 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-14188 ] Easy Appointments--Easy Appointments The Easy Appointments = WordPress plugin through 3.12.26 does not perform capability checks in seve= ral of its appointment-management actions, relying only on a nonce that any=
authenticated user can obtain, allowing users with contributor-level acces=
s to read all customers' appointment details and to create, modify, and del= ete bookings. 2026-07-30 not yet calculated CVE-2026-14221 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-14221 ] Easy Appointments--Easy Appointments = The Easy Appointments WordPress plugin through 3.12.26 does not perform any=
capability or nonce check in one of its connection-deletion actions, allow= ing users with contributor-level access to delete the booking configuration=
and disable the booking system. 2026-07-30 not yet calculated CVE-2026-142=
22 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14222 ] Easy Appointments-= -Easy Appointments The Easy Appointments WordPress plugin through 3.12.26 d= oes not verify ownership or capability when returning stored customer detai= ls, allowing users with subscriber-level access to read any customer's pers= onal information by iterating an identifier. 2026-07-30 not yet calculated = CVE-2026-14223 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14223 ] Easy A= ppointments--Easy Appointments The Easy Appointments WordPress plugin throu=
gh 3.12.26 does not verify that the appointment targeted by its customer-da=
ta update action belongs to the current user; the action only checks a shar=
ed nonce that any authenticated user can obtain from their own appointment'=
s edit form. A subscriber-level user with an appointment of their own can t= herefore reuse that nonce to overwrite the customer metadata (email, name, = phone, description) of another user's appointment. Because the Easy Appoint= ments WordPress plugin through 3.12.26 then treats that metadata as the app= ointment's contact data, a subsequent administrator status change with cust= omer notifications enabled delivers the victim's appointment notification t=
o the attacker-controlled email address. 2026-07-29 not yet calculated CVE-= 2026-14224 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14224 ] Easy Appoi= ntments--Easy Appointments The Easy Appointments WordPress plugin through 3= .12.26 does not require a sufficient capability on one of its appointment-l= isting REST endpoints, restricting it only to a capability that every authe= nticated user holds, allowing users with subscriber-level access to read al=
l bookings on the site, including customer names, schedules, and statuses. = 2026-07-30 not yet calculated CVE-2026-14226 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-14226 ] EasyAppointments--EasyAppointments SQL injection vu= lnerability exists in the order_by parameter of the /customers/search endpo= int in Alex Tselegidis EasyAppointments <=3D 1.5.1. The vulnerability arise=
s from unsanitized user input passed to the order_by method of the CodeIgni= ter Query Builder, enabling attackers to perform time-based queries and sch= ema enumeration. Under certain MySQL configurations, the flaw may lead to r= emote code execution by writing a PHP shell using INTO OUTFILE. 2026-07-27 = not yet calculated CVE-2025-50455 [ https://www.cve.org/CVERecord?id=3DCVE-= 2025-50455 ] Eclipse Foundation--Eclipse CSI - PIA PIA's `POST /v1/upload/s= bom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` clai=
m against an issuer allowlist using Python's `urlparse` before performing O= IDC discovery with `requests`. Because `urlparse` and `requests`/`urllib3` = parse an authority string containing a backslash (e.g. `https://attacker-ho= st\@ci.eclipse.org/`) into *different* hostnames, an attacker can craft an = issuer that passes the allowlist check yet drives `requests` - and subseque= ntly `urllib.request.urlopen` for JWKS retrieval - to connect to an arbitra=
ry attacker-chosen host, port, and scheme. 2026-07-30 not yet calculated CV= E-2026-18353 [ https://www.cve.org/CVERecord?id=3DCVE-2026-18353 ] Ecommerc= e--Ecommerce Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vuln= erable to SQL Injection in /show_price_by_pdtId.php. 2026-07-30 not yet cal= culated CVE-2025-65336 [ https://www.cve.org/CVERecord?id=3DCVE-2025-65336 =
] Ecommerce--Fruits Bazar 1.0 Ecommerce Fruits Bazar 1.0 is vulnerable to C= ross Site Scripting (XSS) in admin/edit_product.php. 2026-07-30 not yet cal= culated CVE-2025-65341 [ https://www.cve.org/CVERecord?id=3DCVE-2025-65341 =
] ELECOM CO.,LTD.--WAB-M1775-PS ELECOM wireless LAN routers and access poin=
ts devices contain a reflected cross-site scripting vulnerability in WebUI.=
If this vulnerability is exploited, an arbitrary script may be executed on=
a logged-in user's web browser. 2026-07-28 not yet calculated CVE-2026-443=
87 [ https://www.cve.org/CVERecord?id=3DCVE-2026-44387 ] ELECOM CO.,LTD.--W= AB-M1775-PS ELECOM wireless LAN routers and access points devices contain a=
n OS Command Injection vulnerability in Restore Settings. If this vulnerabi= lity is exploited, an arbitrary OS command may be executed by an attacker w=
ho can log in to the product. 2026-07-28 not yet calculated CVE-2026-61376 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-61376 ] ELECOM CO.,LTD.--WRC-= X3000GS3-B ELECOM wireless LAN routers and access points devices contain an=
OS Command Injection vulnerability in WebUI. If this vulnerability is expl= oited, an arbitrary OS command may be executed by an attacker who can log i=
n to the product. 2026-07-28 not yet calculated CVE-2026-59764 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-59764 ] Element Pack Addons for Elementor= --Element Pack Addons for Elementor The Element Pack Addons for Elementor W= ordPress plugin before 8.7.13 does not sanitize option values passed throug=
h certain data attributes before a bundled front-end library re-parses and = renders them in the browser, allowing users with contributor-level access o=
r higher to inject arbitrary JavaScript that executes in the session of any=
visitor who views the affected content. 2026-08-02 not yet calculated CVE-= 2026-14817 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14817 ] ElementsKi=
t Elementor Addons--ElementsKit Elementor Addons The ElementsKit Elementor = Addons WordPress plugin before 3.10.01 does not prevent a custom-widget def= inition saved by a user with administrative capabilities from being written=
verbatim into a generated PHP file that the ElementsKit Elementor Addons W= ordPress plugin before 3.10.01 subsequently executes, allowing arbitrary PH=
P code to run on the server; on a multisite network this lets a non-super s= ubsite Administrator, who is otherwise denied code/file editing, reach host= -level code execution beyond the privileges the network grants them. 2026-0= 7-31 not yet calculated CVE-2026-13392 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-13392 ] ElementsKit Elementor Addons--ElementsKit Elementor Add= ons The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does n=
ot sanitize or escape certain megamenu menu-item settings before storing th=
em and outputting them on the front end, and does not require the unfiltere= d_html capability to save them, allowing users with administrative capabili= ties to store malicious JavaScript; on a multisite network this lets a non-= super subsite Administrator, who is denied unfiltered_html, plant a stored = Cross-Site Scripting payload that executes in the sessions of the network S= uper Admin and site visitors. 2026-07-31 not yet calculated CVE-2026-13393 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-13393 ] Ellucian--Advance Web=
A SQL Injection in the Giving Reports functionality in Ellucian Advance We=
b and Legacy Advance allows an authenticated attacker to extract sensitive= =C2=A0information from databases via a crafted SQL query in the class credi= t=C2=A0field. This issue affects Advance Web: all versions; Legacy Advance:=
all versions. Ellucian CRM Advance is not impacted. 2026-07-28 not yet cal= culated CVE-2026-6881 [ https://www.cve.org/CVERecord?id=3DCVE-2026-6881 ] = Enhancesoft LLC--osTicket A logic vulnerability in the password reset token=
validation routine implemented by osTicket in versions prior to v1.17.8 an=
d v1.18.4. During the password reset process, the application retrieves the=
timestamp associated with the provided token and checks whether the config= ured validity period has expired. Consequently, the expiry check is only pe= rformed if the timestamp lookup fails, allowing tokens with an existing tim= estamp to bypass the intended expiry validation. Therefore, an attacker abl=
e to obtain a valid password reset token could reuse it to perform an unaut= horised password reset and compromise the affected account. 2026-07-30 not = yet calculated CVE-2026-18363 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -18363 ] Ente--Museum Server Authorization Bypass in the emergency recovery=
approval component in Ente Technologies Ente Museum Server allows an authe= nticated attacker configured as a victim's emergency contact to bypass the = configured recovery waiting period and take over the victim's account via a=
crafted `approve-recovery` API request. 2026-07-29 not yet calculated CVE-= 2026-16751 [ https://www.cve.org/CVERecord?id=3DCVE-2026-16751 ] Enterprise= DB--pglogical pglogical's apply worker does not sufficiently validate the l= ength of certain fields in incoming replication protocol messages before co= pying them, resulting in an out-of-bounds read. A party acting as the publi= sher for a subscription, for example a non-PostgreSQL endpoint that speaks = the pglogical replication protocol, can return crafted messages that cause = the subscriber's apply worker to read beyond the bounds of an allocated buf= fer, disclosing adjacent process memory or crashing the worker. To exploit = the issue an attacker must be able to direct a subscription at an endpoint = they control. In default installations this requires privileges normally re= served for a superuser, so the issue is most relevant to managed deployment=
s where the ability to create subscriptions has been delegated to non-super= user roles. 2026-07-28 not yet calculated CVE-2026-50735 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-50735 ] EnterpriseDB--pglogical The pglogical q= ueue mechanism, used to convey out-of-band commands such as replicated DDL = from a publisher to a subscriber, executes message payloads on the subscrib=
er at the privilege level of the apply worker, which is equivalent to a Pos= tgreSQL superuser in default installations. A party acting as the publisher=
can send crafted queue messages that cause arbitrary SQL to be executed on=
the subscriber as superuser, escalating from a role permitted to use pglog= ical to full superuser and breaking the isolation between tenants in shared=
deployments. To exploit the issue an attacker must be able to direct a sub= scription at an endpoint they control. In default installations this requir=
es privileges normally reserved for a superuser, so the issue is most relev= ant to managed deployments where the ability to create subscriptions has be=
en delegated to non-superuser roles. 2026-07-28 not yet calculated CVE-2026= -50736 [ https://www.cve.org/CVERecord?id=3DCVE-2026-50736 ] EnterpriseDB--= pglogical When applying replicated changes for a row that is missing one or=
more columns, pglogical evaluates the affected table's default expressions=
on the subscriber. Because the apply worker runs at a privilege level equi= valent to a PostgreSQL superuser in default installations, any function inv= oked by such a default expression also runs at that privilege. A party acti=
ng as the publisher can use this path to cause functions to be executed on = the subscriber as superuser, escalating from a role permitted to use pglogi= cal to full superuser. This is a second, independent path to the same super= user escalation tracked under CVE-2026-50736 (the pglogical queue issue). T=
o exploit the issue an attacker must be able to direct a subscription at an=
endpoint they control. In default installations this requires privileges n= ormally reserved for a superuser, so the issue is most relevant to managed = deployments where the ability to create subscriptions has been delegated to=
non-superuser roles. 2026-07-28 not yet calculated CVE-2026-50737 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-50737 ] EnterpriseDB--pglogical A use= -after-free condition exists in pglogical's worker signaling code, where a = worker structure can be dereferenced after the underlying slot has been fre=
ed or recycled during normal worker lifecycle events. The condition is reac= hable during normal replication operation, including by a low-privileged us=
er able to influence worker start, stop, and restart timing through permitt=
ed pglogical operations. In the typical case the condition crashes replicat= ion workers, causing an availability impact. In the worst case a use-after-= free in a PostgreSQL backend can be leveraged as a remote code execution pr= imitive at the privilege of that backend. 2026-07-28 not yet calculated CVE= -2026-50738 [ https://www.cve.org/CVERecord?id=3DCVE-2026-50738 ] Ericsson-= -Ericsson Packet Core Controller (PCC) Ericsson Packet Core Controller (PCC=
) versions prior to 1.39 contain a vulnerability in Configuration Managemen=
t, allowing an attacker to execute specifically crafted commands to reveal = system secret through error messages. 2026-07-27 not yet calculated CVE-202= 5-59177 [ https://www.cve.org/CVERecord?id=3DCVE-2025-59177 ] Ericsson--Pac= ket Core Controller (PCC) Ericsson Packet Core Controller (PCC) versions pr= ior to 1.38 contain an Improper Neutralization of Special Elements vulnerab= ility allowing an attacker to execute arbitrary code as root. 2026-07-27 no=
t yet calculated CVE-2025-59172 [ https://www.cve.org/CVERecord?id=3DCVE-20= 25-59172 ] Ericsson--Packet Core Controller (PCC) Ericsson Packet Core Cont= roller (PCC) versions prior to 1.39 contain an Exposure of Sensitive System=
Information vulnerability in Configuration Management allowing an attacker=
to enumerate other users on the system. 2026-07-27 not yet calculated CVE-= 2025-59178 [ https://www.cve.org/CVERecord?id=3DCVE-2025-59178 ] Ericsson--= Packet Core Controller (PCC) Ericsson Packet Core Controller (PCC) versions=
prior to 1.38 contain a hardcoded credential vulnerability in the alarm sy= stem. An attacker with access to the cluster with knowledge of the hardcode=
d credential can read alarm and alert information. 2026-07-27 not yet calcu= lated CVE-2025-59180 [ https://www.cve.org/CVERecord?id=3DCVE-2025-59180 ] = Ericsson--Packet Core Controller (PCC) Ericsson Packet Core Controller (PCC=
) versions prior to 1.39 contain a directory traversal vulnerability in Con= figuration Management that could allow an attacker to change directory perm= issions, denying access to legitimate users. 2026-07-27 not yet calculated = CVE-2025-59181 [ https://www.cve.org/CVERecord?id=3DCVE-2025-59181 ] Erlang= --OTP Improper Handling of Exceptional Conditions vulnerability in Erlang O=
TP erts (epmd) allows an unauthenticated remote attacker to permanently ter= minate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion.=
The do_accept function in erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit=
() when accept(2) returns EMFILE (per-process file descriptor limit reached=
) or ENFILE (system-wide file descriptor limit reached), rather than treati=
ng these as recoverable conditions. An attacker can exhaust epmd's file des= criptor slots by holding many TCP connections open while periodically sendi=
ng a single byte to reset the idle timeout, then causing accept(2) to retur=
n EMFILE, which kills the daemon. epmd has no per-source-IP connection cap,=
making the attack feasible from a single source. On Debian/Ubuntu default = packaging the impact is amplified: the systemd unit inherits a low file des= criptor soft limit, and repeated daemon deaths trigger systemd's start-rate= -limit, permanently failing both epmd.service and epmd.socket and requiring=
manual operator intervention to recover. This issue affects OTP from OTP 1= 7.0 before OTP=C2=A029.0.4, OTP=C2=A028.5.0.4 and OTP=C2=A027.3.4.15. 2026-= 07-27 not yet calculated CVE-2026-42792 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-42792 ] Erlang--OTP Relative Path Traversal vulnerability in Er= lang OTP (stdlib zip module) allows writing files outside the intended extr= action directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1=
,2 validate entry paths using zip:check_dir_level/2, which tracks directory=
depth as a running integer counter: .. decrements it, normal path componen=
ts increment it. The caller rejects only paths where the final counter valu=
e is less than zero. A path such as ../x/y causes the counter to go negativ=
e mid-traversal then recover to zero, passing validation while resolving to=
a location outside the extraction directory when joined with the current w= orking directory via add_cwd. This vulnerability is associated with program=
file lib/stdlib/src/zip.erl. This issue affects OTP from OTP 27.1 before O= TP=C2=A029.0.4, OTP=C2=A028.5.0.4 and OTP=C2=A027.3.4.15, corresponding to = stdlib from 6.1 before 8.0.3, 7.3.0.1 and 6.2.2.4. 2026-07-27 not yet calcu= lated CVE-2026-47078 [ https://www.cve.org/CVERecord?id=3DCVE-2026-47078 ] = Erlang--OTP Integer Underflow (Wrap or Wraparound) vulnerability in erlang = otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced=
Integer Overflow, Excessive Allocation. This vulnerability is associated w= ith program files erts/emulator/beam/external.c, emulator/beam/external.c. = The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decod=
er accepts an encoding with both length and trailing-bits fields set to zer=
o. The subsequent computation of the bitstring size underflows an unsigned = integer, producing a value of roughly 2^64 that is then passed as a memory = allocation size. The allocator aborts the entire node with a message such a=
s "Cannot allocate 2305843009213693951 bytes of memory (of type binary)". T=
he crash is a VM-level abort, not an Erlang-level exception. It cannot be i= ntercepted by supervision trees, by try/catch, or by passing the [safe] opt= ion to binary_to_term/2 (which only restricts atom creation and does not pe= rform structural validation of binary encodings). Any application that deco= des ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_ter= m() is exposed. The Erlang distribution protocol also decodes incoming term=
s through the same code path, but distribution is expected to run on truste=
d networks per the OTP Secure Coding Guidelines (DSG-011). This issue affec=
ts OTP from OTP 27.0 before OTP=C2=A029.0.4, OTP=C2=A028.5.0.4 and OTP=C2= =A027.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 1= 5.2.7.11. 2026-07-27 not yet calculated CVE-2026-54890 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-54890 ] Erlang--OTP Signed to Unsigned Conversion=
Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an a= ttacker who can supply a crafted Erlang external term format (ETF) binary t=
o binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual m= achine. When decoding a LARGE_TUPLE_EXT term, the validation pass decoded_s= ize() in erts/emulator/beam/external.c reads the 32-bit arity field as unsi= gned (get_uint32()), while the decode pass dec_term() reads the same field =
as a signed 32-bit integer (get_int32()) into an int. An arity wire value o=
f 0x80000000 passes validation as 2147483648 but decodes as -2147483648, so=
the subsequent hp +=3D n moves the heap allocation pointer backward. Neith=
er pass enforces the runtime tuple-arity limit MAX_ARITYVAL. The result is =
an out-of-bounds heap write; in practice the VM detects an impossible heap = size and aborts, denying service. The required padding is large when uncomp= ressed but the compressed-ETF envelope shrinks it to a small payload on the=
wire. This issue affects OTP from OTP 25.0 before OTP=C2=A029.0.4, OTP=C2= =A028.5.0.4 and OTP=C2=A027.3.4.15, corresponding to erts from 13.0 before = 17.0.4, 16.4.0.4 and 15.2.7.11. 2026-07-27 not yet calculated CVE-2026-5573=
7 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55737 ] Erlang--OTP The Erl= ang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the = cipher suite selected by the server in ServerHello was among the suites off= ered by the client in ClientHello. The client-side tls_handshake:hello/5 ha= ndler validates the negotiated protocol version and the downgrade sentinel = but hands the server-chosen suite directly to ssl_handshake:handle_server_h= ello_extensions/9, which installs it without a membership check. The TLS 1.=
3 client path performs this check (per RFC 8446), so it is not affected. An=
on-path attacker between the client and the intended server can respond wi=
th a ServerHello selecting an anonymous key exchange suite such as TLS_DH_a= non_* or TLS_ECDH_anon_* that the client never offered. Anonymous suites do=
not require the server to present a certificate, so the entire verify_peer=
and cacerts configuration is bypassed: the attacker completes the handshak=
e with its own ephemeral parameters, no certificate is validated, no hostna=
me is checked, and ssl:connect returns {ok, Socket}. All subsequent applica= tion traffic is readable and modifiable by the attacker. This issue affects=
OTP from OTP 17.0 before OTP=C2=A029.0.4, OTP=C2=A028.5.0.4 and OTP=C2=A02= 7.3.4.15, corresponding to ssl from 5.3.4 before 11.7.4, 11.6.0.4 and 11.2.= 12.11. 2026-07-27 not yet calculated CVE-2026-55953 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-55953 ] Erlang--OTP The Erlang/OTP ssl application d= oes not detect cycles when reconstructing an incomplete peer certificate ch= ain during a TLS or DTLS handshake. In ssl_certificate:handle_incomplete_ch= ain/5, the received chain is passed to ssl_certificate:build_certificate_ch= ain/5, which walks issuer relationships via ssl_certificate:do_certificate_= chain/7 with no cycle detection and no depth limit. When the peer supplies = two mutually cross-signed certificates in unordered form (A issues B, B iss= ues A), the issuer lookup alternates between the two certificates and the p= air of functions recurses indefinitely, growing the call stack and chain ac= cumulator without bound. An unauthenticated remote attacker can send a craf= ted certificate chain in a TLS or DTLS Certificate handshake message to exh= aust available memory and crash the BEAM node. Only a TCP connection and a = partial handshake are required; no authentication or completed handshake is=
needed, and both TLS/DTLS servers and clients are affected when processing=
peer certificate messages. This issue affects OTP from OTP 23.2 before OTP= =C2=A029.0.4, OTP=C2=A028.5.0.4 and OTP=C2=A027.3.4.15, corresponding to ss=
l from 10.2 before 11.7.4, 11.6.0.4 and 11.2.12.11. 2026-07-27 not yet calc= ulated CVE-2026-58227 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58227 ]=
Erlang--OTP Classic buffer overflow in the Erlang/OTP megaco flex scanner =
C driver allows a remote unauthenticated attacker to corrupt the driver's m= emory (and potentially achieve remote code execution or a denial-of-service=
crash) by sending a single text-encoded H.248/Megaco message containing an=
oversized property parm name. When tokenizing a Local/Remote descriptor, m= fs_load_property_groups extracts the attacker-controlled property name (bou= nded only by the message length) and, when no value follows, formats it int=
o a fixed 512-byte error_msg field of the MfsErlDrvData struct using an unc= hecked sprintf call. Names longer than roughly 452 bytes overflow into the = immediately following struct fields (text_buf, text_ptr, term_spec, term_sp= ec_size, term_spec_index), overwriting live pointers and counters with atta= cker-chosen bytes. Subsequent scanner code writes and frees through the cor= rupted pointers, producing arbitrary write and arbitrary free primitives in= side the BEAM VM process, which can be leveraged for remote code execution.=
On builds compiled with _FORTIFY_SOURCE the overflow is detected at runtim=
e and terminates the process with SIGABRT, resulting in denial of service. = The overflow occurs in the flex scanner before any grammar or Megaco-level = authentication processing, so exploitation requires only network reachabili=
ty to the megaco transport port on a node configured with {scanner, flex}. = This vulnerability is associated with program files lib/megaco/src/flex/meg= aco_flex_scanner_drv.flex.src and program routines mfs_load_property_groups=
. This issue affects OTP from OTP 17.0 before OTP=C2=A029.0.4, OTP=C2=A028.= 5.0.4 and OTP=C2=A027.3.4.15, corresponding to megaco from 3.17.1 before 4.= 9.1, 4.8.3.1 and 4.7.2.2. Versions prior to OTP 17.0 are also affected but = are not listed because the OTP version scheme is only defined from OTP 17.0=
onwards. 2026-07-27 not yet calculated CVE-2026-59250 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-59250 ] Erlang--OTP Allocation of resources witho=
ut limits in Erlang/OTP public_key certificate path validation allows a rem= ote unauthenticated attacker to cause denial of service by sending a crafte=
d X.509 certificate chain during the TLS handshake. During RFC 5280 policy = processing in public_key:pkix_path_validation/3, the certificate policy tre=
e maintained by pubkey_policy_tree grows without an upper bound. When a cer= tificate chain contains M policies per certificate and K certificates, the = tree grows on the order of M^K nodes because pubkey_policy_tree:add_leaves/=
2 and pubkey_policy_tree:add_leaf_siblings/2 extend the tree per policy per=
certificate. A modest chain with many policies per certificate is enough t=
o pin BEAM schedulers and exhaust the node's memory, taking down the entire=
VM. The attacker only needs to be able to present a certificate chain to t=
he victim, which is the normal precondition for a TLS handshake, so exploit= ation succeeds against any incoming or outgoing TLS connection that validat=
es the peer's chain (the default for SSL/TLS clients and mutual-TLS servers=
). This is the same vulnerability class as OpenSSL's X509_verify_cert polic=
y tree DoS. This vulnerability is associated with program files lib/public_= key/src/pubkey_policy_tree.erl and program routines pubkey_policy_tree:add_= leaves/2 and pubkey_policy_tree:add_leaf_siblings/2. This issue affects OTP=
from OTP 26.2 before OTP=C2=A029.0.4, OTP=C2=A028.5.0.4 and OTP=C2=A027.3.= 4.15, corresponding to public_key from 1.15 before 1.21.4, 1.20.3.4 and 1.1= 7.1.5. 2026-07-27 not yet calculated CVE-2026-59251 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-59251 ] Essential Addons for Elementor--Essential Ad= dons for Elementor The Essential Addons for Elementor WordPress plugin befo=
re 6.6.10 does not validate the HTML tag name of the Pricing Table widget t= itle before outputting it, allowing users with Contributor-level access and=
above to inject JavaScript that will be executed (Stored Cross-Site Script= ing) when the page is viewed, including in the session of an administrator = previewing or visiting the post. 2026-07-30 not yet calculated CVE-2026-133=
44 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13344 ] Essential Addons f=
or Elementor--Essential Addons for Elementor The Essential Addons for Eleme= ntor WordPress plugin before 6.6.10 does not perform authorization, status,=
or visibility checks when resolving WooCommerce products in its product-co= mparison feature, allowing unauthenticated users to disclose the title, pri= ce, and SKU of draft, pending, and private products that are otherwise with= held from public view. 2026-07-30 not yet calculated CVE-2026-13345 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-13345 ] Event Tickets and Registrati= on--Event Tickets and Registration The Event Tickets and Registration WordP= ress plugin before 5.28.4 does not properly escape event titles before outp= utting them in a ticket history log, allowing users with the Editor role an=
d above to perform Stored Cross-Site Scripting attacks that execute against=
higher-privileged users on multisite installations. 2026-07-28 not yet cal= culated CVE-2026-14819 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14819 =
] Event Tickets and Registration--Event Tickets and Registration The Event = Tickets and Registration WordPress plugin before 5.29.0.1 does not perform = any authorization check on one of its order-management REST endpoints, allo= wing unauthenticated users to change the status of existing orders. 2026-08= -01 not yet calculated CVE-2026-14822 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-14822 ] Event Tickets and Registration--Event Tickets and Registra= tion The Event Tickets and Registration WordPress plugin before 5.29.0.1 do=
es not properly verify authorization on some of its seating actions, allowi=
ng users with contributor-level access and above to overwrite the seating l= ayout, ticket inventory, and attendee seat assignments of events they do no=
t own. 2026-08-01 not yet calculated CVE-2026-14823 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-14823 ] Eventin--Eventin The Eventin WordPress plugi=
n before 4.1.16 does not properly authorize order creation and accepts an a= ttacker-supplied order status, allowing unauthenticated users to create ord= ers marked as paid without completing any payment. 2026-07-30 not yet calcu= lated CVE-2026-13178 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13178 ] = Events Made Easy--Events Made Easy The Events Made Easy WordPress plugin be= fore 3.1.4 does not verify that the requester is authorized to modify the t= argeted record when handling an unauthenticated data-change request, relyin=
g only on a public nonce with no per-record token or ownership check, allow= ing unauthenticated attackers to overwrite the personal data of any person = record. 2026-07-31 not yet calculated CVE-2026-14843 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-14843 ] Everest Toolkit--Everest Toolkit The Everes=
t Toolkit WordPress plugin through 1.2.3 does not validate the type of file=
s uploaded during demo-content import (the WordPress file-type test is disa= bled), allowing high-privilege users (Administrator by default, including n= on-super-admin site administrators on multisite) to upload executable PHP f= iles to the uploads directory. 2026-08-01 not yet calculated CVE-2026-13158=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-13158 ] FacturaONE para WooC= ommerce con VeriFactu--FacturaONE para WooCommerce con VeriFactu The Factur= aONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not a= uthenticate one of its request handlers, whose only protection is derived f= rom a cryptographic key that is empty in the default, unconfigured state, a= llowing unauthenticated attackers to write an arbitrary file into a web-acc= essible directory and achieve remote code execution. 2026-07-27 not yet cal= culated CVE-2026-14289 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14289 =
] FeehiCMS--FeehiCMS An issue in FeehiCMS v.2.1.1 allows an attacker to esc= alate privileges via the Session management module, authentication logic, l= ogout handler components 2026-07-31 not yet calculated CVE-2026-51953 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-51953 ] Five Star Restaurant Reser= vations--Five Star Restaurant Reservations The Five Star Restaurant Reserva= tions WordPress plugin before 2.7.23 does not perform a capability check on=
one of its AJAX actions, allowing users with the lowest booking-management=
role (which by default cannot access the Five Star Restaurant Reservations=
WordPress plugin before 2.7.23's settings) to reset the site's configured = booking notification rules. 2026-08-02 not yet calculated CVE-2026-15151 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-15151 ] Fluent Forms--Fluent Fo= rms The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and es= cape one of its form field configuration settings before outputting it insi=
de an inline script when a form is rendered, which could allow users with a=
role as low as Contributor (with delegated form-management permission, and=
therefore lacking the unfiltered_html capability, e.g. in a multisite setu=
p) to perform Stored Cross-Site Scripting attacks that execute in the brows=
er of any visitor who loads the form, including administrators previewing i=
t. 2026-07-30 not yet calculated CVE-2026-11881 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-11881 ] Fluent Support--Fluent Support The Fluent Suppor=
t WordPress plugin before 2.3.1 does not perform a per-ticket access check = before reassigning a ticket's customer, allowing a restricted support agent=
to change the assigned customer of any ticket in the system, including tic= kets outside their granted scope. 2026-08-01 not yet calculated CVE-2026-14= 197 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14197 ] FluentBoards--Flu= entBoards The FluentBoards WordPress plugin before 1.95.3 does not verify t= hat the items selected for a board import operation belong to a board the r= equesting user is authorized to access, allowing any authenticated user wit=
h member access to a single board to copy and read the stages and tasks (in= cluding titles, descriptions and file attachments) of any other board on th=
e site. 2026-08-02 not yet calculated CVE-2026-14938 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-14938 ] FluentCart--FluentCart A New Era of eCommer=
ce The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does=
not verify that a subscription belongs to the requesting customer in sever=
al of its payment-method endpoints, allowing any authenticated customer to = act on another customer's subscription (changing its payment method, or can= celling and re-binding it) when they know the target subscription identifie=
r. 2026-07-28 not yet calculated CVE-2026-14926 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-14926 ] FluentCart--FluentCart A New Era of eCommerce Th=
e FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not = perform any authorization or ownership check before rendering customer orde=
r documents keyed on a sequential numeric identifier, allowing unauthentica= ted visitors to enumerate and disclose customer personal data (names, email=
addresses, billing and shipping postal addresses, and order details) acros=
s the store. 2026-07-31 not yet calculated CVE-2026-14927 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-14927 ] FlxWoo--FlxWoo The FlxWoo WordPress pl= ugin before 3.1.1 does not verify with the payment processor that a checkou=
t session was actually paid before marking the associated order as paid, al= lowing unauthenticated attackers to complete WooCommerce orders without pay= ing. 2026-07-31 not yet calculated CVE-2026-14830 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-14830 ] foreUP--foreUP A vulnerability in the foreUP c= ustomer REST API allows any authenticated user to read cleartext payment-pr= ocessor merchant credentials in the response body. 2026-07-30 not yet calcu= lated CVE-2026-15657 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15657 ] = foreUP--foreUP A vulnerability in the foreUP customer REST API allows any a= uthenticated, low-privilege customer to access an endpoint that returns the=
records of other users without checking that the caller owns the data asso= ciated with that record. 2026-07-30 not yet calculated CVE-2026-15658 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-15658 ] Frappe--ERPNext SQL inject= ion in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The=
application constructs SQL queries through direct string interpolation usi=
ng `str.format()` without employing parameterized queries, allowing the nam=
e (docname) of a Supplier record containing SQL metacharacters to be interp= reted as part of the query. Exploitation of this vulnerability could allow =
an authenticated user with low privileges to execute arbitrary SQL queries,=
bypass Frappe's access restrictions (DocPerm), extract confidential inform= ation from the database-including fragments of the administrator's password=
hash-and access other sensitive data, such as credentials, integration tok= ens, or financial information. 2026-07-29 not yet calculated CVE-2026-12895=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-12895 ] free5gc--free5gc fre= e5GC is an open-source implementation of the 5G core network. Prior to 1.4.=
5, the free5GC AUSF (Authentication Server Function) does not validate the = supiOrSuci field in UE authentication requests. Null bytes (\x00) and other=
control characters pass through JSON parsing unchanged and are forwarded t=
o the UDM in an unescaped URL path. This causes Go's net/url.Parse() to fai=
l, returning HTTP 500 "System failure" and leaking internal stack traces. A=
n unauthenticated attacker can trigger this at scale causing denial of serv= ice for all subscribers attempting authentication through the affected AUSF=
. This vulnerability is fixed in 1.4.5. 2026-07-31 not yet calculated CVE-2= 026-53551 [ https://www.cve.org/CVERecord?id=3DCVE-2026-53551 ] FreeRDP--Fr= eeRDP FreeRDP Windows client before 3.29.0 contains a heap buffer overflow = vulnerability in the clipboard virtual channel when processing CLIPRDR_FILE= _CONTENTS_RESPONSE PDUs without validating the server-provided size against=
the destination buffer. A malicious RDP server can send a response with a = data payload significantly larger than requested, causing arbitrary heap me= mory corruption that may enable remote code execution when a user performs =
a paste operation. 2026-08-01 not yet calculated CVE-2026-67305 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-67305 ] Frontend Admin by DynamiApps--Fr= ontend Admin by DynamiApps The Frontend Admin by DynamiApps WordPress plugi=
n before 3.29.7 does not perform capability checks on its taxonomy term cre= ation, modification, and deletion operations, allowing authenticated users = with low privileges (such as Subscribers) to create, rename, and delete arb= itrary taxonomy terms. 2026-07-30 not yet calculated CVE-2026-11867 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-11867 ] Frontend Admin by DynamiApps= --Frontend Admin by DynamiApps The Frontend Admin by DynamiApps WordPress p= lugin before 3.29.9 decodes HTML entities in a submitted form field value a= fter sanitizing it, which restores HTML tags that the sanitizer had neutral= ized. A double-encoded payload submitted by an unauthenticated visitor is t= herefore stored as a live tag and later output without escaping on the Fron= tend Admin by DynamiApps WordPress plugin before 3.29.9's front-end display=
surfaces, resulting in stored cross-site scripting that executes in the br= owser of any user, including an administrator, who views a page displaying = the submitted value. 2026-07-31 not yet calculated CVE-2026-13609 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-13609 ] Frontend File Manager Plugin--= Frontend File Manager Plugin The Frontend File Manager Plugin WordPress plu= gin through 23.6 does not perform nonce validation on one of its file-metad= ata update actions, allowing an attacker to modify the metadata of a logged= -in user's uploaded file via a CSRF attack, which can be leveraged to downl= oad that file. When guest uploads are enabled, the same action is reachable=
unauthenticated against any user's file. 2026-08-02 not yet calculated CVE= -2026-16292 [ https://www.cve.org/CVERecord?id=3DCVE-2026-16292 ] FS Inc--S= witch 2.2.0D Build 118101 A reflected cross-site scripting (XSS) vulnerabil= ity in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118= 101 allows attackers to execute arbitrary Javascript in the context of the = victim's browser via a crafted URL. 2026-07-31 not yet calculated CVE-2026-= 52232 [ https://www.cve.org/CVERecord?id=3DCVE-2026-52232 ] G DATA--Total S= ecurity G DATA Total Security Backup Service Link Following Local Privilege=
Escalation Vulnerability. This vulnerability allows local attackers to esc= alate privileges on affected installations of G DATA Total Security. An att= acker must first obtain the ability to execute low-privileged code on the t= arget system in order to exploit this vulnerability. The specific flaw exis=
ts within the Backup Service. By creating a symbolic link, an attacker can = abuse the service to delete a file. An attacker can leverage this vulnerabi= lity to escalate privileges and execute arbitrary code in the context of SY= STEM. Was ZDI-CAN-28665. 2026-07-29 not yet calculated CVE-2026-13268 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-13268 ] Gallery for Google Photos-= -Gallery for Google Photos The Gallery for Google Photos WordPress plugin b= efore 1.2.1 does not properly restrict access to the stored third-party OAu=
th credentials of the connected account, exposing the persistent access and=
refresh tokens to unauthenticated users and allowing long-term compromise =
of the linked account. 2026-08-02 not yet calculated CVE-2026-15236 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-15236 ] Geeky Bot--Geeky Bot The Gee=
ky Bot WordPress plugin before 1.2.8 does not perform an authorization chec=
k on one of its AJAX actions, allowing unauthenticated users to retrieve ch= at-history session metadata including WordPress usernames, user IDs, and ti= mestamps. 2026-07-31 not yet calculated CVE-2026-15048 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-15048 ] geonetwork--core-geonetwork GeoNetwork is=
a catalog application to manage spatially referenced resources. From 3.12.=
0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2Lo= ginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits =
an attacker-controlled external redirect after login. This issue is fixed i=
n versions 4.2.16 and 4.4.11. 2026-07-31 not yet calculated CVE-2026-53573 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-53573 ] Ghost Robotics--Visio=
n 60 A lack of authentication in the mobile app (APK v5.5.0) for Ghost Robo= tics' Vision 60 robot allows an unauthenticated attacker connected to the d= evice's internal Wi-Fi network to gain unrestricted access to the web admin= istration interface and the HTTP API. Due to the lack of authorization mech= anisms, the attacker can view real-time camera feeds, control the robot's m= ovements, manage sensors (GPS, RTK, SAM, LIDAR), and execute critical opera= tional commands (Play, Pause, Stop, E-Stop). Successful exploitation comple= tely compromises the confidentiality, integrity, and physical security of t=
he system. 2026-07-27 not yet calculated CVE-2026-12989 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-12989 ] Ghost Robotics--Vision 60 An access cont= rol vulnerability in the mobile app (APK v5.5.0) for Ghost Robotics' Vision=
60 robot allows multiple simultaneous sessions to run without proper clien=
t validation or session integrity checks. An attacker with a modified versi=
on of the app can connect to the robot during an active, legitimate session=
. This allows the attacker to bypass control restrictions, intercept sensit= ive information (such as real-time video), and partially interact with the = system unnoticed and without disconnecting the legitimate user, compromisin=
g confidentiality and operational security. 2026-07-27 not yet calculated C= VE-2026-12990 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12990 ] Ghost R= obotics--Vision 60 The lack of cryptographic mechanisms to ensure the integ= rity and authenticity of communications in Ghost Robotics' Vision 60 robot = (APK v5.5.0) exposes the system to man-in-the-middle attacks. An attacker l= ocated on the local network can use ARP spoofing and selective traffic bloc= king techniques to intercept and manipulate packets between the legitimate = operator and the robot. This allows the attacker to disconnect the original=
controller, establish unauthorized communications, and prevent the operato=
r from regaining control of the device, seriously compromising the confiden= tiality, integrity, and availability (CIA) of operations. 2026-07-27 not ye=
t calculated CVE-2026-12991 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1= 2991 ] GiveWP--GiveWP The GiveWP WordPress plugin before 4.16.3 does not re= strict the set of available payment gateways to those enabled by the admini= strator, deriving it in part from request input, which allows unauthenticat=
ed users to complete donations through a payment gateway the administrator = has disabled. 2026-07-31 not yet calculated CVE-2026-14317 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-14317 ] GiveWP--GiveWP The GiveWP WordPress p= lugin before 4.16.3 does not escape a donation-form template setting before=
outputting it in an HTML attribute, allowing users with the GiveWP Worker = role and above to inject arbitrary web scripts that execute on the public d= onation form viewed by any visitor. 2026-07-30 not yet calculated CVE-2026-= 14318 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14318 ] GiveWP--GiveWP = The GiveWP WordPress plugin before 4.16.3 does not properly restrict access=
to a REST API endpoint that returns recurring-donation records, allowing u= nauthenticated users to retrieve information about anonymous recurring dono= rs, including their name and subscription details. 2026-07-31 not yet calcu= lated CVE-2026-14319 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14319 ] = gleam-lang--gleam Insufficient Verification of Data Authenticity vulnerabil= ity in Gleam allows an adversary in the middle to substitute forged Hex pac= kage contents during dependency resolution. During dependency resolution Gl= eam fetches package metadata from the signature-verified Hex repository, wh= ich covers each release's dependency requirements and SHA-256 outer_checksu=
m. After resolving versions, gleam_cli::dependencies::lookup_package makes =
a second request to the unsigned Hex API through gleam_core::hex::get_packa= ge_release and records the outer_checksum and dependency names from that JS=
ON response into manifest.toml, instead of the values from the verified rep= ository metadata. The Hex repository signature does not cover the API respo= nse. An adversary in the middle who can intercept TLS with a certificate tr= usted by the Gleam process (for example a TLS-inspecting proxy using a CA i=
n the operating system trust store or added through GLEAM_CACERTS_PATH), an=
d who can modify both the API release response and the corresponding reposi= tory tarball, can supply a package archive with a matching forged checksum = without the Hex repository signing key. Gleam verifies the forged tarball a= gainst the forged checksum, accepts it, and extracts it as a dependency sou= rce, resulting in loss of integrity of the downloaded package contents. Onl=
y projects that resolve or update Hex dependencies are affected, which happ= ens when the manifest is missing, a dependency is added or updated, or depe= ndency requirements change. Builds that reuse an unchanged, known-good mani= fest.toml continue to verify tarballs against its pinned checksum. This iss=
ue affects gleam: from 0.18.0 before 1.18.0. 2026-07-29 not yet calculated = CVE-2026-59247 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59247 ] GNU--B= ison GNU Bison allows for an execution of an arbitrary program during HTML = report generation due to improper handling of grammar-defined configuration=
variables. A grammar file can override the executable used for the XML to = HTML transformation step via %define tool.xsltproc, which is accepted witho=
ut restriction and passed directly to execvp(). When running bison --html o=
n a attacker-provided grammar, this behavior allows execution of an arbitra=
ry program with the privileges of the Bison process. Maintainers of this pr= oject were notified about this vulnerability, and fixed the issue in commit=
3169c1e7a2c6acc4c59dfcf8b089896d6881925b. However, they did not provide vu= lnerable version range. Version 3.8.2 was tested=C2=A0and confirmed as vuln= erable, other versions were not tested but might also be vulnerable. 2026-0= 7-29 not yet calculated CVE-2026-56389 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-56389 ] GNU--Bison GNU Bison improperly handles grammar defined=
output paths. Grammar directives such as %output and %header allow specify= ing file paths, which are accepted without restriction and override caller = supplied output options. When processing attacker-supplied grammar, this be= havior allows directing generated files to arbitrary writable locations on = the filesystem, potentially overwriting existing files accessible to the Bi= son process. Maintainers of this project were notified about this vulnerabi= lity, and fixed the issue in commit=C2=A08d101c19d4d9aaedf83a448c925513742d= 4efcf0. However, they did not provide vulnerable version range. Version 3.8=
.2 was tested=C2=A0and confirmed as vulnerable, other versions were not tes= ted but might also be vulnerable. 2026-07-29 not yet calculated CVE-2026-56= 390 [ https://www.cve.org/CVERecord?id=3DCVE-2026-56390 ] Google--Chrome Us=
e after free in Compositing in Google Chrome prior to 151.0.7922.72 allowed=
a remote attacker who had compromised the renderer process to potentially = perform a sandbox escape via a crafted HTML page. (Chromium security severi= ty: Critical) 2026-07-30 not yet calculated CVE-2026-17650 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-17650 ] Google--Chrome Insufficient validatio=
n of untrusted input in Dawn in Google Chrome on Android prior to 151.0.792= 2.72 allowed a remote attacker to potentially perform a sandbox escape via =
a crafted HTML page. (Chromium security severity: Critical) 2026-07-30 not = yet calculated CVE-2026-17651 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -17651 ] Google--Chrome Use after free in Views in Google Chrome prior to 1= 51.0.7922.72 allowed a remote attacker who had compromised the renderer pro= cess to potentially perform a sandbox escape via a crafted HTML page. (Chro= mium security severity: Critical) 2026-07-30 not yet calculated CVE-2026-17= 652 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17652 ] Google--Chrome Us=
e after free in Skia in Google Chrome prior to 151.0.7922.72 allowed a remo=
te attacker who had compromised the renderer process to potentially perform=
a sandbox escape via a crafted HTML page. (Chromium security severity: Cri= tical) 2026-07-30 not yet calculated CVE-2026-17653 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-17653 ] Google--Chrome Race in Updater in Google Chr= ome on Mac prior to 151.0.7922.72 allowed a local attacker to perform OS-le= vel privilege escalation via a malicious file. (Chromium security severity:=
Critical) 2026-07-30 not yet calculated CVE-2026-17654 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-17654 ] Google--Chrome Insufficient validation o=
f untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed =
a remote attacker to potentially perform a sandbox escape via a crafted HTM=
L page. (Chromium security severity: Critical) 2026-07-30 not yet calculate=
d CVE-2026-17655 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17655 ] Goog= le--Chrome Use after free in Ozone in Google Chrome prior to 151.0.7922.72 = allowed a remote attacker to potentially perform a sandbox escape via a cra= fted HTML page. (Chromium security severity: Critical) 2026-07-30 not yet c= alculated CVE-2026-17656 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1765=
6 ] Google--Chrome Use after free in Navigation in Google Chrome prior to 1= 51.0.7922.72 allowed a remote attacker who had compromised the renderer pro= cess to potentially perform a sandbox escape via a crafted HTML page. (Chro= mium security severity: High) 2026-07-30 not yet calculated CVE-2026-17657 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-17657 ] Google--Chrome Use af= ter free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote att= acker to execute arbitrary code inside a sandbox via a crafted HTML page. (= Chromium security severity: High) 2026-07-30 not yet calculated CVE-2026-17= 658 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17658 ] Google--Chrome In= appropriate implementation in SiteIsolation in Google Chrome prior to 151.0= .7922.72 allowed a remote attacker who had compromised the renderer process=
to bypass site isolation via a crafted HTML page. (Chromium security sever= ity: High) 2026-07-30 not yet calculated CVE-2026-17659 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-17659 ] Google--Chrome Insufficient validation o=
f untrusted input in Network in Google Chrome prior to 151.0.7922.72 allowe=
d a remote attacker who had compromised the renderer process to potentially=
perform a sandbox escape via a crafted HTML page. (Chromium security sever= ity: High) 2026-07-30 not yet calculated CVE-2026-17660 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-17660 ] Google--Chrome Use after free in Loader =
in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execut=
e arbitrary code inside a sandbox via a crafted HTML page. (Chromium securi=
ty severity: High) 2026-07-30 not yet calculated CVE-2026-17661 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-17661 ] Google--Chrome Insufficient poli=
cy enforcement in Prefetch in Google Chrome prior to 151.0.7922.72 allowed =
a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom= ium security severity: High) 2026-07-30 not yet calculated CVE-2026-17662 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-17662 ] Google--Chrome Insuffi= cient validation of untrusted input in GPU in Google Chrome on Android prio=
r to 151.0.7922.72 allowed a remote attacker who had compromised the render=
er process to potentially perform a sandbox escape via a crafted HTML page.=
(Chromium security severity: High) 2026-07-30 not yet calculated CVE-2026-= 17663 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17663 ] Google--Chrome = Insufficient validation of untrusted input in Loader in Google Chrome prior=
to 151.0.7922.72 allowed a remote attacker who had compromised the rendere=
r process to leak cross-origin data via a crafted HTML page. (Chromium secu= rity severity: High) 2026-07-30 not yet calculated CVE-2026-17664 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-17664 ] Google--Chrome Use after free =
in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to = execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium = security severity: High) 2026-07-30 not yet calculated CVE-2026-17665 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-17665 ] Google--Chrome Cryptograph=
ic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an at= tacker in a privileged network position to bypass discretionary access cont= rol via malicious network traffic. (Chromium security severity: High) 2026-= 07-30 not yet calculated CVE-2026-17666 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-17666 ] Google--Chrome Uninitialized Use in ANGLE in Google Chr= ome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin d= ata via a crafted HTML page. (Chromium security severity: High) 2026-07-30 = not yet calculated CVE-2026-17667 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-17667 ] Google--Chrome Uninitialized Use in ANGLE in Google Chrome pri=
or to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via=
a crafted HTML page. (Chromium security severity: High) 2026-07-30 not yet=
calculated CVE-2026-17668 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17= 668 ] Google--Chrome Inappropriate implementation in Chrome for iOS in Goog=
le Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to potent= ially perform a sandbox escape via a crafted HTML page. (Chromium security = severity: High) 2026-07-30 not yet calculated CVE-2026-17669 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-17669 ] Google--Chrome Use after free in Vi= ews in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who h=
ad compromised the renderer process to potentially perform a sandbox escape=
via a crafted HTML page. (Chromium security severity: High) 2026-07-30 not=
yet calculated CVE-2026-17670 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-17670 ] Google--Chrome Insufficient validation of untrusted input in ANGL=
E in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had=
compromised the renderer process to potentially perform a sandbox escape v=
ia a crafted HTML page. (Chromium security severity: High) 2026-07-30 not y=
et calculated CVE-2026-17671 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 17671 ] Google--Chrome Insufficient validation of untrusted input in Chrome= cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who = had compromised the renderer process to potentially perform a sandbox escap=
e via a crafted HTML page. (Chromium security severity: High) 2026-07-30 no=
t yet calculated CVE-2026-17672 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-17672 ] Google--Chrome Integer overflow in QUIC in Google Chrome prior t=
o 151.0.7922.72 allowed a remote attacker who had compromised the renderer = process to potentially perform a sandbox escape via a crafted HTML page. (C= hromium security severity: High) 2026-07-30 not yet calculated CVE-2026-176=
73 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17673 ] Google--Chrome Ina= ppropriate implementation in HTML in Google Chrome prior to 151.0.7922.72 a= llowed a remote attacker to bypass content security policy via a crafted HT=
ML page. (Chromium security severity: High) 2026-07-30 not yet calculated C= VE-2026-17674 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17674 ] Google-= -Chrome Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.7=
2 allowed a remote attacker who had compromised the renderer process to pot= entially perform a sandbox escape via a crafted HTML page. (Chromium securi=
ty severity: High) 2026-07-30 not yet calculated CVE-2026-17675 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-17675 ] Google--Chrome Inappropriate imp= lementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 all= owed a remote attacker who had compromised the renderer process to potentia= lly perform a sandbox escape via a crafted HTML page. (Chromium security se= verity: High) 2026-07-30 not yet calculated CVE-2026-17676 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-17676 ] Google--Chrome Inappropriate implemen= tation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed =
a remote attacker to potentially perform a sandbox escape via a crafted HTM=
L page. (Chromium security severity: High) 2026-07-30 not yet calculated CV= E-2026-17677 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17677 ] Google--= Chrome Out of bounds read in ANGLE in Google Chrome prior to 151.0.7922.72 = allowed a remote attacker who had compromised the renderer process to poten= tially perform a sandbox escape via a crafted HTML page. (Chromium security=
severity: High) 2026-07-30 not yet calculated CVE-2026-17678 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-17678 ] Google--Chrome Insufficient valida= tion of untrusted input in Print Preview in Google Chrome prior to 151.0.79= 22.72 allowed a remote attacker who had compromised the renderer process to=
leak cross-origin data via a crafted HTML page. (Chromium security severit=
y: High) 2026-07-30 not yet calculated CVE-2026-17679 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-17679 ] Google--Chrome Heap buffer overflow in Col=
or in Google Chrome on ChromeOS prior to 151.0.7922.72 allowed a remote att= acker who had compromised the renderer process to potentially perform a san= dbox escape via a crafted HTML page. (Chromium security severity: High) 202= 6-07-30 not yet calculated CVE-2026-17680 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-17680 ] Google--Chrome Insufficient validation of untrusted in= put in Web Authentication in Google Chrome on Android prior to 151.0.7922.7=
2 allowed a remote attacker who had compromised the renderer process to pot= entially perform a sandbox escape via a crafted HTML page. (Chromium securi=
ty severity: High) 2026-07-30 not yet calculated CVE-2026-17681 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-17681 ] Google--Chrome Integer overflow =
in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker = who had compromised the renderer process to potentially perform a sandbox e= scape via a crafted HTML page. (Chromium security severity: High) 2026-07-3=
0 not yet calculated CVE-2026-17682 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-17682 ] Google--Chrome Inappropriate implementation in ANGLE in Goog=
le Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potent= ially sensitive information from process memory via a crafted HTML page. (C= hromium security severity: High) 2026-07-30 not yet calculated CVE-2026-176=
83 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17683 ] Google--Chrome Ins= ufficient validation of untrusted input in Chrome for iOS in Google Chrome =
on iOS prior to 151.0.7922.72 allowed a remote attacker who had compromised=
the renderer process to potentially perform a sandbox escape via a crafted=
HTML page. (Chromium security severity: High) 2026-07-30 not yet calculate=
d CVE-2026-17684 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17684 ] Goog= le--Chrome Use after free in Autofill in Google Chrome prior to 151.0.7922.=
72 allowed a remote attacker to execute arbitrary code inside a sandbox via=
a crafted HTML page. (Chromium security severity: High) 2026-07-30 not yet=
calculated CVE-2026-17685 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17= 685 ] Google--Chrome Insufficient validation of untrusted input in Password=
s in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had=
compromised the renderer process to bypass site isolation via a crafted HT=
ML page. (Chromium security severity: High) 2026-07-30 not yet calculated C= VE-2026-17686 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17686 ] Google-= -Chrome Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 all= owed a remote attacker who had compromised the renderer process to potentia= lly perform a sandbox escape via a crafted HTML page. (Chromium security se= verity: High) 2026-07-30 not yet calculated CVE-2026-17687 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-17687 ] Google--Chrome Use after free in Inpu=
t in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had=
compromised the renderer process to potentially perform a sandbox escape v=
ia a crafted HTML page. (Chromium security severity: High) 2026-07-30 not y=
et calculated CVE-2026-17688 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 17688 ] Google--Chrome Uninitialized Use in ANGLE in Google Chrome prior to=
151.0.7922.72 allowed a remote attacker to leak cross-origin data via a cr= afted HTML page. (Chromium security severity: High) 2026-07-30 not yet calc= ulated CVE-2026-17689 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17689 ]=
Google--Chrome Insufficient validation of untrusted input in PDF in Google=
Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak = cross-origin data via a crafted HTML page. (Chromium security severity: Hig=
h) 2026-07-30 not yet calculated CVE-2026-17690 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-17690 ] Google--Chrome Out of bounds write in ANGLE in G= oogle Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to=
potentially perform a sandbox escape via a crafted HTML page. (Chromium se= curity severity: High) 2026-07-30 not yet calculated CVE-2026-17691 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-17691 ] Google--Chrome Use after fre=
e in DataTransfer in Google Chrome on Windows prior to 151.0.7922.72 allowe=
d a remote attacker who had compromised the renderer process to potentially=
perform a sandbox escape via a crafted HTML page. (Chromium security sever= ity: High) 2026-07-30 not yet calculated CVE-2026-17692 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-17692 ] Google--Chrome Insufficient policy enfor= cement in FileSystem in Google Chrome prior to 151.0.7922.72 allowed a remo=
te attacker to leak cross-origin data via a crafted HTML page. (Chromium se= curity severity: High) 2026-07-30 not yet calculated CVE-2026-17693 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-17693 ] Google--Chrome Use after fre=
e in DOM in Google Chrome prior to 151.0.7922.72 allowed a remote attacker =
to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromi=
um security severity: High) 2026-07-30 not yet calculated CVE-2026-17694 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-17694 ] Google--Chrome Inapprop= riate implementation in ANGLE in Google Chrome on Mac prior to 151.0.7922.7=
2 allowed a remote attacker to potentially perform a sandbox escape via a c= rafted HTML page. (Chromium security severity: High) 2026-07-30 not yet cal= culated CVE-2026-17695 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17695 =
] Google--Chrome Side-channel information leakage in Media in Google Chrome=
prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data=
via a crafted HTML page. (Chromium security severity: High) 2026-07-30 not=
yet calculated CVE-2026-17696 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-17696 ] Google--Chrome Type Confusion in ANGLE in Google Chrome prior to = 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox es= cape via a crafted HTML page. (Chromium security severity: High) 2026-07-30=
not yet calculated CVE-2026-17697 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-17697 ] Google--Chrome Insufficient validation of untrusted input in =
UI in Google Chrome on Android prior to 151.0.7922.72 allowed a local attac= ker to leak cross-origin data via a crafted HTML page. (Chromium security s= everity: High) 2026-07-30 not yet calculated CVE-2026-17698 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-17698 ] Google--Chrome Use after free in Vie=
ws in Google Chrome prior to 151.0.7922.72 allowed a local attacker to pote= ntially perform a sandbox escape via a malicious file. (Chromium security s= everity: High) 2026-07-30 not yet calculated CVE-2026-17699 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-17699 ] Google--Chrome Insufficient validati=
on of untrusted input in Actor in Google Chrome prior to 151.0.7922.72 allo= wed a remote attacker who had compromised the renderer process to leak cros= s-origin data via a crafted HTML page. (Chromium security severity: High) 2= 026-07-30 not yet calculated CVE-2026-17700 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-17700 ] Google--Chrome Insufficient validation of untrusted = input in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a rem= ote attacker who had compromised the renderer process to potentially perfor=
m a sandbox escape via a crafted HTML page. (Chromium security severity: Hi= gh) 2026-07-30 not yet calculated CVE-2026-17701 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-17701 ] Google--Chrome Inappropriate implementation in = Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who = had compromised the renderer process to leak cross-origin data via a crafte=
d HTML page. (Chromium security severity: High) 2026-07-30 not yet calculat=
ed CVE-2026-17702 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17702 ] Goo= gle--Chrome Insufficient policy enforcement in Chrome for iOS in Google Chr= ome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navig= ation restrictions via a crafted HTML page. (Chromium security severity: Hi= gh) 2026-07-30 not yet calculated CVE-2026-17703 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-17703 ] Google--Chrome Use after free in ANGLE in Googl=
e Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromis=
ed the renderer process to potentially perform a sandbox escape via a craft=
ed HTML page. (Chromium security severity: High) 2026-07-30 not yet calcula= ted CVE-2026-17704 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17704 ] Go= ogle--Chrome Integer overflow in libxml in Google Chrome prior to 151.0.792= 2.72 allowed a remote attacker to execute arbitrary code inside a sandbox v=
ia a crafted HTML page. (Chromium security severity: High) 2026-07-30 not y=
et calculated CVE-2026-17705 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 17705 ] Google--Chrome Insufficient validation of untrusted input in Media =
in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacke=
r who had compromised the renderer process to leak cross-origin data via a = crafted HTML page. (Chromium security severity: High) 2026-07-30 not yet ca= lculated CVE-2026-17706 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17706=
] Google--Chrome Uninitialized Use in Media in Google Chrome on Windows pr= ior to 151.0.7922.72 allowed a remote attacker who had compromised the rend= erer process to obtain potentially sensitive information from process memor=
y via a crafted HTML page. (Chromium security severity: High) 2026-07-30 no=
t yet calculated CVE-2026-17707 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-17707 ] Google--Chrome Use after free in Audio in Google Chrome prior to=
151.0.7922.72 allowed a remote attacker who had compromised the renderer p= rocess to potentially perform a sandbox escape via a crafted HTML page. (Ch= romium security severity: High) 2026-07-30 not yet calculated CVE-2026-1770=
8 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17708 ] Google--Chrome Race=
in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remo=
te attacker who had compromised the renderer process to potentially perform=
a sandbox escape via a crafted HTML page. (Chromium security severity: Hig=
h) 2026-07-30 not yet calculated CVE-2026-17709 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-17709 ] Google--Chrome Inappropriate implementation in M= HTML in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attack=
er who had compromised the renderer process to potentially perform a sandbo=
x escape via a crafted HTML page. (Chromium security severity: High) 2026-0= 7-30 not yet calculated CVE-2026-17710 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-17710 ] Google--Chrome Race in Downloads in Google Chrome on Ma=
c prior to 151.0.7922.72 allowed a remote attacker who had compromised the = renderer process to potentially perform a sandbox escape via a crafted HTML=
page. (Chromium security severity: High) 2026-07-30 not yet calculated CVE= -2026-17711 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17711 ] Google--C= hrome Race in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a=
remote attacker to execute arbitrary code inside a sandbox via a crafted H= TML page. (Chromium security severity: High) 2026-07-30 not yet calculated = CVE-2026-17712 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17712 ] Google= --Chrome Insufficient validation of untrusted input in Accessibility in Goo= gle Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who = had compromised the renderer process to potentially perform a sandbox escap=
e via a crafted HTML page. (Chromium security severity: High) 2026-07-30 no=
t yet calculated CVE-2026-17713 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-17713 ] Google--Chrome Uninitialized Use in ANGLE in Google Chrome prior=
to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive=
information from process memory via a crafted HTML page. (Chromium securit=
y severity: High) 2026-07-30 not yet calculated CVE-2026-17714 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-17714 ] Google--Chrome Inappropriate impl= ementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a r= emote attacker who convinced a user to engage in specific UI gestures to le=
ak cross-origin data via a crafted HTML page. (Chromium security severity: = High) 2026-07-30 not yet calculated CVE-2026-17715 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-17715 ] Google--Chrome Use after free in Updater in G= oogle Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perf= orm privilege escalation via malicious network traffic. (Chromium security = severity: High) 2026-07-30 not yet calculated CVE-2026-17716 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-17716 ] Google--Chrome Integer overflow in = ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to = potentially perform a sandbox escape via a crafted HTML page. (Chromium sec= urity severity: High) 2026-07-30 not yet calculated CVE-2026-17717 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-17717 ] Google--Chrome Use after free=
in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker=
to potentially perform a sandbox escape via a crafted HTML page. (Chromium=
security severity: High) 2026-07-30 not yet calculated CVE-2026-17718 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-17718 ] Google--Chrome Use after = free in Input in Google Chrome prior to 151.0.7922.72 allowed a remote atta= cker to execute arbitrary code inside a sandbox via a crafted HTML page. (C= hromium security severity: High) 2026-07-30 not yet calculated CVE-2026-177=
19 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17719 ] Google--Chrome Ins= ufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7= 922.72 allowed a remote attacker who had compromised the renderer process t=
o leak cross-origin data via a crafted HTML page. (Chromium security severi= ty: High) 2026-07-30 not yet calculated CVE-2026-17720 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-17720 ] Google--Chrome Out of bounds write in ANG=
LE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to pot= entially perform a sandbox escape via a crafted HTML page. (Chromium securi=
ty severity: High) 2026-07-30 not yet calculated CVE-2026-17721 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-17721 ] Google--Chrome Object lifecycle = issue in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed=
a remote attacker who had compromised the renderer process to potentially = perform a sandbox escape via a crafted HTML page. (Chromium security severi= ty: High) 2026-07-30 not yet calculated CVE-2026-17722 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-17722 ] Google--Chrome Use after free in Media in=
Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker = who had compromised the renderer process to potentially perform a sandbox e= scape via a crafted HTML page. (Chromium security severity: High) 2026-07-3=
0 not yet calculated CVE-2026-17723 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-17723 ] Google--Chrome Race in Chrome for iOS in Google Chrome on iO=
S prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scri= pts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Hi= gh) 2026-07-30 not yet calculated CVE-2026-17724 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-17724 ] Google--Chrome Type Confusion in V8 in Google C= hrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary=
code inside a sandbox via a crafted HTML page. (Chromium security severity=
: High) 2026-07-30 not yet calculated CVE-2026-17725 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-17725 ] Google--Chrome Integer overflow in WebGL in=
Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker =
to potentially perform a sandbox escape via a crafted HTML page. (Chromium = security severity: High) 2026-07-30 not yet calculated CVE-2026-17726 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-17726 ] Google--Chrome Out of boun=
ds write in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowe=
d a remote attacker to potentially perform a sandbox escape via a crafted H= TML page. (Chromium security severity: High) 2026-07-30 not yet calculated = CVE-2026-17727 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17727 ] Google= --Chrome Inappropriate implementation in Extensions in Google Chrome prior =
to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or H= TML (UXSS) via a crafted HTML page. (Chromium security severity: Medium) 20= 26-07-30 not yet calculated CVE-2026-17728 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-17728 ] Google--Chrome Use after free in V8 in Google Chrome = prior to 151.0.7922.72 allowed a remote attacker who had compromised the re= nderer process to potentially perform out of bounds memory access via a cra= fted HTML page. (Chromium security severity: Medium) 2026-07-30 not yet cal= culated CVE-2026-17729 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17729 =
] Google--Chrome Side-channel information leakage in Autofill in Google Chr= ome prior to 151.0.7922.72 allowed a remote attacker who convinced a user t=
o engage in specific UI gestures to leak cross-origin data via a crafted HT=
ML page. (Chromium security severity: Medium) 2026-07-30 not yet calculated=
CVE-2026-17730 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17730 ] Googl= e--Chrome Inappropriate implementation in Autofill in Google Chrome on Andr= oid prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin d= ata via a crafted HTML page. (Chromium security severity: Medium) 2026-07-3=
0 not yet calculated CVE-2026-17731 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-17731 ] Google--Chrome Inappropriate implementation in SVG in Google=
Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-orig=
in data via a crafted HTML page. (Chromium security severity: Medium) 2026-= 07-30 not yet calculated CVE-2026-17732 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-17732 ] Google--Chrome Inappropriate implementation in QUIC in = Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker t=
o leak cross-origin data via a crafted HTML page. (Chromium security severi= ty: Medium) 2026-07-30 not yet calculated CVE-2026-17733 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-17733 ] Google--Chrome Inappropriate implementa= tion in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote a= ttacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.=
(Chromium security severity: Medium) 2026-07-30 not yet calculated CVE-202= 6-17734 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17734 ] Google--Chrom=
e Insufficient validation of untrusted input in BFCache in Google Chrome pr= ior to 151.0.7922.72 allowed a remote attacker who had compromised the rend= erer process to potentially perform a sandbox escape via a crafted HTML pag=
e. (Chromium security severity: Medium) 2026-07-30 not yet calculated CVE-2= 026-17735 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17735 ] Google--Chr= ome Insufficient validation of untrusted input in WebView in Google Chrome =
on Android prior to 151.0.7922.72 allowed a remote attacker who had comprom= ised the renderer process to potentially perform a sandbox escape via a cra= fted HTML page. (Chromium security severity: Medium) 2026-07-30 not yet cal= culated CVE-2026-17736 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17736 =
] Google--Chrome Use after free in Bluetooth in Google Chrome on Android pr= ior to 151.0.7922.72 allowed a remote attacker who had compromised the rend= erer process to potentially perform a sandbox escape via a crafted HTML pag=
e. (Chromium security severity: Medium) 2026-07-30 not yet calculated CVE-2= 026-17737 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17737 ] Google--Chr= ome Insufficient validation of untrusted input in Payments in Google Chrome=
prior to 151.0.7922.72 allowed a remote attacker who had compromised the r= enderer process to potentially perform a sandbox escape via a crafted HTML = page. (Chromium security severity: Medium) 2026-07-30 not yet calculated CV= E-2026-17738 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17738 ] Google--= Chrome Insufficient policy enforcement in Extensions in Google Chrome prior=
to 151.0.7922.72 allowed an attacker who convinced a user to install a mal= icious extension to inject arbitrary scripts or HTML (UXSS) via a crafted C= hrome Extension. (Chromium security severity: Medium) 2026-07-30 not yet ca= lculated CVE-2026-17739 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17739=
] Google--Chrome Uninitialized Use in ANGLE in Google Chrome prior to 151.= 0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted=
HTML page. (Chromium security severity: Medium) 2026-07-30 not yet calcula= ted CVE-2026-17740 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17740 ] Go= ogle--Chrome Insufficient validation of untrusted input in WebView in Googl=
e Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to pot= entially perform a sandbox escape via a crafted HTML page. (Chromium securi=
ty severity: Medium) 2026-07-30 not yet calculated CVE-2026-17741 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-17741 ] Google--Chrome Insufficient po= licy enforcement in Payments in Google Chrome prior to 151.0.7922.72 allowe=
d a remote attacker to leak cross-origin data via a crafted HTML page. (Chr= omium security severity: Medium) 2026-07-30 not yet calculated CVE-2026-177=
42 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17742 ] Google--Chrome Ins= ufficient policy enforcement in ControlledFrame in Google Chrome prior to 1= 51.0.7922.72 allowed a remote attacker to bypass same origin policy via a c= rafted HTML page. (Chromium security severity: Medium) 2026-07-30 not yet c= alculated CVE-2026-17743 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1774=
3 ] Google--Chrome Inappropriate implementation in File Input in Google Chr= ome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentiall=
y perform a sandbox escape via a crafted HTML page. (Chromium security seve= rity: Medium) 2026-07-30 not yet calculated CVE-2026-17744 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-17744 ] Google--Chrome Out of bounds read in = Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who = had compromised the renderer process to potentially perform a sandbox escap=
e via a crafted HTML page. (Chromium security severity: Medium) 2026-07-30 = not yet calculated CVE-2026-17745 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-17745 ] Google--Chrome Use after free in GPU in Google Chrome on Mac p= rior to 151.0.7922.72 allowed a remote attacker who had compromised the ren= derer process to potentially perform a sandbox escape via a crafted HTML pa= ge. (Chromium security severity: Medium) 2026-07-30 not yet calculated CVE-= 2026-17746 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17746 ] Google--Ch= rome Insufficient validation of untrusted input in Payments in Google Chrom=
e on Android prior to 151.0.7922.72 allowed a remote attacker who had compr= omised the renderer process to perform UI spoofing via a crafted HTML page.=
(Chromium security severity: Medium) 2026-07-30 not yet calculated CVE-202= 6-17747 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17747 ] Google--Chrom=
e Inappropriate implementation in Extensions in Google Chrome prior to 151.= 0.7922.72 allowed a remote attacker who had compromised the renderer proces=
s to bypass site isolation via a crafted HTML page. (Chromium security seve= rity: Medium) 2026-07-30 not yet calculated CVE-2026-17748 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-17748 ] Google--Chrome Insufficient validatio=
n of untrusted input in Extensions in Google Chrome prior to 151.0.7922.72 = allowed an attacker who convinced a user to install a malicious extension t=
o potentially perform a sandbox escape via a crafted Chrome Extension. (Chr= omium security severity: Medium) 2026-07-30 not yet calculated CVE-2026-177=
49 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17749 ] Google--Chrome Use=
after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remo=
te attacker to potentially perform a sandbox escape via a crafted HTML page=
. (Chromium security severity: Medium) 2026-07-30 not yet calculated CVE-20= 26-17750 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17750 ] Google--Chro=
me Inappropriate implementation in AdFilter in Google Chrome prior to 151.0= .7922.72 allowed a remote attacker to execute arbitrary code inside a sandb=
ox via a crafted HTML page. (Chromium security severity: Medium) 2026-07-30=
not yet calculated CVE-2026-17751 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-17751 ] Google--Chrome Use after free in Views in Google Chrome on Ma=
c prior to 151.0.7922.72 allowed a remote attacker to potentially exploit h= eap corruption via a crafted HTML page. (Chromium security severity: Medium=
) 2026-07-30 not yet calculated CVE-2026-17752 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-17752 ] Google--Chrome Inappropriate implementation in Au= tofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to=
leak cross-origin data via a crafted HTML page. (Chromium security severit=
y: Medium) 2026-07-30 not yet calculated CVE-2026-17753 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-17753 ] Google--Chrome Inappropriate implementat= ion in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attac= ker to bypass same origin policy via a crafted HTML page. (Chromium securit=
y severity: Medium) 2026-07-30 not yet calculated CVE-2026-17754 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-17754 ] Google--Chrome Incorrect securi=
ty UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an atta= cker who convinced a user to install a malicious extension to perform UI sp= oofing via a crafted Chrome Extension. (Chromium security severity: Medium)=
2026-07-30 not yet calculated CVE-2026-17755 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-17755 ] Google--Chrome Insufficient policy enforcement in = Presentation in Google Chrome prior to 151.0.7922.72 allowed a remote attac= ker to bypass navigation restrictions via a crafted HTML page. (Chromium se= curity severity: Medium) 2026-07-30 not yet calculated CVE-2026-17756 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-17756 ] Google--Chrome Uninitializ=
ed Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote att= acker to leak cross-origin data via a crafted HTML page. (Chromium security=
severity: Medium) 2026-07-30 not yet calculated CVE-2026-17757 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-17757 ] Google--Chrome Heap buffer overf= low in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attack=
er to potentially perform a sandbox escape via a crafted HTML page. (Chromi=
um security severity: Medium) 2026-07-30 not yet calculated CVE-2026-17758 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-17758 ] Google--Chrome Uninit= ialized Use in Codecs in Google Chrome prior to 151.0.7922.72 allowed a rem= ote attacker to obtain potentially sensitive information from process memor=
y via a crafted HTML page. (Chromium security severity: Medium) 2026-07-30 = not yet calculated CVE-2026-17759 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-17759 ] Google--Chrome Side-channel information leakage in NoStatePref= etch in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to l= eak cross-origin data via a crafted HTML page. (Chromium security severity:=
Medium) 2026-07-30 not yet calculated CVE-2026-17760 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-17760 ] Google--Chrome Insufficient validation of = untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.79= 22.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) = via malicious network traffic. (Chromium security severity: Medium) 2026-07= -30 not yet calculated CVE-2026-17761 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-17761 ] Google--Chrome Inappropriate implementation in Chrome for = iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacke=
r to leak cross-origin data via a crafted HTML page. (Chromium security sev= erity: Medium) 2026-07-30 not yet calculated CVE-2026-17762 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-17762 ] Google--Chrome Inappropriate impleme= ntation in GPU in Google Chrome prior to 151.0.7922.72 allowed a remote att= acker who had compromised the renderer process to leak cross-origin data vi=
a a crafted HTML page. (Chromium security severity: Medium) 2026-07-30 not = yet calculated CVE-2026-17763 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -17763 ] Google--Chrome Inappropriate implementation in FedCM in Google Chr= ome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin = policy via a crafted HTML page. (Chromium security severity: Medium) 2026-0= 7-30 not yet calculated CVE-2026-17764 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-17764 ] Google--Chrome Inappropriate implementation in WebProte=
ct in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who ha=
d compromised the renderer process to leak cross-origin data via a crafted = HTML page. (Chromium security severity: Medium) 2026-07-30 not yet calculat=
ed CVE-2026-17765 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17765 ] Goo= gle--Chrome Insufficient validation of untrusted input in Clipboard in Goog=
le Chrome on Android prior to 151.0.7922.72 allowed a local attacker to lea=
k cross-origin data via a crafted HTML page. (Chromium security severity: M= edium) 2026-07-30 not yet calculated CVE-2026-17766 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-17766 ] Google--Chrome Insufficient validation of un= trusted input in WebView in Google Chrome on Android prior to 151.0.7922.72=
allowed a remote attacker who had compromised the renderer process to leak=
cross-origin data via a crafted HTML page. (Chromium security severity: Me= dium) 2026-07-30 not yet calculated CVE-2026-17767 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-17767 ] Google--Chrome Insufficient validation of unt= rusted input in WebSockets in Google Chrome prior to 151.0.7922.72 allowed =
a remote attacker who had compromised the renderer process to potentially p= erform a sandbox escape via a crafted HTML page. (Chromium security severit=
y: Medium) 2026-07-30 not yet calculated CVE-2026-17768 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-17768 ] Google--Chrome Insufficient validation o=
f untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a=
remote attacker to leak cross-origin data via a crafted HTML page. (Chromi=
um security severity: Medium) 2026-07-30 not yet calculated CVE-2026-17769 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-17769 ] Google--Chrome Out of=
bounds read in Media in Google Chrome on Mac prior to 151.0.7922.72 allowe=
d a remote attacker who had compromised the renderer process to potentially=
perform a sandbox escape via a crafted HTML page. (Chromium security sever= ity: Medium) 2026-07-30 not yet calculated CVE-2026-17770 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-17770 ] Google--Chrome Uninitialized Use in Sk=
ia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to lea=
k cross-origin data via a crafted HTML page. (Chromium security severity: M= edium) 2026-07-30 not yet calculated CVE-2026-17771 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-17771 ] Google--Chrome Out of bounds read in WebGL i=
n Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform=
an out of bounds memory read via a crafted HTML page. (Chromium security s= everity: Medium) 2026-07-30 not yet calculated CVE-2026-17772 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-17772 ] Google--Chrome Insufficient valida= tion of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 all= owed a remote attacker to leak cross-origin data via a crafted HTML page. (= Chromium security severity: Medium) 2026-07-30 not yet calculated CVE-2026-= 17773 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17773 ] Google--Chrome = Insufficient validation of untrusted input in Variations in Google Chrome p= rior to 151.0.7922.72 allowed an attacker in a privileged network position =
to potentially exploit heap corruption via malicious network traffic. (Chro= mium security severity: Medium) 2026-07-30 not yet calculated CVE-2026-1777=
4 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17774 ] Google--Chrome Inap= propriate implementation in PresentationAPI in Google Chrome prior to 151.0= .7922.72 allowed a remote attacker to leak cross-origin data via a crafted = HTML page. (Chromium security severity: Medium) 2026-07-30 not yet calculat=
ed CVE-2026-17775 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17775 ] Goo= gle--Chrome Policy bypass in Receiver in Google Chrome prior to 151.0.7922.=
72 allowed a remote attacker who had compromised the renderer process to po= tentially perform a sandbox escape via a crafted HTML page. (Chromium secur= ity severity: Medium) 2026-07-30 not yet calculated CVE-2026-17776 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-17776 ] Google--Chrome Inappropriate = implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed =
a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom= ium security severity: Medium) 2026-07-30 not yet calculated CVE-2026-17777=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-17777 ] Google--Chrome Use a= fter free in Extensions in Google Chrome prior to 151.0.7922.72 allowed a r= emote attacker to execute arbitrary code inside a sandbox via a crafted Chr= ome Extension. (Chromium security severity: Medium) 2026-07-30 not yet calc= ulated CVE-2026-17778 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17778 ]=
Google--Chrome Inappropriate implementation in Site Isolation in Google Ch= rome prior to 151.0.7922.72 allowed a remote attacker to bypass site isolat= ion via a crafted HTML page. (Chromium security severity: Medium) 2026-07-3=
0 not yet calculated CVE-2026-17779 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-17779 ] Google--Chrome Inappropriate implementation in Isolated Web = Apps in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to b= ypass navigation restrictions via a crafted HTML page. (Chromium security s= everity: Medium) 2026-07-30 not yet calculated CVE-2026-17780 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-17780 ] Google--Chrome Inappropriate imple= mentation in Extensions in Google Chrome prior to 151.0.7922.72 allowed an = attacker who convinced a user to install a malicious extension to leak cros= s-origin data via a crafted Chrome Extension. (Chromium security severity: = Medium) 2026-07-30 not yet calculated CVE-2026-17781 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-17781 ] Google--Chrome Incorrect security UI in Chr= ome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote=
attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML=
page. (Chromium security severity: Medium) 2026-07-30 not yet calculated C= VE-2026-17782 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17782 ] Google-= -Chrome Inappropriate implementation in Loader in Google Chrome prior to 15= 1.0.7922.72 allowed a remote attacker to leak cross-origin data via a craft=
ed HTML page. (Chromium security severity: Medium) 2026-07-30 not yet calcu= lated CVE-2026-17783 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17783 ] = Google--Chrome Use after free in Audio in Google Chrome on Mac prior to 151= .0.7922.72 allowed a remote attacker who had compromised the renderer proce=
ss to potentially perform a sandbox escape via a crafted HTML page. (Chromi=
um security severity: Medium) 2026-07-30 not yet calculated CVE-2026-17784 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-17784 ] Google--Chrome Uninit= ialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remo=
te attacker to leak cross-origin data via a crafted HTML page. (Chromium se= curity severity: Medium) 2026-07-30 not yet calculated CVE-2026-17785 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-17785 ] Google--Chrome Insufficien=
t validation of untrusted input in DevTools in Google Chrome prior to 151.0= .7922.72 allowed an attacker who convinced a user to install a malicious ex= tension to perform privilege escalation via a crafted Chrome Extension. (Ch= romium security severity: Medium) 2026-07-30 not yet calculated CVE-2026-17= 786 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17786 ] Google--Chrome In= appropriate implementation in DevTools in Google Chrome prior to 151.0.7922= .72 allowed a remote attacker to bypass same origin policy via a crafted HT=
ML page. (Chromium security severity: Medium) 2026-07-30 not yet calculated=
CVE-2026-17787 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17787 ] Googl= e--Chrome Inappropriate implementation in Blink in Google Chrome prior to 1= 51.0.7922.72 allowed a remote attacker to leak cross-origin data via a craf= ted HTML page. (Chromium security severity: Medium) 2026-07-30 not yet calc= ulated CVE-2026-17788 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17788 ]=
Google--Chrome Insufficient validation of untrusted input in Chrome for iO=
S in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker =
to bypass navigation restrictions via malicious network traffic. (Chromium = security severity: Medium) 2026-07-30 not yet calculated CVE-2026-17789 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-17789 ] Google--Chrome Uninitial= ized Use in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowe=
d a remote attacker to obtain potentially sensitive information from proces=
s memory via a crafted HTML page. (Chromium security severity: Medium) 2026= -07-30 not yet calculated CVE-2026-17790 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-17790 ] Google--Chrome Insufficient validation of untrusted inp=
ut in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote att= acker who had compromised the renderer process to perform UI spoofing via a=
crafted HTML page. (Chromium security severity: Medium) 2026-07-30 not yet=
calculated CVE-2026-17791 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17= 791 ] Google--Chrome Inappropriate implementation in Credential Management =
in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perfor=
m UI spoofing via a crafted HTML page. (Chromium security severity: Medium)=
2026-07-30 not yet calculated CVE-2026-17792 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-17792 ] Google--Chrome Inappropriate implementation in Mes= sages in Google Chrome on Android prior to 151.0.7922.72 allowed a remote a= ttacker to perform UI spoofing via a crafted HTML page. (Chromium security = severity: Medium) 2026-07-30 not yet calculated CVE-2026-17793 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-17793 ] Google--Chrome Insufficient valid= ation of untrusted input in Mobile in Google Chrome on Android prior to 151= .0.7922.72 allowed a remote attacker who had compromised the renderer proce=
ss to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. = (Chromium security severity: Medium) 2026-07-30 not yet calculated CVE-2026= -17794 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17794 ] Google--Chrome=
Inappropriate implementation in GetUserMedia in Google Chrome prior to 151= .0.7922.72 allowed a remote attacker who had compromised the renderer proce=
ss to leak cross-origin data via a crafted HTML page. (Chromium security se= verity: Medium) 2026-07-30 not yet calculated CVE-2026-17795 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-17795 ] Google--Chrome Side-channel informa= tion leakage in WebXR in Google Chrome prior to 151.0.7922.72 allowed a rem= ote attacker to obtain potentially sensitive information from process memor=
y via a crafted HTML page. (Chromium security severity: Medium) 2026-07-30 = not yet calculated CVE-2026-17796 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-17796 ] Google--Chrome Inappropriate implementation in CSS in Google C= hrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary = scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity=
: Medium) 2026-07-30 not yet calculated CVE-2026-17797 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-17797 ] Google--Chrome Inappropriate implementati=
on in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacke=
r to leak cross-origin data via a crafted HTML page. (Chromium security sev= erity: Medium) 2026-07-30 not yet calculated CVE-2026-17798 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-17798 ] Google--Chrome Insufficient validati=
on of untrusted input in Safe Browsing in Google Chrome prior to 151.0.7922= .72 allowed a remote attacker to bypass discretionary access control via a = malicious file. (Chromium security severity: Medium) 2026-07-30 not yet cal= culated CVE-2026-17799 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17799 =
] Google--Chrome Inappropriate implementation in MediaRecording in Google C= hrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentiall=
y sensitive information from process memory via a crafted HTML page. (Chrom= ium security severity: Medium) 2026-07-30 not yet calculated CVE-2026-17800=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-17800 ] Google--Chrome Out o=
f bounds read and write in ANGLE in Google Chrome prior to 151.0.7922.72 al= lowed a remote attacker to potentially perform a sandbox escape via a craft=
ed HTML page. (Chromium security severity: Medium) 2026-07-30 not yet calcu= lated CVE-2026-17801 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17801 ] = Google--Chrome Side-channel information leakage in GPU in Google Chrome on = Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-orig=
in data via a crafted HTML page. (Chromium security severity: Medium) 2026-= 07-30 not yet calculated CVE-2026-17802 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-17802 ] Google--Chrome Insufficient validation of untrusted inp=
ut in Save to Drive in Google Chrome prior to 151.0.7922.72 allowed a remot=
e attacker who had compromised the renderer process to potentially perform =
a sandbox escape via a crafted PDF file. (Chromium security severity: Mediu=
m) 2026-07-30 not yet calculated CVE-2026-17803 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-17803 ] Google--Chrome Use after free in Media in Google=
Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromise=
d the renderer process to potentially perform a sandbox escape via a crafte=
d HTML page. (Chromium security severity: Medium) 2026-07-30 not yet calcul= ated CVE-2026-17804 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17804 ] G= oogle--Chrome Insufficient policy enforcement in Glic in Google Chrome on A= ndroid prior to 151.0.7922.72 allowed a remote attacker to bypass navigatio=
n restrictions via a crafted HTML page. (Chromium security severity: Medium=
) 2026-07-30 not yet calculated CVE-2026-17805 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-17805 ] Google--Chrome Insufficient validation of untrust=
ed input in Extensions in Google Chrome prior to 151.0.7922.72 allowed a re= mote attacker who had compromised the renderer process to potentially perfo=
rm a sandbox escape via a crafted HTML page. (Chromium security severity: M= edium) 2026-07-30 not yet calculated CVE-2026-17806 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-17806 ] Google--Chrome Use after free in V8 in Googl=
e Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitr= ary code inside a sandbox via a crafted HTML page. (Chromium security sever= ity: Medium) 2026-07-30 not yet calculated CVE-2026-17807 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-17807 ] Google--Chrome Uninitialized Use in We= bGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote att= acker to leak cross-origin data via a crafted HTML page. (Chromium security=
severity: Medium) 2026-07-30 not yet calculated CVE-2026-17808 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-17808 ] Google--Chrome Insufficient vali= dation of untrusted input in Extensions in Google Chrome prior to 151.0.792= 2.72 allowed a remote attacker who had compromised the renderer process to = potentially perform a sandbox escape via a crafted HTML page. (Chromium sec= urity severity: Medium) 2026-07-30 not yet calculated CVE-2026-17809 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-17809 ] Google--Chrome Uninitialize=
d Use in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote atta= cker to leak cross-origin data via a crafted HTML page. (Chromium security = severity: Medium) 2026-07-30 not yet calculated CVE-2026-17810 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-17810 ] Google--Chrome Use after free in = ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote a= ttacker to potentially perform a sandbox escape via a crafted HTML page. (C= hromium security severity: Medium) 2026-07-30 not yet calculated CVE-2026-1= 7811 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17811 ] Google--Chrome I= nappropriate implementation in DigitalCredentials in Google Chrome prior to=
151.0.7922.72 allowed a remote attacker to perform UI spoofing via a craft=
ed HTML page. (Chromium security severity: Medium) 2026-07-30 not yet calcu= lated CVE-2026-17812 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17812 ] = Google--Chrome Insufficient policy enforcement in Chrome for iOS in Google = Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass na= vigation restrictions via a crafted HTML page. (Chromium security severity:=
Medium) 2026-07-30 not yet calculated CVE-2026-17813 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-17813 ] Google--Chrome Insufficient validation of = untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.79= 22.72 allowed a remote attacker to bypass navigation restrictions via a cra= fted HTML page. (Chromium security severity: Medium) 2026-07-30 not yet cal= culated CVE-2026-17814 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17814 =
] Google--Chrome Insufficient policy enforcement in GuestView in Google Chr= ome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin d= ata via a crafted HTML page. (Chromium security severity: Medium) 2026-07-3=
0 not yet calculated CVE-2026-17815 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-17815 ] Google--Chrome Insufficient policy enforcement in Speech in = Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker w=
ho had compromised the renderer process to perform privilege escalation via=
a crafted HTML page. (Chromium security severity: Medium) 2026-07-30 not y=
et calculated CVE-2026-17816 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 17816 ] Google--Chrome Inappropriate implementation in ReportingAndNEL in G= oogle Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross= -origin data via a crafted HTML page. (Chromium security severity: Medium) = 2026-07-30 not yet calculated CVE-2026-17817 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-17817 ] Google--Chrome Inappropriate implementation in Netw= ork in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to in= ject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium se= curity severity: Medium) 2026-07-30 not yet calculated CVE-2026-17818 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-17818 ] Google--Chrome Inappropria=
te implementation in WebAppInstalls in Google Chrome prior to 151.0.7922.72=
allowed a remote attacker to perform UI spoofing via a crafted HTML page. = (Chromium security severity: Medium) 2026-07-30 not yet calculated CVE-2026= -17819 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17819 ] Google--Chrome=
Insufficient policy enforcement in Autofill in Google Chrome prior to 151.= 0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted=
HTML page. (Chromium security severity: Medium) 2026-07-30 not yet calcula= ted CVE-2026-17820 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17820 ] Go= ogle--Chrome Insufficient policy enforcement in Extensions in Google Chrome=
prior to 151.0.7922.72 allowed an attacker who convinced a user to install=
a malicious extension to bypass navigation restrictions via a crafted Chro=
me Extension. (Chromium security severity: Medium) 2026-07-30 not yet calcu= lated CVE-2026-17821 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17821 ] = Google--Chrome Race in Chrome for iOS in Google Chrome on iOS prior to 151.= 0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HT=
ML page. (Chromium security severity: Medium) 2026-07-30 not yet calculated=
CVE-2026-17822 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17822 ] Googl= e--Chrome Insufficient policy enforcement in WebXR in Google Chrome prior t=
o 151.0.7922.72 allowed a remote attacker to bypass same origin policy via =
a crafted HTML page. (Chromium security severity: Medium) 2026-07-30 not ye=
t calculated CVE-2026-17823 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1= 7823 ] Google--Chrome Insufficient policy enforcement in ServiceWorker in G= oogle Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass sam=
e origin policy via a crafted HTML page. (Chromium security severity: Mediu=
m) 2026-07-30 not yet calculated CVE-2026-17824 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-17824 ] Google--Chrome Insufficient policy enforcement i=
n Passwords in Google Chrome on Android prior to 151.0.7922.72 allowed a re= mote attacker to bypass discretionary access control via a crafted HTML pag=
e. (Chromium security severity: Medium) 2026-07-30 not yet calculated CVE-2= 026-17825 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17825 ] Google--Chr= ome Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 151.0.7922.72 allowed a remote attacker who convinced a user to en= gage in specific UI gestures to leak cross-origin data via a crafted HTML p= age. (Chromium security severity: Medium) 2026-07-30 not yet calculated CVE= -2026-17826 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17826 ] Google--C= hrome Inappropriate implementation in CSS in Google Chrome prior to 151.0.7= 922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS)=
via a crafted HTML page. (Chromium security severity: Medium) 2026-07-30 n=
ot yet calculated CVE-2026-17827 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-17827 ] Google--Chrome Inappropriate implementation in Chrome for iOS i=
n Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to = perform UI spoofing via a crafted HTML page. (Chromium security severity: M= edium) 2026-07-30 not yet calculated CVE-2026-17828 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-17828 ] Google--Chrome Insufficient policy enforceme=
nt in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote at= tacker to leak cross-origin data via a crafted HTML page. (Chromium securit=
y severity: Medium) 2026-07-30 not yet calculated CVE-2026-17829 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-17829 ] Google--Chrome Inappropriate im= plementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.=
72 allowed a remote attacker to bypass navigation restrictions via a crafte=
d HTML page. (Chromium security severity: Medium) 2026-07-30 not yet calcul= ated CVE-2026-17830 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17830 ] G= oogle--Chrome Insufficient validation of untrusted input in Passwords in Go= ogle Chrome prior to 151.0.7922.72 allowed a remote attacker who had compro= mised the renderer process to perform UI spoofing via a crafted HTML page. = (Chromium security severity: Medium) 2026-07-30 not yet calculated CVE-2026= -17831 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17831 ] Google--Chrome=
Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a = remote attacker who had compromised the renderer process to potentially per= form a sandbox escape via a crafted HTML page. (Chromium security severity:=
Medium) 2026-07-30 not yet calculated CVE-2026-17832 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-17832 ] Google--Chrome Inappropriate implementatio=
n in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote att= acker to leak cross-origin data via a crafted HTML page. (Chromium security=
severity: Medium) 2026-07-30 not yet calculated CVE-2026-17833 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-17833 ] Google--Chrome Insufficient vali= dation of untrusted input in Passwords in Google Chrome prior to 151.0.7922= .72 allowed a remote attacker who had compromised the renderer process to p= otentially perform a sandbox escape via a crafted HTML page. (Chromium secu= rity severity: Medium) 2026-07-30 not yet calculated CVE-2026-17834 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-17834 ] Google--Chrome Inappropriate=
implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.79= 22.72 allowed a remote attacker to perform UI spoofing via a crafted HTML p= age. (Chromium security severity: Medium) 2026-07-30 not yet calculated CVE= -2026-17835 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17835 ] Google--C= hrome Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed =
a remote attacker to execute arbitrary code inside a sandbox via a crafted = HTML page. (Chromium security severity: Medium) 2026-07-30 not yet calculat=
ed CVE-2026-17836 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17836 ] Goo= gle--Chrome Insufficient validation of untrusted input in DevTools in Googl=
e Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromis=
ed the renderer process to potentially perform a sandbox escape via a craft=
ed HTML page. (Chromium security severity: Medium) 2026-07-30 not yet calcu= lated CVE-2026-17837 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17837 ] = Google--Chrome Incorrect security UI in Chrome for iOS in Google Chrome on = iOS prior to 151.0.7922.72 allowed a remote attacker to perform domain spoo= fing via a crafted HTML page. (Chromium security severity: Medium) 2026-07-=
30 not yet calculated CVE-2026-17838 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-17838 ] Google--Chrome Inappropriate implementation in Chrome for i=
OS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker=
to perform UI spoofing via a crafted HTML page. (Chromium security severit=
y: Medium) 2026-07-30 not yet calculated CVE-2026-17839 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-17839 ] Google--Chrome Incorrect security UI in = Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker=
to perform domain spoofing via a crafted HTML page. (Chromium security sev= erity: Medium) 2026-07-30 not yet calculated CVE-2026-17840 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-17840 ] Google--Chrome Race in Chrome for iO=
S in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker =
to perform UI spoofing via a crafted HTML page. (Chromium security severity=
: Medium) 2026-07-30 not yet calculated CVE-2026-17841 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-17841 ] Google--Chrome Inappropriate implementati=
on in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed=
a remote attacker who convinced a user to engage in specific UI gestures t=
o bypass same origin policy via a crafted HTML page. (Chromium security sev= erity: Medium) 2026-07-30 not yet calculated CVE-2026-17842 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-17842 ] Google--Chrome Inappropriate impleme= ntation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote att= acker to leak cross-origin data via a crafted HTML page. (Chromium security=
severity: Medium) 2026-07-30 not yet calculated CVE-2026-17843 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-17843 ] Google--Chrome Insufficient vali= dation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 a= llowed an attacker on the local network segment to leak cross-origin data v=
ia malicious network traffic. (Chromium security severity: Medium) 2026-07-=
30 not yet calculated CVE-2026-17844 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-17844 ] Google--Chrome Inappropriate implementation in CSS in Googl=
e Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitra=
ry scripts or HTML (UXSS) via a crafted HTML page. (Chromium security sever= ity: Medium) 2026-07-30 not yet calculated CVE-2026-17845 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-17845 ] Google--Chrome Inappropriate implement= ation in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a=
remote attacker who had compromised the renderer process to bypass same or= igin policy via a crafted HTML page. (Chromium security severity: Medium) 2= 026-07-30 not yet calculated CVE-2026-17846 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-17846 ] Google--Chrome Insufficient validation of untrusted = input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote att= acker to potentially perform a sandbox escape via a crafted HTML page. (Chr= omium security severity: Medium) 2026-07-30 not yet calculated CVE-2026-178=
47 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17847 ] Google--Chrome Int= eger overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowed a r= emote attacker to potentially perform a sandbox escape via a crafted video = file. (Chromium security severity: Medium) 2026-07-30 not yet calculated CV= E-2026-17848 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17848 ] Google--= Chrome Inappropriate implementation in Chrome for iOS in Google Chrome on i=
OS prior to 151.0.7922.72 allowed a remote attacker to spoof the contents o=
f the Omnibox (URL bar) via malicious network traffic. (Chromium security s= everity: Medium) 2026-07-30 not yet calculated CVE-2026-17849 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-17849 ] Google--Chrome Inappropriate imple= mentation in Permissions in Google Chrome prior to 151.0.7922.72 allowed a = remote attacker to bypass same origin policy via a crafted HTML page. (Chro= mium security severity: Medium) 2026-07-30 not yet calculated CVE-2026-1785=
0 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17850 ] Google--Chrome Side= -channel information leakage in Autofill in Google Chrome prior to 151.0.79= 22.72 allowed a remote attacker who had compromised the renderer process to=
leak cross-origin data via a crafted HTML page. (Chromium security severit=
y: Medium) 2026-07-30 not yet calculated CVE-2026-17851 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-17851 ] Google--Chrome Inappropriate implementat= ion in Media Router in Google Chrome prior to 151.0.7922.72 allowed a remot=
e attacker to bypass same origin policy via a crafted HTML page. (Chromium = security severity: Medium) 2026-07-30 not yet calculated CVE-2026-17852 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-17852 ] Google--Chrome Inappropr= iate implementation in DevTools in Google Chrome prior to 151.0.7922.72 all= owed a remote attacker who had compromised the renderer process to inject s= cripts or HTML into a privileged page via a crafted HTML page. (Chromium se= curity severity: Medium) 2026-07-30 not yet calculated CVE-2026-17853 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-17853 ] Google--Chrome Insufficien=
t policy enforcement in WebMCP in Google Chrome prior to 151.0.7922.72 allo= wed a remote attacker to bypass same origin policy via a crafted HTML page.=
(Chromium security severity: Medium) 2026-07-30 not yet calculated CVE-202= 6-17854 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17854 ] Google--Chrom=
e Race in DevTools in Google Chrome on Mac prior to 151.0.7922.72 allowed a=
remote attacker who had compromised the renderer process to potentially pe= rform a sandbox escape via a crafted HTML page. (Chromium security severity=
: Medium) 2026-07-30 not yet calculated CVE-2026-17855 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-17855 ] Google--Chrome Inappropriate implementati=
on in Network in Google Chrome on Mac prior to 151.0.7922.72 allowed a remo=
te attacker who had compromised the renderer process to potentially perform=
a sandbox escape via a crafted HTML page. (Chromium security severity: Med= ium) 2026-07-30 not yet calculated CVE-2026-17856 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-17856 ] Google--Chrome Inappropriate implementation in=
Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker =
to leak cross-origin data via a crafted HTML page. (Chromium security sever= ity: Medium) 2026-07-30 not yet calculated CVE-2026-17857 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-17857 ] Google--Chrome Uninitialized Use in We= bNN in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote att= acker to leak cross-origin data via a crafted HTML page. (Chromium security=
severity: Medium) 2026-07-30 not yet calculated CVE-2026-17858 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-17858 ] Google--Chrome Inappropriate imp= lementation in Favicons in Google Chrome prior to 151.0.7922.72 allowed a r= emote attacker to leak cross-origin data via a crafted HTML page. (Chromium=
security severity: Medium) 2026-07-30 not yet calculated CVE-2026-17859 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-17859 ] Google--Chrome Insuffic= ient validation of untrusted input in Mobile in Google Chrome on Android pr= ior to 151.0.7922.72 allowed a local attacker to spoof the contents of the = Omnibox (URL bar) via a malicious file. (Chromium security severity: Medium=
) 2026-07-30 not yet calculated CVE-2026-17860 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-17860 ] Google--Chrome Insufficient validation of untrust=
ed input in Updater in Google Chrome prior to 151.0.7922.72 allowed a local=
attacker to perform OS-level privilege escalation via a malicious file. (C= hromium security severity: Medium) 2026-07-30 not yet calculated CVE-2026-1= 7861 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17861 ] Google--Chrome U=
se after free in Tracing in Google Chrome on Windows prior to 151.0.7922.72=
allowed a local attacker to perform OS-level privilege escalation via a ma= licious file. (Chromium security severity: Medium) 2026-07-30 not yet calcu= lated CVE-2026-17862 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17862 ] = Google--Chrome Inappropriate implementation in Browser in Google Chrome on = Windows prior to 151.0.7922.72 allowed a local attacker to perform privileg=
e escalation via a malicious file. (Chromium security severity: Medium) 202= 6-07-30 not yet calculated CVE-2026-17863 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-17863 ] Google--Chrome Inappropriate implementation in Updater=
in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to=
perform OS-level privilege escalation via a malicious file. (Chromium secu= rity severity: Medium) 2026-07-30 not yet calculated CVE-2026-17864 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-17864 ] Google--Chrome Inappropriate=
implementation in Crypto in Google Chrome on Mac prior to 151.0.7922.72 al= lowed a remote attacker who had compromised the renderer process to potenti= ally perform a sandbox escape via a crafted HTML page. (Chromium security s= everity: Medium) 2026-07-30 not yet calculated CVE-2026-17865 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-17865 ] Google--Chrome Type Confusion in T=
ab in Google Chrome on Android prior to 151.0.7922.72 allowed a remote atta= cker who had compromised the renderer process to potentially perform a sand= box escape via a crafted HTML page. (Chromium security severity: Medium) 20= 26-07-30 not yet calculated CVE-2026-17866 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-17866 ] Google--Chrome Insufficient validation of untrusted i= nput in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attac= ker to potentially perform a sandbox escape via a crafted HTML page. (Chrom= ium security severity: Medium) 2026-07-30 not yet calculated CVE-2026-17867=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-17867 ] Google--Chrome Insuf= ficient policy enforcement in USB in Google Chrome prior to 151.0.7922.72 a= llowed a remote attacker to perform privilege escalation via a crafted HTML=
page. (Chromium security severity: Medium) 2026-07-30 not yet calculated C= VE-2026-17868 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17868 ] Google-= -Chrome Out of bounds read in WebXR in Google Chrome prior to 151.0.7922.72=
allowed a remote attacker to perform an out of bounds memory read via a cr= afted HTML page. (Chromium security severity: Medium) 2026-07-30 not yet ca= lculated CVE-2026-17869 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17869=
] Google--Chrome Insufficient validation of untrusted input in Cast in Goo= gle Chrome prior to 151.0.7922.72 allowed an attacker on the local network = segment to leak cross-origin data via malicious network traffic. (Chromium = security severity: Medium) 2026-07-30 not yet calculated CVE-2026-17870 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-17870 ] Google--Chrome Inappropr= iate implementation in Passwords in Google Chrome prior to 151.0.7922.72 al= lowed a remote attacker who convinced a user to engage in specific UI gestu= res to leak cross-origin data via a crafted HTML page. (Chromium security s= everity: Medium) 2026-07-30 not yet calculated CVE-2026-17871 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-17871 ] Google--Chrome Cryptographic Flaw =
in WebAppInstalls in Google Chrome on Android prior to 151.0.7922.72 allowe=
d a local attacker to potentially perform a sandbox escape via a crafted HT=
ML page. (Chromium security severity: Medium) 2026-07-30 not yet calculated=
CVE-2026-17872 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17872 ] Googl= e--Chrome Insufficient policy enforcement in Chrome for iOS in Google Chrom=
e on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass discret= ionary access control via a crafted HTML page. (Chromium security severity:=
Medium) 2026-07-30 not yet calculated CVE-2026-17873 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-17873 ] Google--Chrome Inappropriate implementatio=
n in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed =
a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium=
security severity: Medium) 2026-07-30 not yet calculated CVE-2026-17874 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-17874 ] Google--Chrome Use afte=
r free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote a= ttacker to execute arbitrary code inside a sandbox via a crafted PDF file. = (Chromium security severity: Medium) 2026-07-30 not yet calculated CVE-2026= -17875 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17875 ] Google--Chrome=
Inappropriate implementation in Payments in Google Chrome prior to 151.0.7= 922.72 allowed a remote attacker to leak cross-origin data via a crafted HT=
ML page. (Chromium security severity: Medium) 2026-07-30 not yet calculated=
CVE-2026-17876 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17876 ] Googl= e--Chrome Inappropriate implementation in Chromoting in Google Chrome on Li= nux prior to 151.0.7922.72 allowed a local attacker to perform OS-level pri= vilege escalation via malicious network traffic. (Chromium security severit=
y: Medium) 2026-07-30 not yet calculated CVE-2026-17877 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-17877 ] Google--Chrome Inappropriate implementat= ion in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacke=
r to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chro= mium security severity: Medium) 2026-07-30 not yet calculated CVE-2026-1787=
8 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17878 ] Google--Chrome Inap= propriate implementation in Autofill in Google Chrome prior to 151.0.7922.7=
2 allowed a remote attacker to leak cross-origin data via a crafted HTML pa= ge. (Chromium security severity: Medium) 2026-07-30 not yet calculated CVE-= 2026-17879 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17879 ] Google--Ch= rome Inappropriate implementation in Autofill in Google Chrome prior to 151= .0.7922.72 allowed a remote attacker to leak cross-origin data via a crafte=
d HTML page. (Chromium security severity: Medium) 2026-07-30 not yet calcul= ated CVE-2026-17880 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17880 ] G= oogle--Chrome Integer overflow in WebXR in Google Chrome prior to 151.0.792= 2.72 allowed a remote attacker to execute arbitrary code inside a sandbox v=
ia a crafted HTML page. (Chromium security severity: Medium) 2026-07-30 not=
yet calculated CVE-2026-17881 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-17881 ] Google--Chrome Policy bypass in Extensions in Google Chrome prior=
to 151.0.7922.72 allowed an attacker who convinced a user to install a mal= icious extension to bypass site isolation via a crafted Chrome Extension. (= Chromium security severity: Medium) 2026-07-30 not yet calculated CVE-2026-= 17882 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17882 ] Google--Chrome = Inappropriate implementation in Headless in Google Chrome prior to 151.0.79= 22.72 allowed a remote attacker to bypass same origin policy via a crafted = HTML page. (Chromium security severity: Medium) 2026-07-30 not yet calculat=
ed CVE-2026-17883 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17883 ] Goo= gle--Chrome Object lifecycle issue in WebRTC in Google Chrome prior to 151.= 0.7922.72 allowed a remote attacker to potentially exploit heap corruption = via a crafted HTML page. (Chromium security severity: Medium) 2026-07-30 no=
t yet calculated CVE-2026-17884 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-17884 ] Google--Chrome Inappropriate implementation in Paint in Google C= hrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin=
data via a crafted HTML page. (Chromium security severity: Medium) 2026-07= -30 not yet calculated CVE-2026-17885 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-17885 ] Google--Chrome Use after free in Enterprise in Google Chro=
me prior to 151.0.7922.72 allowed a remote attacker to potentially exploit = heap corruption via a crafted HTML page. (Chromium security severity: Mediu=
m) 2026-07-30 not yet calculated CVE-2026-17886 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-17886 ] Google--Chrome Use after free in TabStrip in Goo= gle Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a=
user to engage in specific UI gestures to potentially exploit heap corrupt= ion via a crafted HTML page. (Chromium security severity: Medium) 2026-07-3=
0 not yet calculated CVE-2026-17887 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-17887 ] Google--Chrome Insufficient validation of untrusted input in=
WebUI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to=
potentially perform a sandbox escape via malicious network traffic. (Chrom= ium security severity: Medium) 2026-07-30 not yet calculated CVE-2026-17888=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-17888 ] Google--Chrome Unini= tialized Use in WebXR in Google Chrome prior to 151.0.7922.72 allowed a rem= ote attacker to leak cross-origin data via a crafted HTML page. (Chromium s= ecurity severity: Medium) 2026-07-30 not yet calculated CVE-2026-17889 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-17889 ] Google--Chrome Insufficie=
nt validation of untrusted input in DevTools in Google Chrome prior to 151.= 0.7922.72 allowed a remote attacker who had compromised the renderer proces=
s to potentially perform a sandbox escape via a crafted HTML page. (Chromiu=
m security severity: Medium) 2026-07-30 not yet calculated CVE-2026-17890 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-17890 ] Google--Chrome Use aft=
er free in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed=
a remote attacker who had compromised the renderer process to potentially = perform a sandbox escape via a crafted HTML page. (Chromium security severi= ty: Medium) 2026-07-30 not yet calculated CVE-2026-17891 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-17891 ] Google--Chrome Inappropriate implementa= tion in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote atta= cker to obtain potentially sensitive information from process memory via a = crafted HTML page. (Chromium security severity: Medium) 2026-07-30 not yet = calculated CVE-2026-17892 [ https://www.cve.org/CVERecord?id=3DCVE-2026-178=
92 ] Google--Chrome Insufficient validation of untrusted input in Updater i=
n Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who=
had compromised the renderer process to potentially perform a sandbox esca=
pe via a crafted HTML page. (Chromium security severity: Medium) 2026-07-30=
not yet calculated CVE-2026-17893 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-17893 ] Google--Chrome Use after free in Views in Google Chrome on Li= nux prior to 151.0.7922.72 allowed a remote attacker to potentially exploit=
heap corruption via a crafted HTML page. (Chromium security severity: Medi= um) 2026-07-30 not yet calculated CVE-2026-17894 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-17894 ] Google--Chrome Inappropriate implementation in = DataTransfer in Google Chrome prior to 151.0.7922.72 allowed a remote attac= ker who convinced a user to engage in specific UI gestures to leak cross-or= igin data via a crafted HTML page. (Chromium security severity: Medium) 202= 6-07-30 not yet calculated CVE-2026-17895 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-17895 ] Google--Chrome Use after free in DevTools in Google Ch= rome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary = code inside a sandbox via a crafted HTML page. (Chromium security severity:=
Medium) 2026-07-30 not yet calculated CVE-2026-17896 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-17896 ] Google--Chrome Inappropriate implementatio=
n in ORB in Google Chrome prior to 151.0.7922.72 allowed a remote attacker =
to leak cross-origin data via a crafted HTML page. (Chromium security sever= ity: Medium) 2026-07-30 not yet calculated CVE-2026-17897 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-17897 ] Google--Chrome Use after free in DevTo= ols in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinc=
ed a user to install a malicious extension to execute arbitrary code inside=
a sandbox via a crafted Chrome Extension. (Chromium security severity: Low=
) 2026-07-30 not yet calculated CVE-2026-17898 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-17898 ] Google--Chrome Insufficient policy enforcement in=
DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who c= onvinced a user to install a malicious extension to perform privilege escal= ation via a crafted Chrome Extension. (Chromium security severity: Low) 202= 6-07-30 not yet calculated CVE-2026-17899 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-17899 ] Google--Chrome Inappropriate implementation in Enterpr= ise in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote att= acker to leak cross-origin data via a malicious file. (Chromium security se= verity: Low) 2026-07-30 not yet calculated CVE-2026-17900 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-17900 ] Google--Chrome Insufficient validation=
of untrusted input in Sharing in Google Chrome on Android prior to 151.0.7= 922.72 allowed a remote attacker to bypass navigation restrictions via mali= cious network traffic. (Chromium security severity: Low) 2026-07-30 not yet=
calculated CVE-2026-17901 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17= 901 ] Google--Chrome Inappropriate implementation in Editing in Google Chro=
me on Linux prior to 151.0.7922.72 allowed a remote attacker to leak cross-= origin data via a crafted HTML page. (Chromium security severity: Low) 2026= -07-30 not yet calculated CVE-2026-17902 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-17902 ] Google--Chrome Insufficient policy enforcement in Chrom= ecast in Google Chrome prior to 151.0.7922.72 allowed an attacker on the lo= cal network segment to inject scripts or HTML into a privileged page via ma= licious network traffic. (Chromium security severity: Low) 2026-07-30 not y=
et calculated CVE-2026-17903 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 17903 ] Google--Chrome Insufficient policy enforcement in NFC in Google Chr= ome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cro= ss-origin data via a crafted HTML page. (Chromium security severity: Low) 2= 026-07-30 not yet calculated CVE-2026-17904 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-17904 ] Google--Chrome Inappropriate implementation in Surfa= ceCapture in Google Chrome prior to 151.0.7922.72 allowed a remote attacker=
to leak cross-origin data via a crafted HTML page. (Chromium security seve= rity: Low) 2026-07-30 not yet calculated CVE-2026-17905 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-17905 ] Google--Chrome Insufficient validation o=
f untrusted input in Bluetooth in Google Chrome prior to 151.0.7922.72 allo= wed a remote attacker who had compromised the renderer process to potential=
ly perform a sandbox escape via a crafted HTML page. (Chromium security sev= erity: Low) 2026-07-30 not yet calculated CVE-2026-17906 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-17906 ] Google--Chrome Side-channel information=
leakage in Network in Google Chrome prior to 151.0.7922.72 allowed a remot=
e attacker to leak cross-origin data via a crafted HTML page. (Chromium sec= urity severity: Low) 2026-07-30 not yet calculated CVE-2026-17907 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-17907 ] Google--Chrome Insufficient va= lidation of untrusted input in Printing in Google Chrome on Windows prior t=
o 151.0.7922.72 allowed a remote attacker who had compromised the renderer = process to potentially perform a sandbox escape via a crafted HTML page. (C= hromium security severity: Low) 2026-07-30 not yet calculated CVE-2026-1790=
8 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17908 ] Google--Chrome Insu= fficient validation of untrusted input in Isolated Web Apps in Google Chrom=
e prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin dat=
a via malicious network traffic. (Chromium security severity: Low) 2026-07-=
30 not yet calculated CVE-2026-17909 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-17909 ] Google--Chrome Insufficient policy enforcement in NFC in Go= ogle Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to = leak cross-origin data via a crafted HTML page. (Chromium security severity=
: Low) 2026-07-30 not yet calculated CVE-2026-17910 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-17910 ] Google--Chrome Insufficient policy enforceme=
nt in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker=
to leak cross-origin data via a crafted HTML page. (Chromium security seve= rity: Low) 2026-07-30 not yet calculated CVE-2026-17911 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-17911 ] Google--Chrome Inappropriate implementat= ion in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowe=
d a remote attacker to bypass navigation restrictions via a crafted HTML pa= ge. (Chromium security severity: Low) 2026-07-30 not yet calculated CVE-202= 6-17912 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17912 ] Google--Chrom=
e Inappropriate implementation in Chrome for iOS in Google Chrome on iOS pr= ior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a=
crafted HTML page. (Chromium security severity: Low) 2026-07-30 not yet ca= lculated CVE-2026-17913 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17913=
] Google--Chrome Side-channel information leakage in Skia in Google Chrome=
prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sen= sitive information from process memory via a crafted HTML page. (Chromium s= ecurity severity: Low) 2026-07-30 not yet calculated CVE-2026-17914 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-17914 ] Google--Chrome Inappropriate=
implementation in WebView in Google Chrome on Android prior to 151.0.7922.=
72 allowed a remote attacker to perform UI spoofing via a crafted HTML page=
. (Chromium security severity: Low) 2026-07-30 not yet calculated CVE-2026-= 17915 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17915 ] Google--Chrome = Insufficient policy enforcement in Settings in Google Chrome prior to 151.0= .7922.72 allowed a remote attacker who had compromised the renderer process=
to perform privilege escalation via a crafted HTML page. (Chromium securit=
y severity: Low) 2026-07-30 not yet calculated CVE-2026-17916 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-17916 ] Google--Chrome Insufficient policy=
enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.=
72 allowed a remote attacker to bypass discretionary access control via a c= rafted HTML page. (Chromium security severity: Low) 2026-07-30 not yet calc= ulated CVE-2026-17917 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17917 ]=
Google--Chrome Use after free in Sync in Google Chrome prior to 151.0.7922= .72 allowed a remote attacker to execute arbitrary code inside a sandbox vi=
a a crafted HTML page. (Chromium security severity: Low) 2026-07-30 not yet=
calculated CVE-2026-17918 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17= 918 ] Google--Chrome Insufficient policy enforcement in Enterprise in Googl=
e Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform = privilege escalation via physical access to the device. (Chromium security = severity: Low) 2026-07-30 not yet calculated CVE-2026-17919 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-17919 ] Google--Chrome Use after free in V8 =
in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a=
user to install a malicious extension to execute arbitrary code inside a s= andbox via a crafted Chrome Extension. (Chromium security severity: Low) 20= 26-07-30 not yet calculated CVE-2026-17920 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-17920 ] Google--Chrome Insufficient validation of untrusted i= nput in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote=
attacker who had compromised the renderer process to bypass navigation res= trictions via a crafted HTML page. (Chromium security severity: Low) 2026-0= 7-30 not yet calculated CVE-2026-17921 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-17921 ] Google--Chrome Inappropriate implementation in Enterpri=
se in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to exe= cute arbitrary code via a crafted HTML page. (Chromium security severity: L= ow) 2026-07-30 not yet calculated CVE-2026-17922 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-17922 ] Google--Chrome Policy bypass in Enterprise in G= oogle Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass nav= igation restrictions via a crafted domain name. (Chromium security severity=
: Low) 2026-07-30 not yet calculated CVE-2026-17923 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-17923 ] Google--Chrome Use after free in DNS in Goog=
le Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromi= sed the renderer process to potentially perform a sandbox escape via a craf= ted HTML page. (Chromium security severity: Low) 2026-07-30 not yet calcula= ted CVE-2026-17924 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17924 ] Go= ogle--Chrome Inappropriate implementation in Cast in Google Chrome on Andro=
id prior to 151.0.7922.72 allowed a remote attacker to bypass same origin p= olicy via a crafted HTML page. (Chromium security severity: Low) 2026-07-30=
not yet calculated CVE-2026-17925 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-17925 ] Google--Chrome Insufficient validation of untrusted input in = DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker = who convinced a user to engage in specific UI gestures to bypass navigation=
restrictions via a crafted HTML page. (Chromium security severity: Low) 20= 26-07-30 not yet calculated CVE-2026-17926 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-17926 ] Google--Chrome Insufficient policy enforcement in Dev= Tools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convi= nced a user to install a malicious extension to leak cross-origin data via =
a crafted Chrome Extension. (Chromium security severity: Low) 2026-07-30 no=
t yet calculated CVE-2026-17927 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-17927 ] Google--Chrome Inappropriate implementation in DataTransfer in G= oogle Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross= -origin data via a crafted HTML page. (Chromium security severity: Low) 202= 6-07-30 not yet calculated CVE-2026-17928 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-17928 ] Google--Chrome Insufficient validation of untrusted in= put in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote at= tacker to bypass navigation restrictions via a malicious file. (Chromium se= curity severity: Low) 2026-07-30 not yet calculated CVE-2026-17929 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-17929 ] Google--Chrome Insufficient v= alidation of untrusted input in Extensions in Google Chrome prior to 151.0.= 7922.72 allowed a remote attacker who had compromised the renderer process =
to perform privilege escalation via a crafted HTML page. (Chromium security=
severity: Low) 2026-07-30 not yet calculated CVE-2026-17930 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-17930 ] Google--Chrome Inappropriate implem= entation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remo=
te attacker to bypass navigation restrictions via a crafted HTML page. (Chr= omium security severity: Low) 2026-07-30 not yet calculated CVE-2026-17931 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-17931 ] Google--Chrome Use af= ter free in DataTransfer in Google Chrome on Windows prior to 151.0.7922.72=
allowed a local attacker to obtain potentially sensitive information from = process memory via a crafted HTML page. (Chromium security severity: Low) 2= 026-07-30 not yet calculated CVE-2026-17932 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-17932 ] Google--Chrome Inappropriate implementation in DOMSt= orage in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to = leak cross-origin data via a crafted HTML page. (Chromium security severity=
: Low) 2026-07-30 not yet calculated CVE-2026-17933 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-17933 ] Google--Chrome Insufficient validation of un= trusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a=
remote attacker to bypass navigation restrictions via a crafted HTML page.=
(Chromium security severity: Low) 2026-07-30 not yet calculated CVE-2026-1= 7934 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17934 ] Google--Chrome H= eap buffer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allow=
ed a remote attacker to execute arbitrary code inside a sandbox via a craft=
ed HTML page. (Chromium security severity: Low) 2026-07-30 not yet calculat=
ed CVE-2026-17935 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17935 ] Goo= gle--Chrome Inappropriate implementation in DevTools in Google Chrome prior=
to 151.0.7922.72 allowed a remote attacker who convinced a user to engage =
in specific UI gestures to bypass navigation restrictions via a crafted HTM=
L page. (Chromium security severity: Low) 2026-07-30 not yet calculated CVE= -2026-17936 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17936 ] Google--C= hrome Insufficient validation of untrusted input in DevTools in Google Chro=
me prior to 151.0.7922.72 allowed a remote attacker to bypass navigation re= strictions via a crafted HTML page. (Chromium security severity: Low) 2026-= 07-30 not yet calculated CVE-2026-17937 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-17937 ] Google--Chrome Inappropriate implementation in FullScre=
en in Google Chrome on Android prior to 151.0.7922.72 allowed a remote atta= cker to perform UI spoofing via a crafted HTML page. (Chromium security sev= erity: Low) 2026-07-30 not yet calculated CVE-2026-17938 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-17938 ] Google--Chrome Insufficient validation =
of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 all= owed a remote attacker to perform UI spoofing via malicious network traffic=
. (Chromium security severity: Low) 2026-07-30 not yet calculated CVE-2026-= 17939 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17939 ] Google--Chrome = Insufficient validation of untrusted input in Picture-in-Picture in Google = Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had = compromised the renderer process to potentially perform a sandbox escape vi=
a a crafted HTML page. (Chromium security severity: Low) 2026-07-30 not yet=
calculated CVE-2026-17940 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17= 940 ] Google--Chrome Inappropriate implementation in Chrome for iOS in Goog=
le Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to spoof = the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium se= curity severity: Low) 2026-07-30 not yet calculated CVE-2026-17941 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-17941 ] Google--Chrome Side-channel i= nformation leakage in SVG in Google Chrome prior to 151.0.7922.72 allowed a=
remote attacker to leak cross-origin data via a crafted HTML page. (Chromi=
um security severity: Low) 2026-07-30 not yet calculated CVE-2026-17942 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-17942 ] Google--Chrome Inappropr= iate implementation in Parser in Google Chrome prior to 151.0.7922.72 allow=
ed a remote attacker to bypass content security policy via a crafted HTML p= age. (Chromium security severity: Low) 2026-07-30 not yet calculated CVE-20= 26-17943 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17943 ] Google--Chro=
me Inappropriate implementation in Chrome for iOS in Google Chrome on iOS p= rior to 151.0.7922.72 allowed a remote attacker to bypass navigation restri= ctions via a crafted HTML page. (Chromium security severity: Low) 2026-07-3=
0 not yet calculated CVE-2026-17944 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-17944 ] Google--Chrome Insufficient validation of untrusted input in=
Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attack=
er who had compromised the renderer process to perform UI spoofing via a cr= afted HTML page. (Chromium security severity: Low) 2026-07-30 not yet calcu= lated CVE-2026-17945 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17945 ] = Google--Chrome Uninitialized Use in Dawn in Google Chrome prior to 151.0.79= 22.72 allowed a remote attacker who had compromised the renderer process to=
obtain potentially sensitive information from process memory via a crafted=
HTML page. (Chromium security severity: Low) 2026-07-30 not yet calculated=
CVE-2026-17946 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17946 ] Googl= e--Chrome Use after free in WebSockets in Google Chrome prior to 151.0.7922= .72 allowed a remote attacker to potentially perform a sandbox escape via a=
crafted HTML page. (Chromium security severity: Low) 2026-07-30 not yet ca= lculated CVE-2026-17947 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17947=
] Google--Chrome Type Confusion in V8 in Google Chrome prior to 151.0.7922= .72 allowed an attacker who convinced a user to install a malicious extensi=
on to execute arbitrary code inside a sandbox via a crafted Chrome Extensio=
n. (Chromium security severity: Low) 2026-07-30 not yet calculated CVE-2026= -17948 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17948 ] Google--Chrome=
Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.7=
2 allowed a remote attacker to leak cross-origin data via a crafted HTML pa= ge. (Chromium security severity: Low) 2026-07-30 not yet calculated CVE-202= 6-17949 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17949 ] Google--Chrom=
e Inappropriate implementation in Safebrowsing in Google Chrome on Mac prio=
r to 151.0.7922.72 allowed a remote attacker to execute arbitrary code via =
a malicious file. (Chromium security severity: Low) 2026-07-30 not yet calc= ulated CVE-2026-17950 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17950 ]=
Google--Chrome Heap buffer overflow in WebRTC in Google Chrome prior to 15= 1.0.7922.72 allowed a remote attacker to perform an out of bounds memory re=
ad via a crafted HTML page. (Chromium security severity: Low) 2026-07-30 no=
t yet calculated CVE-2026-17951 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-17951 ] Google--Chrome Inappropriate implementation in V8 in Google Chro=
me prior to 151.0.7922.72 allowed an attacker who convinced a user to insta=
ll a malicious extension to execute arbitrary code inside a sandbox via a c= rafted Chrome Extension. (Chromium security severity: Low) 2026-07-30 not y=
et calculated CVE-2026-17952 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 17952 ] Google--Chrome Insufficient policy enforcement in WebView in Google=
Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypa=
ss navigation restrictions via a crafted HTML page. (Chromium security seve= rity: Low) 2026-07-30 not yet calculated CVE-2026-17953 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-17953 ] Google--Chrome Policy bypass in MHTML in=
Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cro= ss-origin data via a crafted MHTML page. (Chromium security severity: Low) = 2026-07-30 not yet calculated CVE-2026-17954 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-17954 ] Google--Chrome Insufficient validation of untrusted=
input in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote=
attacker to perform UI spoofing via a crafted HTML page. (Chromium securit=
y severity: Low) 2026-07-30 not yet calculated CVE-2026-17955 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-17955 ] Google--Chrome Inappropriate imple= mentation in Scheduling in Google Chrome prior to 151.0.7922.72 allowed a r= emote attacker to execute arbitrary code inside a sandbox via a crafted HTM=
L page. (Chromium security severity: Low) 2026-07-30 not yet calculated CVE= -2026-17956 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17956 ] Google--C= hrome Inappropriate implementation in CORS in Google Chrome prior to 151.0.= 7922.72 allowed a remote attacker who had compromised the renderer process =
to leak cross-origin data via a crafted HTML page. (Chromium security sever= ity: Low) 2026-07-30 not yet calculated CVE-2026-17957 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-17957 ] Google--Chrome Inappropriate implementati=
on in Views in Google Chrome prior to 151.0.7922.72 allowed a remote attack=
er to perform UI spoofing via a crafted HTML page. (Chromium security sever= ity: Low) 2026-07-30 not yet calculated CVE-2026-17958 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-17958 ] Google--Chrome Inappropriate implementati=
on in Network in Google Chrome prior to 151.0.7922.72 allowed a remote atta= cker to leak cross-origin data via a crafted HTML page. (Chromium security = severity: Low) 2026-07-30 not yet calculated CVE-2026-17959 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-17959 ] Google--Chrome Insufficient policy e= nforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72=
allowed a remote attacker to bypass no-referrer policy via a crafted HTML = page. (Chromium security severity: Low) 2026-07-30 not yet calculated CVE-2= 026-17960 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17960 ] Google--Chr= ome Inappropriate implementation in Session in Google Chrome on Android pri=
or to 151.0.7922.72 allowed a remote attacker to bypass navigation restrict= ions via a crafted HTML page. (Chromium security severity: Low) 2026-07-30 = not yet calculated CVE-2026-17961 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-17961 ] Google--Chrome Inappropriate implementation in Blink in Google=
Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrar=
y scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severi= ty: Low) 2026-07-30 not yet calculated CVE-2026-17962 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-17962 ] Google--Chrome Inappropriate implementatio=
n in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker =
to leak cross-origin data via a crafted HTML page. (Chromium security sever= ity: Low) 2026-07-30 not yet calculated CVE-2026-17963 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-17963 ] Google--Chrome Incorrect security UI in U=
I in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attac= ker to perform domain spoofing via a crafted HTML page. (Chromium security = severity: Low) 2026-07-30 not yet calculated CVE-2026-17964 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-17964 ] Google--Chrome Incorrect security UI=
in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a=
remote attacker to perform UI spoofing via a crafted HTML page. (Chromium = security severity: Low) 2026-07-30 not yet calculated CVE-2026-17965 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-17965 ] Google--Chrome Inappropriat=
e implementation in Views in Google Chrome on Mac prior to 151.0.7922.72 al= lowed a local attacker to obtain potentially sensitive information from pro= cess memory via a crafted HTML page. (Chromium security severity: Low) 2026= -07-30 not yet calculated CVE-2026-17966 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-17966 ] Google--Chrome Use after free in Chrome for iOS in Goog=
le Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to potent= ially exploit heap corruption via a crafted HTML page. (Chromium security s= everity: Low) 2026-07-30 not yet calculated CVE-2026-17967 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-17967 ] Google--Chrome Uninitialized Use in W= ebXR in Google Chrome on Android prior to 151.0.7922.72 allowed a remote at= tacker to obtain potentially sensitive information from process memory via =
a crafted HTML page. (Chromium security severity: Low) 2026-07-30 not yet c= alculated CVE-2026-17968 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1796=
8 ] Google--Chrome Inappropriate implementation in Passwords in Google Chro=
me prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary co=
de inside a sandbox via a crafted HTML page. (Chromium security severity: L= ow) 2026-07-30 not yet calculated CVE-2026-17969 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-17969 ] Google--Chrome Insufficient validation of untru= sted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed an = attacker in a privileged network position to perform UI spoofing via malici= ous network traffic. (Chromium security severity: Low) 2026-07-30 not yet c= alculated CVE-2026-17970 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1797=
0 ] Google--Chrome Inappropriate implementation in Frame in Google Chrome p= rior to 151.0.7922.72 allowed a remote attacker to potentially perform out =
of bounds memory access via a crafted HTML page. (Chromium security severit=
y: Low) 2026-07-30 not yet calculated CVE-2026-17971 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-17971 ] Google--Chrome Inappropriate implementation=
in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a=
remote attacker to perform UI spoofing via a crafted HTML page. (Chromium = security severity: Low) 2026-07-30 not yet calculated CVE-2026-17972 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-17972 ] Google--Chrome Inappropriat=
e implementation in Views in Google Chrome on Mac prior to 151.0.7922.72 al= lowed a local attacker to obtain potentially sensitive information from pro= cess memory via a crafted HTML page. (Chromium security severity: Low) 2026= -07-30 not yet calculated CVE-2026-17973 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-17973 ] Google--Chrome Insufficient policy enforcement in DevTo= ols in Google Chrome prior to 151.0.7922.72 allowed a local attacker to byp= ass navigation restrictions via a crafted HTML page. (Chromium security sev= erity: Low) 2026-07-30 not yet calculated CVE-2026-17974 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-17974 ] Google--Chrome Inappropriate implementa= tion in IME in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote=
attacker to obtain potentially sensitive information from process memory v=
ia a crafted HTML page. (Chromium security severity: Low) 2026-07-30 not ye=
t calculated CVE-2026-17975 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1= 7975 ] Google--Chrome Insufficient policy enforcement in Extensions in Goog=
le Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user t=
o install a malicious extension to bypass discretionary access control via =
a crafted domain name. (Chromium security severity: Low) 2026-07-30 not yet=
calculated CVE-2026-17976 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17= 976 ] Google--Chrome Policy bypass in CSS in Google Chrome prior to 151.0.7= 922.72 allowed a remote attacker to leak cross-origin data via a crafted HT=
ML page. (Chromium security severity: Low) 2026-07-30 not yet calculated CV= E-2026-17977 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17977 ] Google--= Chrome Side-channel information leakage in WebCodecs in Google Chrome prior=
to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive=
information from process memory via a crafted HTML page. (Chromium securit=
y severity: Low) 2026-07-30 not yet calculated CVE-2026-17978 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-17978 ] Google--Chrome Race in V8 in Googl=
e Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitr= ary code inside a sandbox via a crafted HTML page. (Chromium security sever= ity: Low) 2026-07-30 not yet calculated CVE-2026-17979 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-17979 ] Google--Chrome Inappropriate implementati=
on in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remot=
e attacker who convinced a user to engage in specific UI gestures to leak c= ross-origin data via a crafted HTML page. (Chromium security severity: Low)=
2026-07-30 not yet calculated CVE-2026-17980 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-17980 ] Google--Chrome Inappropriate implementation in Bli=
nk in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to lea=
k cross-origin data via a crafted HTML page. (Chromium security severity: L= ow) 2026-07-30 not yet calculated CVE-2026-17981 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-17981 ] Google--Chrome Insufficient validation of untru= sted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote=
attacker to bypass same origin policy via a crafted HTML page. (Chromium s= ecurity severity: Low) 2026-07-30 not yet calculated CVE-2026-17982 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-17982 ] Google--Chrome Inappropriate=
implementation in Global Media Controls in Google Chrome prior to 151.0.79= 22.72 allowed a remote attacker to perform UI spoofing via a crafted HTML p= age. (Chromium security severity: Low) 2026-07-30 not yet calculated CVE-20= 26-17983 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17983 ] Google--Chro=
me Inappropriate implementation in Browser in Google Chrome on Android prio=
r to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a=
crafted HTML page. (Chromium security severity: Low) 2026-07-30 not yet ca= lculated CVE-2026-17984 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17984=
] Google--Chrome Insufficient policy enforcement in Speech in Google Chrom=
e prior to 151.0.7922.72 allowed a remote attacker to bypass site isolation=
via a crafted HTML page. (Chromium security severity: Low) 2026-07-30 not = yet calculated CVE-2026-17985 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -17985 ] Google--Chrome Insufficient policy enforcement in Bluetooth in Goo= gle Chrome prior to 151.0.7922.72 allowed a remote attacker who had comprom= ised the renderer process to bypass same origin policy via a crafted HTML p= age. (Chromium security severity: Low) 2026-07-30 not yet calculated CVE-20= 26-17986 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17986 ] Google--Chro=
me Insufficient validation of untrusted input in Notifications in Google Ch= rome prior to 151.0.7922.72 allowed a remote attacker who had compromised t=
he renderer process to potentially perform a sandbox escape via a crafted P=
DF file. (Chromium security severity: Low) 2026-07-30 not yet calculated CV= E-2026-17987 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17987 ] Google--= Chrome Insufficient validation of untrusted input in Navigation in Google C= hrome prior to 151.0.7922.72 allowed a remote attacker who had compromised = the renderer process to bypass navigation restrictions via a crafted HTML p= age. (Chromium security severity: Low) 2026-07-30 not yet calculated CVE-20= 26-17988 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17988 ] Google--Chro=
me Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a r= emote attacker to execute arbitrary code inside a sandbox via a crafted HTM=
L page. (Chromium security severity: Low) 2026-07-30 not yet calculated CVE= -2026-17989 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17989 ] Google--C= hrome Insufficient validation of untrusted input in WebAuthn in Google Chro=
me prior to 151.0.7922.72 allowed a remote attacker who had compromised the=
renderer process to potentially perform a sandbox escape via a crafted PDF=
file. (Chromium security severity: Low) 2026-07-30 not yet calculated CVE-= 2026-17990 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17990 ] Google--Ch= rome Insufficient validation of untrusted input in AI in Google Chrome prio=
r to 151.0.7922.72 allowed a remote attacker who had compromised the render=
er process to potentially perform a sandbox escape via a crafted HTML page.=
(Chromium security severity: Low) 2026-07-30 not yet calculated CVE-2026-1= 7991 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17991 ] Google--Chrome U= ninitialized Use in Skia in Google Chrome on Windows prior to 151.0.7922.72=
allowed a remote attacker to obtain potentially sensitive information from=
process memory via a crafted HTML page. (Chromium security severity: Low) = 2026-07-30 not yet calculated CVE-2026-17992 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-17992 ] Google--Chrome Race in Updater in Google Chrome on = Windows prior to 151.0.7922.72 allowed a local attacker to perform privileg=
e escalation via a malicious file. (Chromium security severity: Low) 2026-0= 7-30 not yet calculated CVE-2026-17993 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-17993 ] Google--Chrome Inappropriate implementation in Media in=
Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker =
to bypass navigation restrictions via a crafted HTML page. (Chromium securi=
ty severity: Low) 2026-07-30 not yet calculated CVE-2026-17994 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-17994 ] Google--Chrome Out of bounds read=
in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker =
to perform an out of bounds memory read via a crafted HTML page. (Chromium = security severity: Low) 2026-07-30 not yet calculated CVE-2026-17995 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-17995 ] Google--Chrome Inappropriat=
e implementation in Browser in Google Chrome on Mac prior to 151.0.7922.72 = allowed a local attacker to bypass navigation restrictions via a malicious = file. (Chromium security severity: Low) 2026-07-30 not yet calculated CVE-2= 026-17996 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17996 ] Google--Chr= ome Inappropriate implementation in Passwords in Google Chrome prior to 151= .0.7922.72 allowed a remote attacker who had compromised the renderer proce=
ss to leak cross-origin data via a crafted HTML page. (Chromium security se= verity: Low) 2026-07-30 not yet calculated CVE-2026-17997 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-17997 ] Google--Chrome Incorrect security UI i=
n Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker wh=
o convinced a user to install a malicious extension to perform UI spoofing = via a crafted Chrome Extension. (Chromium security severity: Low) 2026-07-3=
0 not yet calculated CVE-2026-17998 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-17998 ] Google--Chrome Race in PictureInPicture in Google Chrome on = Android prior to 151.0.7922.72 allowed a remote attacker to perform domain = spoofing via a crafted HTML page. (Chromium security severity: Low) 2026-07= -30 not yet calculated CVE-2026-17999 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-17999 ] Google--Chrome Insufficient policy enforcement in USB in G= oogle Chrome on Android prior to 151.0.7922.72 allowed a remote attacker wh=
o had compromised the renderer process to leak cross-origin data via a craf= ted HTML page. (Chromium security severity: Low) 2026-07-30 not yet calcula= ted CVE-2026-18000 [ https://www.cve.org/CVERecord?id=3DCVE-2026-18000 ] Go= ogle--Chrome Inappropriate implementation in WebGL in Google Chrome prior t=
o 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive i= nformation from process memory via a crafted HTML page. (Chromium security = severity: Low) 2026-07-30 not yet calculated CVE-2026-18001 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-18001 ] Google--Chrome Insufficient validati=
on of untrusted input in Google Lens in Google Chrome prior to 151.0.7922.7=
2 allowed a remote attacker who had compromised the renderer process to pot= entially perform a sandbox escape via a crafted HTML page. (Chromium securi=
ty severity: Low) 2026-07-30 not yet calculated CVE-2026-18002 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-18002 ] Google--Chrome Inappropriate impl= ementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72=
allowed a remote attacker to perform UI spoofing via a crafted HTML page. = (Chromium security severity: Low) 2026-07-30 not yet calculated CVE-2026-18= 003 [ https://www.cve.org/CVERecord?id=3DCVE-2026-18003 ] Google--Chrome In= sufficient policy enforcement in Speech in Google Chrome prior to 151.0.792= 2.72 allowed a remote attacker who had compromised the renderer process to = leak cross-origin data via a crafted HTML page. (Chromium security severity=
: Low) 2026-07-30 not yet calculated CVE-2026-18004 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-18004 ] Google--Chrome Inappropriate implementation =
in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker =
to obtain potentially sensitive information from process memory via a craft=
ed HTML page. (Chromium security severity: Low) 2026-07-30 not yet calculat=
ed CVE-2026-18005 [ https://www.cve.org/CVERecord?id=3DCVE-2026-18005 ] Goo= gle--Chrome Inappropriate implementation in Google Lens in Google Chrome pr= ior to 151.0.7922.72 allowed a remote attacker who had compromised the rend= erer process to perform UI spoofing via a crafted HTML page. (Chromium secu= rity severity: Low) 2026-07-30 not yet calculated CVE-2026-18006 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-18006 ] Google--Chrome Inappropriate im= plementation in Input in Google Chrome on Android prior to 151.0.7922.72 al= lowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch= romium security severity: Low) 2026-07-30 not yet calculated CVE-2026-18007=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-18007 ] Google--Chrome Inapp= ropriate implementation in Settings in Google Chrome prior to 151.0.7922.72=
allowed a remote attacker to perform UI spoofing via malicious network tra= ffic. (Chromium security severity: Low) 2026-07-30 not yet calculated CVE-2= 026-18008 [ https://www.cve.org/CVERecord?id=3DCVE-2026-18008 ] Google--Chr= ome Insufficient validation of untrusted input in Passwords in Google Chrom=
e prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing v=
ia malicious network traffic. (Chromium security severity: Low) 2026-07-30 = not yet calculated CVE-2026-18009 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-18009 ] Google--Chrome Inappropriate implementation in Passwords in Go= ogle Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI = spoofing via malicious network traffic. (Chromium security severity: Low) 2= 026-07-30 not yet calculated CVE-2026-18010 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-18010 ] Google--Chrome Inappropriate implementation in Chrom=
e for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a local at= tacker to obtain potentially sensitive information from process memory via = physical access to the device. (Chromium security severity: Low) 2026-07-30=
not yet calculated CVE-2026-18011 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-18011 ] Google--Chrome Use after free in PDFium in Google Chrome prio=
r to 151.0.7922.72 allowed a remote attacker to execute arbitrary code insi=
de a sandbox via a crafted PDF file. (Chromium security severity: Low) 2026= -07-30 not yet calculated CVE-2026-18012 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-18012 ] Google--Chrome Inappropriate implementation in Chrome f=
or iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote atta= cker to perform UI spoofing via a crafted HTML page. (Chromium security sev= erity: Low) 2026-07-30 not yet calculated CVE-2026-18013 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-18013 ] Google--Chrome Insufficient validation =
of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allo= wed a remote attacker to bypass navigation restrictions via a malicious fil=
e. (Chromium security severity: Low) 2026-07-30 not yet calculated CVE-2026= -18014 [ https://www.cve.org/CVERecord?id=3DCVE-2026-18014 ] Google--Chrome=
Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.= 0.7922.72 allowed a remote attacker to potentially perform a sandbox escape=
via a crafted HTML page. (Chromium security severity: Low) 2026-07-30 not = yet calculated CVE-2026-18015 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -18015 ] Google--Chrome Insufficient policy enforcement in Chrome for iOS i=
n Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to = perform UI spoofing via a crafted HTML page. (Chromium security severity: L= ow) 2026-07-30 not yet calculated CVE-2026-18016 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-18016 ] Google--Chrome Use after free in Dawn in Google=
Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitra=
ry code inside a sandbox via a crafted HTML page. (Chromium security severi= ty: Low) 2026-07-30 not yet calculated CVE-2026-18017 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-18017 ] Google--Chrome Inappropriate implementatio=
n in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a l= ocal attacker to perform UI spoofing via a malicious file. (Chromium securi=
ty severity: Low) 2026-07-30 not yet calculated CVE-2026-18018 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-18018 ] Google--Chrome Side-channel infor= mation leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a r= emote attacker to leak cross-origin data via a crafted HTML page. (Chromium=
security severity: Low) 2026-07-30 not yet calculated CVE-2026-18019 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-18019 ] Google--Google-ADK A vulne= rability in the Agent Development Kit (ADK) allows for continuation forgery=
in tool confirmations. An attacker who is able to manipulate or inject eve= nts into the session history can execute unauthorized tools by forging a to=
ol confirmation response. This is possible because the framework did not ve= rify if the target tool was registered to the executing agent, did not vali= date if the tool actually required confirmation, and did not match the conf= irmation arguments against the original tool call event in the history. 202= 6-07-29 not yet calculated CVE-2026-18236 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-18236 ] Google--MCP Toolbox for Databases (googleapis/mcp-tool= box) A Server-Side Request Forgery (SSRF) and credential exfiltration vulne= rability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/= mcp-toolbox. The tool takes an unvalidated pageURL parameter from the clien=
t and issues an HTTP GET request to it using an authenticated client. The u= nderlying transport automatically attaches an Authorization: Bearer header =
to every outbound request regardless of the destination host. An attacker c=
an supply an arbitrary external URL to the pageURL parameter (either direct=
ly via the tool execution payload or implicitly via data-driven pagination = tracking loops), leading Toolbox into sending its OAuth/service-account acc= ess token to an attacker-controlled listener. Depending on the configuratio=
n, this leaks either the end-user's token or the broader service-account ac= cess token (ADC), potentially exposing Protected Health Information (PHI) a=
nd secondary Google Cloud Platform services. 2026-07-27 not yet calculated = CVE-2026-16481 [ https://www.cve.org/CVERecord?id=3DCVE-2026-16481 ] Google= --mcp-toolbox Incorrect Authorization in the direct HTTP API tool invocatio=
n endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unaut= henticated attacker to invoke tools protected by the scopeRequired feature = via sending tool invocation requests through legacy HTTP endpoints when the=
--enable-api flag is active. 2026-07-31 not yet calculated CVE-2026-14537 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-14537 ] Google--mcp-toolbox A=
n improper authorization and security-boundary bypass vulnerability in the = bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 t= hrough 1.4.0 allows an authenticated attacker to bypass allowedDatasets val= idation checks. The toolbox relies on the BigQuery dry-run API to enforce d= ataset restrictions, but due to a fail-open logic flaw, it bypasses validat= ion when the API returns an empty array for specialized constructs. This al= lows the attacker to extract structural DDL schemas for explicitly excluded=
datasets via INFORMATION_SCHEMA, and access downstream federated row data = via EXTERNAL_QUERY connections. 2026-07-31 not yet calculated CVE-2026-1453=
8 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14538 ] Google--mcp-toolbox=
An allocation of resources without limits vulnerability in the HTTP handle=
r component of Google mcp-toolbox versions up to and including 1.4.0 allows=
an unauthenticated attacker to cause a denial of service (DoS). The /mcp e= ndpoint handler reads incoming payloads directly into system memory using a=
n unrestricted buffer loop (io.ReadAll) without applying defensive constrai= nts such as http.MaxBytesReader or pre-read Content-Length enforcement. By = submitting a single, massive HTTP request body, an attacker can linearly co= nsume available host memory until the runtime process is terminated by an O= ut-Of-Memory (OOM) error. 2026-07-31 not yet calculated CVE-2026-14539 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-14539 ] Google--mcp-toolbox A Ser= ver-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP so= urce and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0=
. While the toolbox implements baseline input sanitization for user-control= led parameters, the underlying HTTP client (internal/sources/http/http.go) = fails to safely regulate request redirection boundaries. Specifically, the = client is initialized without a restrictive CheckRedirect policy hook and l= acks target IP validation. An attacker or a malicious data-driven prompt ca=
n supply a crafted path parameter that triggers an open redirect or a direc=
t destination swap on the target backend, coercing the mcp-toolbox into bli= ndly following the redirection and making unauthorized requests to internal=
or arbitrary external endpoints. 2026-07-31 not yet calculated CVE-2026-14= 540 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14540 ] Google--mcp-toolb=
ox An authentication bypass and audience confusion vulnerability exists in = the Google OAuth provider component of Google mcp-toolbox version 1.4.0. Wh=
en a Google authService is initialized with mcpEnabled: true but lacks an e= xplicitly defined audience or clientId, the ValidateMCPAuth pipeline for op= aque tokens skips audience validation entirely. As a result, the toolbox wi=
ll accept any valid Google OAuth access token-even those minted for unrelat=
ed ecosystem applications-granting unauthorized clients access to protected=
tools and data backends. 2026-07-31 not yet calculated CVE-2026-14541 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-14541 ] gopacket--gopacket gopack=
et provides packet processing capabilities for Go. In version 1.6.0 and ear= lier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an att= acker-controlled 32-bit community count and AS path member count and sizes =
a slice allocation from those counts without bounding them against the byte=
s remaining in the datagram, so a 104-byte UDP datagram can drive an alloca= tion of up to 16 GiB and cause an unauthenticated remote denial of service.=
This issue is fixed in version 1.6.1. 2026-07-28 not yet calculated CVE-20= 26-54332 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54332 ] gopacket--go= packet gopacket provides packet processing capabilities for Go. In version = 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by = subtracting a fixed header size from an attacker-controlled AVP Length fiel=
d, so a vendor-flagged AVP whose Length is smaller than the 12-byte header = underflows the unsigned 32-bit value and drives an unbounded allocation of = roughly 4 GiB, and two such messages in succession OOM-kill a collector, ca= using an unauthenticated remote denial of service. This issue is fixed in v= ersion 1.6.1. 2026-07-28 not yet calculated CVE-2026-54345 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-54345 ] GStreamer--GStreamer GStreamer qtdemu=
x Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vul= nerability allows remote attackers to execute arbitrary code on affected in= stallations of GStreamer. Interaction with this library is required to expl= oit this vulnerability but attack vectors may vary depending on the impleme= ntation. The specific flaw exists within the parsing of UncompressedFrameCo= nfigBox structures. The issue results from the lack of proper validation of=
the length of user-supplied data prior to copying it to a fixed-length sta= ck-based buffer. An attacker can leverage this vulnerability to execute cod=
e in the context of the current process. Was ZDI-CAN-29392. 2026-07-29 not = yet calculated CVE-2026-5056 [ https://www.cve.org/CVERecord?id=3DCVE-2026-= 5056 ] HackingRepo--dssrf-js DSSRF is a Node.js library that provides a wid=
e range of utilities and advanced SSRF defense checks. Prior to 1.0.4, is_u= rl_safe in src/helpers.ts strips the @ userinfo delimiter with remove_at_sy= mbol_in_string before new URL parses the URL, allowing an attacker-controll=
ed URL to bypass internal-IP validation and cause a client using the origin=
al URL to reach an internal service. This issue is fixed in version 1.0.4. = 2026-07-30 not yet calculated CVE-2026-54722 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-54722 ] HackingRepo--dssrf-js DSSRF is a Node.js library th=
at provides a wide range of utilities and advanced SSRF defense checks. Pri=
or to 1.0.5, is_url_safe can treat localhost as safe when DNS resolver 1.1.= 1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.look=
up fallback occurs, allowing server-side request forgery. This issue is fix=
ed in version 1.0.5. 2026-07-31 not yet calculated CVE-2026-54729 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-54729 ] Heimdall Data--Database Proxy = Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code=
Execution Vulnerability. This vulnerability allows remote attackers to exe= cute arbitrary code on affected installations of Heimdall Data Database Pro= xy. Authentication is required to exploit this vulnerability. The specific = flaw exists within the generateFileContent function. The issue results from=
the lack of proper neutralization of CRLF sequences. An attacker can lever= age this vulnerability to execute code in the context of root. Was ZDI-CAN-= 29251. 2026-07-29 not yet calculated CVE-2026-12357 [ https://www.cve.org/C= VERecord?id=3DCVE-2026-12357 ] Honeywell--S35 Series 3M/5M/8M/PinHole Camer=
as Honeywell S35 Series 3M/5M/8M/PinHole Cameras, all versions prior to and=
including version HC5.26.1.14.20260207 contains an=C2=A0audit log disclosu=
re Vulnerability=C2=A0that could allow an attacker to access audit logs=C2= =A0without authentication, potentially resulting in the disclosure of sensi= tive information. Honeywell recommends updating to the latest available ver= sion (HC5.26.1.16.20260207) once available. 2026-07-27 not yet calculated C= VE-2026-17612 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17612 ] hugging= face--huggingface/transformers A vulnerability in huggingface/transformers = versions <=3D5.8.0.dev0 allows an attacker to perform arbitrary file writes=
via path traversal. The issue resides in the `save_pretrained()` methods o=
f `PreTrainedTokenizerBase` and `ProcessorMixin`, where keys from the `chat= _template` dictionary are used directly as filenames without proper validat= ion. An attacker can exploit this by publishing a malicious Hugging Face Hu=
b repository with a crafted `tokenizer_config.json` file. When a victim dow= nloads and saves the tokenizer or processor, the attacker-controlled keys c=
an escape the intended save directory, enabling arbitrary file writes with = attacker-controlled content. This vulnerability affects multiple processors=
inheriting from `ProcessorMixin`, including Idefics, Florence, Gemma, Phi,=
and Qwen-VL. 2026-08-02 not yet calculated CVE-2026-9856 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-9856 ] HUSKY--HUSKY The HUSKY WordPress plugin=
before 1.4.1 does not sanitize a stored setting value against directory tr= aversal before concatenating it into a file inclusion path, allowing users = with the shop manager capability to cause the inclusion and execution of ar= bitrary local files, which is then triggered on every front-end request inc= luding for unauthenticated visitors. 2026-08-01 not yet calculated CVE-2026= -15244 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15244 ] IBM--Langflow = OSS IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access a= nother user's private vector documents by creating their own flow with matc= hing Chroma persist_directory and collection_name values. The attacker rece= ives exact victim content in their workflow output despite having no author= ization to read the victim's flow. Additionally, the attacker can pollute t=
he victim's collection by inserting their own documents into the shared nam= espace. 2026-07-30 not yet calculated CVE-2026-13444 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-13444 ] Infor Global--Infor Global HR An Insecure D= irect Object Reference (IDOR) in the Employee Compensation View function of=
Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrari=
ly view the compensation information of other employees via a crafted GET r= equest. 2026-07-29 not yet calculated CVE-2025-60931 [ https://www.cve.org/= CVERecord?id=3DCVE-2025-60931 ] JetEngine--JetEngine The JetEngine WordPres=
s plugin before 3.8.12 does not escape a post meta value before outputting =
it through one of its shortcodes, allowing users with the Contributor role = and above to perform Stored Cross-Site Scripting attacks that execute in th=
e context of higher-privileged users such as administrators. 2026-08-02 not=
yet calculated CVE-2026-14864 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-14864 ] Jinher--Jinher OA C6 Jinher OA C6 contains an XML External Entity=
(XXE) injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/sp_manag= er_getUserlist.aspx/GetXmlHttp endpoint. An unauthenticated remote attacker=
can send a crafted XML payload to read arbitrary files from the server via=
an out-of-band attack. 2026-07-29 not yet calculated CVE-2026-50782 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-50782 ] Johnson Controls--FM System=
s Employee Unrestricted upload of file with dangerous type vulnerability in=
Johnson Controls FM Systems Employee allows Using Malicious Files. This is= sue affects FM Systems Employee: before 2025.3.1. 2026-07-31 not yet calcul= ated CVE-2026-21662 [ https://www.cve.org/CVERecord?id=3DCVE-2026-21662 ] J= ohnson Controls--FM Systems Employee Improper neutralization of input durin=
g web page generation ('cross-site scripting') vulnerability in Johnson Con= trols FM Systems Employee allows Stored XSS. This issue affects FM Systems = Employee: before 2025.3.1. 2026-07-31 not yet calculated CVE-2026-34495 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-34495 ] Johnson Controls--FM Sys= tems Employee Improper neutralization of Script-Related HTML tags in a web = page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allo=
ws Cross-Site Scripting (XSS). This issue affects FM Systems Employee: befo=
re 2025.3.1. 2026-07-31 not yet calculated CVE-2026-34497 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-34497 ] Johnson Controls--XAAP Application Cle= artext storage of sensitive information vulnerability in Johnson Controls X= AAP Application on Android allows an attacker on a jailbroken or otherwise = compromised device to Retrieve Sensitive Data. This issue affects XAAP Appl= ication: before 1.53. 2026-07-31 not yet calculated CVE-2026-34490 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-34490 ] joomdle.com--Joomdle componen=
t for Joomla Joomla Extension - joomdle.com - Insecure default configuratio=
n allows read/write user account access in Joomdle < 3.1.1 - The default co= nfiguration of the extension allowed read access and password reset of CMS = accounts. 2026-07-28 not yet calculated CVE-2026-65881 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-65881 ] joomdle.com--Joomdle component for Joomla=
Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < = 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a ref= lected XSS vector. 2026-07-28 not yet calculated CVE-2026-65882 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-65882 ] joomlacontenteditor.net--Joomla = Content Editor (JCE) extension for Joomla Joomla Extension - joomlacontente= ditor.net - Creation of hidden files and unintended file overwrite via rena=
me function in Joomla Content Editor (JCE) < 2.20.2 - Improper input valida= tion in the file rename functionality allowed an authenticated user with fi=
le management permissions to rename files to otherwise invalid names, resul= ting in the creation of hidden files. The issue also allowed existing files=
at the destination path to be unintentionally replaced. 2026-07-29 not yet=
calculated CVE-2026-65891 [ https://www.cve.org/CVERecord?id=3DCVE-2026-65= 891 ] joomshaper.com--SP Page Builder extension for Joomla Joomla Extension=
- joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.=
1 - Improper validation of order parameters in the Dynamic Content endpoint=
leads to an SQL injection vector. 2026-07-27 not yet calculated CVE-2026-6= 5766 [ https://www.cve.org/CVERecord?id=3DCVE-2026-65766 ] joomshaper.com--=
SP Page Builder extension for Joomla Joomla Extension - joomshaper.com - Un= authenticated SQL injection in SP Page Builder < 6.7.1 - Improper validatio=
n of catid parameters in the loadMoreArticles endpoint leads to an SQL inje= ction vector. 2026-07-27 not yet calculated CVE-2026-65876 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-65876 ] joomshaper.com--SP Page Builder exten= sion for Joomla Joomla Extension - joomshaper.com - Authenticated SQL injec= tion in SP Page Builder < 6.7.1 - Improper validation of various parameters=
in the media manager search and date filters lead to an SQL injection vect= or. 2026-07-27 not yet calculated CVE-2026-65877 [ https://www.cve.org/CVER= ecord?id=3DCVE-2026-65877 ] joomshaper.com--SP Page Builder extension for J= oomla Joomla Extension - joomshaper.com - Authenticated arbitrary file dele=
te in SP Page Builder < 6.7.1- Improper path validation and ACL checks lead=
to a file deletion vector in the media manager. 2026-07-27 not yet calcula= ted CVE-2026-65878 [ https://www.cve.org/CVERecord?id=3DCVE-2026-65878 ] jo= omshaper.com--SP Page Builder extension for Joomla Joomla Extension - jooms= haper.com - Unauthenticated mail relay via a hardcoded, product-wide secret=
in SP Page Builder < 6.7.1 - A hardcoded secret allowed attackers to forge=
the mail from address of forms. 2026-07-27 not yet calculated CVE-2026-658=
79 [ https://www.cve.org/CVERecord?id=3DCVE-2026-65879 ] JS Help Desk--JS H= elp Desk The JS Help Desk WordPress plugin before 3.1.4 does not perform au= thorization or ownership checks before returning support-ticket content in =
a nonce-gated search handler, allowing any authenticated user (Subscriber a=
nd above) to read the subject and full message body of every other user's s= upport tickets. 2026-07-31 not yet calculated CVE-2026-14928 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-14928 ] JS Help Desk--JS Help Desk The JS H= elp Desk WordPress plugin before 3.1.4 does not verify ownership of the tar= geted reply before updating it, allowing any authenticated user (Subscriber=
and above) to overwrite the content of any support-ticket reply on the sit=
e. 2026-07-31 not yet calculated CVE-2026-14929 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-14929 ] JS Help Desk--JS Help Desk The JS Help Desk Word= Press plugin before 3.1.4 does not perform any authorization, nonce, or own= ership check on a front-end request dispatcher, allowing unauthenticated us= ers to upload files (limited to the JS Help Desk WordPress plugin before 3.= 1.4's inert allowed extensions) and attach them to arbitrary users' support=
tickets. 2026-07-31 not yet calculated CVE-2026-14930 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-14930 ] JS Help Desk--JS Help Desk The JS Help De=
sk WordPress plugin before 3.1.4 grants a support-agent capability to the C= ontributor role on activation and does not perform a capability check on a = user-listing handler, allowing Contributor-level users to enumerate the ema=
il addresses of all registered WordPress users. 2026-07-31 not yet calculat=
ed CVE-2026-14931 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14931 ] JS = Help Desk--JS Help Desk The JS Help Desk WordPress plugin before 3.1.5 does=
not verify that the requesting user owns the ticket being loaded: a low-pr= ivileged authenticated user can supply another user's ticket ID and read th=
at ticket's contents, including the reporter's PII and message body. 2026-0= 7-31 not yet calculated CVE-2026-15209 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-15209 ] juev--nebula-mesh nebula-mesh is a self-hosted control = plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3=
, every /ui/* POST / PUT / PATCH / DELETE route processes the request as so=
on as the session cookie validates. SameSite=3DLax on the session cookie pr= events most cross-site form submits but does not protect: top-level form-su= bmit navigations from third-party pages (some browsers still send Lax cooki=
es on top-level POSTs); same-registrable-domain attackers (sibling-subdomai=
n XSS, subdomain takeover); the GET /ui/logout route, which a third-party <= img src=3D".../ui/logout"> can force-trigger. This issue has been patched i=
n version 0.3.3. 2026-07-28 not yet calculated CVE-2026-47725 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-47725 ] juev--nebula-mesh nebula-mesh is a=
self-hosted control plane for Slack Nebula mesh virtual private network. P= rior to version 0.3.2, internal/api/audit.go:12 - handleGetAuditLog does no=
admin check. The route is bearer-auth gated only; any operator API key ret= urns the full audit log via store.ListAuditEntries (up to limit=3D1000). Th=
is includes cross-tenant actor names, host/CA/operator IDs, action timestam= ps, and masked-IP entries from rate-limit refusals - enough surface for a t= enant to enumerate the server's activity, infer staffing patterns, or ident= ify high-value targets. This issue has been patched in version 0.3.2. 2026-= 07-28 not yet calculated CVE-2026-47726 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-47726 ] juev--nebula-mesh nebula-mesh is a self-hosted control = plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7=
, internal/pki/resolver.go:36-64 constructs a CAManager with the plaintext = ed25519.PrivateKey after unwrapping via the master key; internal/pki/ca.go:= 13-16 stores it. Callers at internal/api/enroll.go:116, internal/api/update= s.go:297, and internal/api/mobile_bundle.go:40 use the manager for one Sign=
() and drop the reference on function return - but the underlying slice con= tents are not wiped before release. The keystore package's contract (intern= al/keystore/keystore.go doc: "Callers MUST zeroise the returned plaintext D=
EK as soon as it is no longer needed") is not met by the CAManager consumer=
. Decrypted CA private keys persist in process heap until Go's GC scavenges=
the underlying slice - minutes to hours under load, indefinitely on idle s= ervers. This issue has been patched in version 0.3.7. 2026-07-28 not yet ca= lculated CVE-2026-48025 [ https://www.cve.org/CVERecord?id=3DCVE-2026-48025=
] juev--nebula-mesh nebula-mesh is a self-hosted control plane for Slack N= ebula mesh virtual private network. Prior to version 0.3.2, internal/web/se= ssion.go and internal/web/oidc.go set HttpOnly and SameSite=3DLax on every = cookie but never Secure. A single plaintext request to the origin (operator=
on a LAN, mistyped URL, HTTP=C3=A2=E2=80=A0=E2=80=99HTTPS not strictly enf= orced, reverse proxy misconfiguration) discloses the session. This issue ha=
s been patched in version 0.3.2. 2026-07-28 not yet calculated CVE-2026-480=
58 [ https://www.cve.org/CVERecord?id=3DCVE-2026-48058 ] keras-team--keras-= team/keras A vulnerability in keras-team/keras versions <=3D 3.14.0 allows = arbitrary local HDF5 file content disclosure due to improper handling of HD=
F5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` fun= ctions bypass the `safe_get_h5_group` and `safe_get_h5_dataset` helpers, wh= ich are designed to reject ExternalLinks and SoftLinks. This results in aut= omatic dereferencing of links to external HDF5 files, enabling attackers to=
disclose sensitive data from the victim's local filesystem. Specifically, = `KerasFileEditor` extracts attributes and datasets from linked files into i=
ts internal structures, while `keras.saving.load_weights` loads weights fro=
m linked files into the user's model. This issue can be exploited by provid= ing a malicious `.h5`, `.weights.h5`, or `.keras` file containing ExternalL= inks. 2026-08-02 not yet calculated CVE-2026-9335 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-9335 ] King Addons for Elementor--King Addons for Elem= entor The King Addons for Elementor WordPress plugin before 51.1.76 does no=
t escape a user-supplied grid setting before reflecting it into an HTML att= ribute in an unauthenticated AJAX response, allowing attackers to execute a= rbitrary JavaScript in the browser of a visitor who is tricked into loading=
a crafted page. 2026-08-02 not yet calculated CVE-2026-14841 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-14841 ] Kirki--Kirki The Kirki WordPress p= lugin before 6.0.13 does not restrict which classes may be instantiated whe=
n it deserialises data that unauthenticated users can store, leading to PHP=
Object Injection that is triggered when an administrator later reviews the=
stored data. With a suitable gadget chain present on the site (via another=
installed Kirki WordPress plugin before 6.0.13, , or an outdated WordPress=
version), this could be leveraged to perform a variety of attacks, such as=
remote code execution. 2026-07-31 not yet calculated CVE-2026-12720 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-12720 ] Kirki--Kirki The Kirki Word= Press plugin before 6.0.13 does not properly sanitise and escape a value ta= ken from the request before using it in a SQL statement, allowing unauthent= icated attackers to perform SQL injection attacks. 2026-07-31 not yet calcu= lated CVE-2026-12721 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12721 ] = kishan0725--Hospital Management System kishan0725 Hospital Management Syste=
m 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php. 2= 026-07-29 not yet calculated CVE-2025-65340 [ https://www.cve.org/CVERecord= ?id=3DCVE-2025-65340 ] kishan0725--Hospital Management System kishan0725 Ho= spital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/= view-patient.php?viewid=3D1. 2026-07-29 not yet calculated CVE-2025-69942 [=
https://www.cve.org/CVERecord?id=3DCVE-2025-69942 ] kishan0725--Hospital M= anagement System kishan0725 Hospital Management System 4.0 is vulnerale to = SQL Injection in get_doctor.php via the parameters doctor and specilization= id. 2026-07-29 not yet calculated CVE-2025-69943 [ https://www.cve.org/CVER= ecord?id=3DCVE-2025-69943 ] kishan0725--Hospital Management System kishan07=
25 Hospital Management System 4.0 is vulnerable to SQL Injection in the vie= w-medhistory.php endpoint via the viewid parameter. 2026-07-29 not yet calc= ulated CVE-2025-69944 [ https://www.cve.org/CVERecord?id=3DCVE-2025-69944 ]=
kishan0725--Hospital Management System kishan0725 Hospital Management Syst=
em 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=3D=
1. 2026-07-29 not yet calculated CVE-2025-69945 [ https://www.cve.org/CVERe= cord?id=3DCVE-2025-69945 ] kishan0725--Hospital Management System kishan072=
5 Hospital Management System 4.0 is vulnerable to SQL Injection in check_av= ailability.php via the parameters emailid and email. 2026-07-29 not yet cal= culated CVE-2025-69949 [ https://www.cve.org/CVERecord?id=3DCVE-2025-69949 =
] Kong--Kubernetes Ingress Controller Kong Kubernetes Ingress Controller (K= IC) allows a user with namespace-scoped Secret creation privileges to cause=
a cluster-wide ingress configuration denial of service. KIC collects CA-ce= rtificate Secrets across all watched namespaces using a label selector alon=
e, without ingress-class or namespace restrictions. The CA-certificate prim= ary key is derived from a user-supplied field in the Secret. Duplicate CA-c= ertificate IDs cause Kong Gateway to reject the entire configuration docume=
nt and halting all ingress changes cluster-wide. 2026-07-29 not yet calcula= ted CVE-2026-15228 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15228 ] Ko= ng--Kubernetes Ingress Controller Kong Operator's embedded Kong Kubernetes = Ingress Controller (KIC) allows a user with namespace-scoped Secret creatio=
n privileges to cause a cluster-wide ingress configuration denial of servic=
e. The embedded KIC collects CA-certificate Secrets across all watched name= spaces using a label selector alone, without ingress-class or namespace res= trictions. The CA-certificate primary key is derived from a user-supplied f= ield in the Secret. Duplicate CA-certificate IDs cause Kong Gateway to reje=
ct the entire configuration document and halting all ingress changes cluste= r-wide. 2026-07-29 not yet calculated CVE-2026-16543 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-16543 ] kyndryl-open-source--hashi-vault-js hashi-v= ault-js is a Node.js module for interacting with the HashiCorp Vault API. P= rior to 0.5.2, src/Vault.js concatenates unencoded identifier values includ= ing name, username, group, role, and version into Vault request paths and q= uery strings instead of using encodeURIComponent() and URLSearchParams, all= owing path traversal and query parameter injection. This issue is fixed in = version 0.5.2. 2026-07-31 not yet calculated CVE-2026-55100 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-55100 ] LangGenius--Dify Dify AI Workflow oa= uth_redirect_url Open Redirect Vulnerability. This vulnerability allows rem= ote attackers to disclose sensitive information on affected installations o=
f Dify. User interaction is required to exploit this vulnerability in that = the target must visit a malicious page or open a malicious file. The specif=
ic flaw exists within the OAuth flow handling in the AppInitializer compone= nt. An attacker can force a redirection to a site that serves malicious con= tent. An attacker can leverage this vulnerability to disclose information i=
n the context of the application. Was ZDI-CAN-29196. 2026-07-29 not yet cal= culated CVE-2026-18266 [ https://www.cve.org/CVERecord?id=3DCVE-2026-18266 =
] Legion of the Bouncy Castle Inc.--BC-JAVA In Bouncy Castle for Java from = 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-= derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes=
the decrypted message, and the ciphertext compression routines Poly.compre= ssPoly and PolyVec.compressPolyVec. An attacker able to measure the timing =
of a large number of decapsulations performed with the same long-term priva=
te key can recover that key. These are the KyberSlash1 (Poly.toMsg) and Kyb= erSlash2 (ciphertext compression) divisions. Compression performed during e= ncapsulation operates on values that become the public ciphertext and is no=
t affected. 2026-07-28 not yet calculated CVE-2024-14041 [ https://www.cve.= org/CVERecord?id=3DCVE-2024-14041 ] Lenxel WP--Lenxel WP The Lenxel WP Word= Press theme through 1.0.31 does not perform any authorization or ownership = check on its password-reset action, validating only a CSRF nonce, allowing = unauthenticated attackers to reset the password of any user (including an a= dministrator) and take over the account. 2026-08-02 not yet calculated CVE-= 2026-12586 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12586 ] LG Electro= nics--SmartShare Improper neutralization of special elements used in an SQL=
command ('SQL injection') vulnerability in LG Electronics SmartShare allow=
s SQL Injection. This issue affects SmartShare: through 2.3.1712.1202,=C2= =A0which is supported on Microsoft Windows 10 and earlier versions. 2026-07= -30 not yet calculated CVE-2026-15929 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-15929 ] LifterLMS--LifterLMS The LifterLMS WordPress plugin before=
10.0.10 does not strip event-handler attributes from a course pricing fiel=
d before storing and rendering it, allowing users with a course-editing rol=
e to inject JavaScript that executes in the session of an administrator who=
views the course. 2026-07-30 not yet calculated CVE-2026-14207 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-14207 ] LifterLMS--LifterLMS The LifterL=
MS WordPress plugin before 10.0.10 does not perform a capability check in o=
ne of its select2 query AJAX handlers, only verifying that the user is logg=
ed in, allowing any authenticated user with subscriber-level access to read=
the titles of internal post types such as coupon codes by supplying the po=
st type. 2026-07-30 not yet calculated CVE-2026-14231 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-14231 ] Lightbox with PhotoSwipe--Lightbox with Ph= otoSwipe The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does no=
t sanitise or escape a link data attribute before rendering it into the ima=
ge lightbox caption in the browser, allowing users with author-level access=
and above (who lack the unfiltered_html capability) to store JavaScript th=
at runs when a visitor or administrator opens the lightbox. 2026-07-31 not = yet calculated CVE-2026-14833 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -14833 ] Link Library--Link Library Improper neutralization of input during=
web page generation ('cross-site scripting') vulnerability in Link Library=
allows Cross-Site Scripting (XSS). This issue affects Link Library: before=
7.9.4. 2026-07-29 not yet calculated CVE-2026-18197 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-18197 ] Linux--Linux In the Linux kernel, the follo= wing vulnerability has been resolved: KVM: x86: wean fast IN from emulator_= pio_in Use __emulator_pio_in() directly for fast PIO instead of bouncing th= rough emulator_pio_in() now that __emulator_pio_in() fills "val" when handl= ing in-kernel PIO. vcpu->arch.pio.count is guaranteed to be '0', so this a = pure nop. emulator_pio_in_emulated is now the last caller of emulator_pio_i=
n. No functional change intended. 2026-07-30 not yet calculated CVE-2022-49=
94 [ https://www.cve.org/CVERecord?id=3DCVE-2022-4994 ] Linux--Linux In the=
Linux kernel, the following vulnerability has been resolved: bridge: cfm: = reject invalid CCM interval at configuration time ccm_tx_work_expired() re-= arms itself via queue_delayed_work() using the configured exp_interval conv= erted by interval_to_us(). When exp_interval is BR_CFM_CCM_INTERVAL_NONE or=
out of range, interval_to_us() returns 0, causing the worker to fire immed= iately in a tight loop that allocates skbs until OOM. Fix this by validatin=
g exp_interval at configuration time: - Constrain IFLA_BRIDGE_CFM_CC_CONFIG= _EXP_INTERVAL to the valid range [BR_CFM_CCM_INTERVAL_3_3_MS, BR_CFM_CCM_IN= TERVAL_10_MIN] in the netlink policy so userspace cannot set an invalid val= ue. - Reject starting CCM TX in br_cfm_cc_ccm_tx() when exp_interval has no=
t yet been configured (defaults to 0 from kzalloc). 2026-07-27 not yet calc= ulated CVE-2026-64537 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64537 ]=
Linux--Linux In the Linux kernel, the following vulnerability has been res= olved: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). fib6_nh_mtu_change=
() re-fetches idev via __in6_dev_get(arg->dev) and dereferences idev->cnf.m= tu6 without a NULL check. addrconf_ifdown() clears dev->ip6_ptr with RCU_IN= IT_POINTER() after rt6_disable_ip() has released tb6_lock, so the RA-driven=
MTU walk can observe a NULL idev and oops. The caller rt6_mtu_change_route=
() guards its own __in6_dev_get(), but this re-fetch is unguarded; nexthop-= backed routes survive addrconf_ifdown()'s flush, so the walk still reaches =
it after ip6_ptr is nulled. Return 0 when idev is NULL, matching rt6_mtu_ch= ange_route() and the fib6_mtu() fix in commit 5ad509c1fdad ("ipv6: Fix null= -ptr-deref in fib6_mtu()."). Oops: general protection fault, ... KASAN: nul= l-ptr-deref in range [0x00000000000002a8-0x00000000000002af] RIP: 0010:fib6= _nh_mtu_change+0x203/0x990 rt6_mtu_change_route+0x141/0x1d0 __fib6_clean_al= l+0xd0/0x160 rt6_mtu_change+0xb4/0x100 ndisc_router_discovery+0x24b5/0x2cb0=
icmpv6_rcv+0x12e9/0x1710 ipv6_rcv+0x39b/0x410 2026-07-27 not yet calculate=
d CVE-2026-64538 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64538 ] Linu= x--Linux In the Linux kernel, the following vulnerability has been resolved=
: ipv6: ndisc: fix NULL deref in accept_untracked_na() accept_untracked_na(=
) re-fetches the inet6_dev with __in6_dev_get(dev) and dereferences idev->c= nf.accept_untracked_na without a NULL check, even though its only caller nd= isc_recv_na() already fetched and NULL-checked idev for the same device. Bo=
th reads of dev->ip6_ptr run in the same RCU read-side critical section, bu=
t a concurrent addrconf_ifdown() can clear dev->ip6_ptr between them: lower= ing the MTU below IPV6_MIN_MTU calls addrconf_ifdown() without the synchron= ize_net() that orders the unregister path, so the re-fetch returns NULL and=
oopses: BUG: KASAN: null-ptr-deref in ndisc_recv_na (net/ipv6/ndisc.c:974)=
Read of size 4 at addr 0000000000000364 Call Trace: <IRQ> ndisc_recv_na (n= et/ipv6/ndisc.c:974) icmpv6_rcv (net/ipv6/icmp.c:1193) ip6_protocol_deliver= _rcu (net/ipv6/ip6_input.c:479) ip6_input_finish (net/ipv6/ip6_input.c:534)=
ip6_input (net/ipv6/ip6_input.c:545) ip6_mc_input (net/ipv6/ip6_input.c:63=
5) ipv6_rcv (net/ipv6/ip6_input.c:351) </IRQ> It is reachable by an unprivi= leged user via a network namespace. Pass the caller's already validated ide=
v instead of re-fetching it; the idev stays alive for the whole RCU critica=
l section, so it is safe even after dev->ip6_ptr has been cleared. 2026-07-=
27 not yet calculated CVE-2026-64542 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-64542 ] Linux--Linux In the Linux kernel, the following vulnerabili=
ty has been resolved: crypto: asymmetric_keys - fix OOB read in pefile_dige= st_pe_contents pefile_digest_pe_contents() computes the trailing-data hash = length as pelen - (hashed_bytes + certs_size). A crafted PE can make the ad= dition exceed pelen, causing the unsigned subtraction to underflow to ~4 Gi=
B. This is passed to crypto_shash_update() which reads out of bounds and pa= nics on unmapped vmalloc guard pages. BUG: unable to handle page fault for = address: ffffc900038d8000 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:s= ha256_blocks_generic (lib/crypto/sha256.c:152) Call Trace: <TASK> __sha256_= update (lib/crypto/sha256.c:208) crypto_sha256_update (crypto/sha256.c:142)=
verify_pefile_signature (crypto/asymmetric_keys/verify_pefile.c:436) kexec= _kernel_verify_pe_sig (kernel/kexec_file.c:151) __do_sys_kexec_file_load (k= ernel/kexec_file.c:406) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entr= y_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) </TASK> Kernel p= anic - not syncing: Fatal exception Validate that the addition does not ove= rflow and the result does not exceed pelen before the subtraction. Return -= ELIBBAD on failure. 2026-07-27 not yet calculated CVE-2026-64544 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-64544 ] Linux--Linux In the Linux kerne=
l, the following vulnerability has been resolved: Bluetooth: bpa10x: avoid = OOB read of revision string in bpa10x_setup() bpa10x_setup() sends the vend=
or command 0xfc0e and passes the response to bt_dev_info() and hci_set_fw_i= nfo() as a "%s" string starting at skb->data + 1, without checking the leng= th: bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); hci_set_fw_info(hdev,=
"%s", skb->data + 1); A device that returns a one-byte response (status on= ly) leaves skb->data + 1 past the end of the data, and the %s walk reads ad= jacent slab memory until it meets a NUL. The same happens when the payload =
is not NUL-terminated within skb->len. The out-of-bounds bytes end up in th=
e kernel log and the firmware-info debugfs file. Print the revision string = with a bounded "%.*s" limited to skb->len - 1 instead. This keeps the strin=
g readable for well-behaved devices while never reading past the received d= ata, and does not fail setup, so a device returning a short or unterminated=
response keeps working. 2026-07-27 not yet calculated CVE-2026-64549 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-64549 ] Linux--Linux In the Linux = kernel, the following vulnerability has been resolved: net: psample: fix in=
fo leak in PSAMPLE_ATTR_DATA psample open codes nla_put() presumably to avo=
id wiping the data with 0s just to override it with packet data. This open = coding is missing clearing the pad, however, each netlink attr is padded to=
4B and data_len may not be divisible by 4B. 2026-07-27 not yet calculated = CVE-2026-64553 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64553 ] Linuxf= abrik--monitoring-plugins Linuxfabrik monitoring-plugins provides Python mo= nitoring plugins for Icinga, Nagios, and related monitoring systems. In ver= sion 6.0.0, the logfile check legacy database migration moved a predictable=
path from /tmp with os.rename() and allowed a local user controlling the p= lugin account to place a symlink that would be followed by sqlite3.connect(=
) during a root-run check. 2026-07-29 not yet calculated CVE-2026-67433 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-67433 ] Linuxfabrik--monitoring-= plugins linuxfabrik-lib provides Python modules for database access, cachin=
g, shell execution, and API integrations. Prior to version 6.0.0, lib.url.f= etch() followed cross-origin redirects while forwarding caller-supplied cre= dential headers other than Authorization and Cookie, allowing a malicious r= edirect-capable server to receive headers such as X-Auth-Token from authent= icated monitoring requests. This issue is fixed in version 6.0.0. 2026-07-2=
9 not yet calculated CVE-2026-67435 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-67435 ] Linuxfabrik--monitoring-plugins Linuxfabrik monitoring-plugi=
ns provides Python monitoring plugins for Icinga, Nagios, and related monit= oring systems. In 6.0.0 and earlier, the redfish-* plugins built request UR=
Ls by concatenating an operator-supplied base URL with response-supplied @o= data.id links, allowing a malicious or compromised BMC to redirect authenti= cated Redfish requests and disclose X-Auth-Token or HTTP Basic credentials.=
2026-07-29 not yet calculated CVE-2026-67436 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-67436 ] Login & Register Forms--Login & Register Forms The=
Login & Register Forms WordPress plugin before 3.2.5 does not properly enf= orce the rate limit on its password-reset verification-code flow, keying bo=
th the verification code and the per-source attempt counter on an unauthent= icated, client-controlled value, allowing unauthenticated attackers to rese=
t the limit at will and brute-force the code to take over any account, incl= uding administrators, when the verification-code reset mode is enabled. 202= 6-08-01 not yet calculated CVE-2026-14836 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-14836 ] login-social--login-social The login-social WordPress = plugin through 1.0.4 does not validate password-reset requests against a re= set key or the requester's identity, and it issues authentication sessions = from unverified third-party sign-in data, allowing unauthenticated attacker=
s to reset any user's password or log in as any existing account, including=
administrators, and take over the site. 2026-08-02 not yet calculated CVE-= 2026-16261 [ https://www.cve.org/CVERecord?id=3DCVE-2026-16261 ] lookyloo--= lookyloo A stored cross-site scripting vulnerability existed in the capture=
tree visualization page. The application embedded the serialized capture t= ree directly into an inline JavaScript block using the Jinja safe filter. B= ecause the tree data can contain values derived from captured and potential=
ly attacker-controlled web content, a specially crafted value could prematu= rely terminate the surrounding <script> element and inject arbitrary HTML o=
r JavaScript. The malicious code would execute in the browser of a user vie= wing the affected capture tree. Successful exploitation could allow an atta= cker to perform actions using the victim's authenticated session, access in= formation available to the victim, or modify application data within the pe= rmissions of the affected user. The patch removes the JSON data from the HT=
ML document and retrieves it through a dedicated API endpoint. The client t= hen processes the response using response.json(), preventing capture data f= rom being interpreted as executable content within the original page's HTML=
or JavaScript context. 2026-07-27 not yet calculated CVE-2026-66824 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-66824 ] lookyloo--lookyloo Lookyloo=
did not enforce limits on the decompressed size of uploaded capture archiv=
es and compressed HAR files. An attacker could submit a specially crafted Z= IP, gzip, or zlib-compressed capture containing data that expands to a very=
large size during processing. Because the application decompressed this co= ntent directly in memory without first limiting the output size, processing=
the malicious capture could exhaust available memory, terminate a web or w= orker process, or make the Lookyloo instance unavailable. The vulnerability=
affects both full Lookyloo capture archive imports and API submissions con= taining gzip-compressed HAR data. Repeated exploitation could cause a persi= stent denial-of-service condition until the affected processes or instance = are restarted. The patch introduces: * A 1 GB cumulative uncompressed-size = limit for imported capture archives. * Size-limited gzip and zlib decompres= sion for compressed HAR files. * Explicit detection and handling of suspect=
ed zip bombs. * An HTTP 400 response when an oversized compressed HAR file =
is submitted through the API. 2026-07-28 not yet calculated CVE-2026-66913 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-66913 ] LWS Optimize--LWS Opt= imize The LWS Optimize WordPress plugin before 3.4 does not perform a capab= ility check on its cache-clearing actions, allowing any authenticated user,=
including Subscribers, to flush the site's caches and force repeated cache=
rebuilds. 2026-08-02 not yet calculated CVE-2026-16042 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-16042 ] Mailgun--Mailgun for WordPress The Mailg=
un for WordPress plugin before 2.2.1 does not perform any capability or non=
ce check on an unauthenticated AJAX action that adds subscribers to the sit=
e owner's configured email service mailing lists, allowing unauthenticated = attackers to enrol arbitrary email addresses into those lists using the own= er's stored API credentials. 2026-07-31 not yet calculated CVE-2026-14834 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-14834 ] MainWP Child--MainWP C= hild The MainWP Child WordPress plugin before 6.1.2 does not verify the req= uester's identity in its site-registration request handler when password au= thentication has been disabled for the targeted account, allowing an unauth= enticated attacker to obtain a valid authentication session as that account=
, including an administrator, by naming its login in a single registration = request. 2026-07-27 not yet calculated CVE-2026-12255 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-12255 ] malach-it--boruta Authentication Bypass by=
Capture-replay vulnerability in malach-it Boruta allows an attacker who ha=
s obtained a previously valid JWT client assertion to authenticate as the i= ssuing OAuth client after the assertion has expired. Boruta accepts JWT-bas=
ed client authentication (client_secret_jwt and private_key_jwt token endpo= int authentication methods) but never enforces that the assertion's exp cla=
im is in the future. The pre-check helper Boruta.Oauth.Request.Base.check_e= xpiration/1 in lib/boruta/oauth/request/base.ex only verifies that an exp c= laim is present (it pattern-matches on the existence of the key and returns=
success), and the Joken token configuration used for signature verificatio=
n, Boruta.Oauth.Authorization.Client.Token.token_config/0 in lib/boruta/oau= th/authorization/client.ex, returns an empty map, so Joken's default exp cl= aim validator is not engaged either. Any attacker who obtains a validly-sig= ned client assertion (for example through logs, reverse proxies, browser to= oling, or other observability surfaces) can replay it indefinitely to authe= nticate as the client and obtain access tokens with that client's privilege=
s. This issue affects boruta: from 2.3.0 before 2.3.7. 2026-07-30 not yet c= alculated CVE-2026-53431 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5343=
1 ] malach-it--boruta Server-Side Request Forgery vulnerability in malach-i=
t Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenI=
D authorization server to issue outbound HTTP requests to attacker-chosen U= RIs, including internal services and cloud metadata endpoints. Three code p= aths fetch remote URIs supplied by the requester without sufficient validat= ion of the target. Boruta.Oauth.Request.Base.fetch_unsigned_request/1 in li= b/boruta/oauth/request/base.ex dereferences the OAuth request_uri parameter=
from the authorization request via Finch.build(:get, request_uri) |> Finch= .request(OpenIDHttpClient). Boruta.Openid.parse_registration_params/2 in li= b/boruta/openid.ex dereferences the jwks_uri supplied in an OpenID Connect = dynamic client registration request. Boruta.Ecto.Clients.refresh_jwk_from_j= wks_uri/1 in lib/boruta/adapters/ecto/clients.ex later refreshes the stored=
jwks_uri for an existing client. In all three paths the only validation is=
that the URI parses with a scheme (and one of the two request_uri clauses = does not even restrict the scheme to http or https). The implementations do=
not require HTTPS, do not enforce a host or IP allowlist, do not reject lo= opback, private, link-local, or other non-public ranges after DNS resolutio=
n, do not cap response size, and do not constrain redirects. An attacker ca=
n therefore steer the server's HTTP client at arbitrary network targets rea= chable from the Boruta host. This issue affects boruta: from 2.3.2 before 2= .3.7. 2026-07-30 not yet calculated CVE-2026-54885 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-54885 ] malach-it--boruta Improper Isolation or Compa= rtmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid mod= ule) allows attackers to register OpenID Connect clients with administrativ=
e privileges through the dynamic client registration entry point. Boruta.Op= enid.register_client/3 forwards caller-supplied registration parameters to = the administrative client creation path without a public/admin field-level = allowlist, so an unauthenticated registrant can set security-sensitive attr= ibutes including supported grant types, authorized scopes, PKCE enforcement=
, public refresh and revocation behavior, token lifetimes, and signing sett= ings. The library does not distinguish between metadata a public registrant=
is allowed to set and administrative controls that should require operator=
approval. This vulnerability is associated with program files lib/boruta/o= penid.ex and program routines 'Elixir.Boruta.Openid':register_client/3, 'El= ixir.Boruta.Openid':parse_registration_params/2. This issue affects boruta = from 2.3.0 before 2.3.7. 2026-07-30 not yet calculated CVE-2026-65635 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-65635 ] Mapster WP Maps--Mapster W=
P Maps The Mapster WP Maps WordPress plugin before 1.24.0 does not perform = any authorization or post-status check on a public REST endpoint, allowing = unauthenticated users to retrieve the title and full content of any post re= gardless of its status, including unpublished (draft, pending, private, and=
trashed) posts. 2026-08-01 not yet calculated CVE-2026-14839 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-14839 ] Masteriyo LMS--Masteriyo LMS The M= asteriyo LMS WordPress plugin before 2.3.1 does not correctly verify author= ization on an unauthenticated AJAX action used to clear user sessions, allo= wing unauthenticated attackers to terminate the active sessions (force-logo= ut) of any user on the site, including administrators. 2026-07-27 not yet c= alculated CVE-2026-13332 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1333=
2 ] Media Manager--TastyIgniter A stored Cross-Site Scripting (XSS) vulnera= bility in the file upload functionality of the Media Manager in TastyIgnite=
r v4.3.0, caused by insufficient validation and sanitization of SVG files. =
An authenticated user with low privileges can upload a malicious SVG file c= ontaining JavaScript code. When an administrator views that file, the code = executes in the context of their browser. By chaining this vulnerability wi=
th a Cross-Site Request Forgery (CSRF) attack, an attacker can extract the = administrator's CSRF token and perform unauthorized actions-such as modifyi=
ng credentials-thereby gaining full control of the administrative account. = 2026-07-27 not yet calculated CVE-2026-14856 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-14856 ] MemberGlut--MemberGlut The MemberGlut WordPress plu= gin before 1.1.5 does not validate the role chosen during front-end registr= ation, allowing unauthenticated users to register an account with an arbitr= ary role, including administrator, leading to full site compromise. 2026-07= -27 not yet calculated CVE-2026-12394 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-12394 ] Mercusys--MB115-4G Denial-of-service (DoS) vulnerability d=
ue to a stack buffer overflow in the http_gdpr_decrypt function of the Merc= usys MB115-4G device's web interface. An unauthenticated attacker could exp= loit this vulnerability by sending a specially crafted request to the /cgi/= login endpoint, causing memory corruption and the httpd process to crash, r= esulting in a denial of service for the web administration service. 2026-07= -27 not yet calculated CVE-2026-12495 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-12495 ] Meta Box--Meta Box The Meta Box WordPress plugin before 5.= 13.1 does not verify that a user is authorized to delete the supplied attac= hment before deleting it, allowing users with a low-privilege role such as = Contributor to permanently delete arbitrary media attachments belonging to = other users. 2026-08-02 not yet calculated CVE-2026-15248 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-15248 ] Milk admin--Milk admin An issue in the=
redirect parameter in Milk admin <=3D0.9.8 allows remote attackers to redi= rect users to arbitrary external URLs via a crafted request. 2026-07-27 not=
yet calculated CVE-2026-51564 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-51564 ] Milk admin--Milk admin Cross-site scripting (XSS) vulnerability i=
n Modules/Docs/DocsController.php in Milk admin <=3D0.9.8 allows remote att= ackers to inject arbitrary web script or HTML via the action parameter in a=
crafted request 2026-07-27 not yet calculated CVE-2026-51565 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-51565 ] miniOrange 2FA--miniOrange 2FA The=
miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitt=
ed one-time password against the targeted user's stored secret, instead ver= ifying it against an attacker-supplied value, allowing an unauthenticated a= ttacker who knows a victim's password to bypass two-factor authentication a=
nd gain access to the victim's account, including administrators. 2026-07-3=
1 not yet calculated CVE-2026-12695 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-12695 ] miniOrange--miniOrange Social Login and Register (Discord, G= oogle, Twitter, LinkedIn) The miniOrange Social Login and Register (Discord=
, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind th=
e one-time code used by its optional email-verification (Profile Completion=
) feature to the account it was issued for, allowing unauthenticated attack= ers to obtain a valid session for any account, including administrators, by=
requesting a code for an email address they control and replaying it again=
st the victim's email address. Exploitation requires the Profile Completion=
feature to be enabled and social login to be configured. 2026-07-29 not ye=
t calculated CVE-2026-14300 [ https://www.cve.org/CVERecord?id=3DCVE-2026-1= 4300 ] misp--misp MISP installation scripts generated an Apache HTTP virtua= l-host configuration containing an incorrectly formatted HTTP-to-HTTPS redi= rect: Redirect permanent / https://misp.example Apache's Redirect directive=
appends any portion of the requested path that follows the matched prefix =
to the configured destination URL. Because the destination did not end with=
/, attacker-controlled path content was appended directly to the hostname = rather than to its URL path. For example, a request resembling: http://misp= .example/@attacker.example/ could result in a redirect resembling: https://= misp.example@attacker.example/ Under standard URL parsing, misp.example is = interpreted as user information and attacker.example as the destination hos=
t. An unauthenticated remote attacker could therefore construct a URL hoste=
d under the legitimate MISP domain that redirects users to an attacker-cont= rolled website. The vulnerability could be used for phishing, credential co= llection, or potentially disclosing sensitive query-string information pres= erved during the redirect. Exploitation requires a user to follow the craft=
ed HTTP URL. The fix adds the missing trailing slash to the redirect destin= ation, ensuring that appended request data remains part of the path on the = configured MISP host. Existing installationsExisting MISP installations sho= uld review their Apache HTTP virtual-host configuration and ensure that the=
HTTPS redirect destination ends with a trailing slash: Redirect permanent =
/ https://misp.example/ After updating the configuration, validate it with = apachectl configtest and reload or restart Apache for the change to take ef= fect 2026-07-28 not yet calculated CVE-2026-67178 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-67178 ] Mitsubishi Electric Corporation--MELSEC MX Con= troller MX-R model MXR300-16 Improper Enforcement of Message Integrity Duri=
ng Transmission in a Communication Channel vulnerability in Mitsubishi Elec= tric MELSEC MX Controller MX-R model, MELSEC MX Controller MX-F model, Mast= er/local module, CC-Link IE TSN interface board, Motion module, Motion Cont= rol Board, Block-type remote module, Block-type remote module with safety f= unctions, Analog-Digital converter module, Digital-Analog converter module,=
CC-Link IE TSN compatible coupler, FPGA module, Tension meter, AC Servo ME= LSERVO-J5, AC Servo MELSERVO-JET, Liner Track System MTR-S series Linear tr= ack control module, Inverter FR-A800/F800/E800 Series, Industrial Robot CR8= 00-D series controller Network Base Card, CC-Link IE TSN expansion unit, CC= -Link IE TSN-CC-Link IE Field Network bridge module, CC-Link IE TSN-AnyWire= ASLINK bridge module, Energy Measuring Unit CC-Link IE TSN Communication Un= it, Industrial Computer MELIPC series, GOT3000 Series, CC-Link IE TSN Commu= nication Unit, Motion Control Software, CC-Link IE TSN Communication Softwa=
re for Windows, Analysis Support Software MELSOFT VIMA, Master/Local module=
Designated communication LSI DeviceKit, Master/Local module Designated com= munication LSI, Remote Station Communication LSI with GbE-PHY, CC-Link IE T=
SN Master/Local module Designated communication LSI SDK, and Remote station=
software development kit allows an attacker with access to a CC-Link IE TS=
N network to tamper with communication data (control input/output values) b=
y sending specially crafted packets under specific timing conditions. This = could allow the attacker to cause a denial-of-service (DoS) condition in th=
e affected product by interfering with its control function or causing it t=
o operate incorrectly. 2026-07-30 not yet calculated CVE-2026-13584 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-13584 ] modelcontextprotocol--ruby-s=
dk MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers=
and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTrans= port in the mcp gem does not validate the HTTP Host or Origin request heade= rs, which allows a malicious browser page to use DNS rebinding to reach a l= ocally running MCP server and invoke exposed tools. This issue is fixed in = version 0.23.0. 2026-07-29 not yet calculated CVE-2026-63118 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-63118 ] modelcontextprotocol--ruby-sdk MCP = Ruby SDK is the official Ruby SDK for Model Context Protocol servers and cl= ients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in=
the mcp gem does not bind a session ID to a session owner, allowing an att= acker with a stolen session ID to send tools/call requests that execute in = the victim's session. This issue is fixed in version 0.23.0. 2026-07-29 not=
yet calculated CVE-2026-67431 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-67431 ] MotoPress--MotoPress Hotel Booking The MotoPress Hotel Booking Wo= rdPress plugin before 6.0.4 does not perform a capability check before retu= rning a booking's full customer details in one of its AJAX actions, allowin=
g any authenticated user with a low-privileged account (Subscriber and abov=
e) to read the personal data, including name, email, phone, and address, of=
any customer. 2026-07-30 not yet calculated CVE-2026-15235 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-15235 ] MPG--MPG The MPG WordPress plugin be= fore 4.1.8 does not sanitise and escape a parameter before reflecting it ba=
ck in the response, allowing unauthenticated attackers to perform Reflected=
Cross-Site Scripting against a victim who is induced to send a crafted req= uest. 2026-07-27 not yet calculated CVE-2026-13726 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-13726 ] msgpack--msgpack-ruby MessagePack for Ruby is=
an implementation of the MessagePack binary serialization format. Prior to=
1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last,=
rmem_end, and rmem_owner stale after _msgpack_buffer_shift_chunk returns a=
n rmem page to the shared pool, allowing a subsequent Buffer#write and a se= cond MessagePack::Buffer to alias the page and disclose or corrupt cross-bu= ffer data. This issue is fixed in version 1.8.2. 2026-07-30 not yet calcula= ted CVE-2026-54522 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54522 ] MS= I--MSI Center MSI Center NTIOLib_X64 Origin Validation Error Local Privileg=
e Escalation Vulnerability. This vulnerability allows local attackers to es= calate privileges on affected installations of MSI Center. An attacker must=
first obtain the ability to execute low-privileged code on the target syst=
em in order to exploit this vulnerability. The specific flaw exists within = the NTIOLib_X64.sys driver. The issue results from insufficient validation =
of the origin of commands. An attacker can leverage this vulnerability to e= scalate privileges and execute arbitrary code in the context of SYSTEM. Was=
ZDI-CAN-28935. 2026-07-29 not yet calculated CVE-2026-6102 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-6102 ] N-able--N-central Authentication bypa=
ss using an alternate path or channel vulnerability in N-able N-central all= ows Authentication Bypass. This issue affects N-central: through 2026.1. 20= 26-08-01 not yet calculated CVE-2026-18556 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-18556 ] N-able--N-central An incomplete patch for CVE-2026-18= 556 allows for authentication bypass and account takeover in N-central Vers= ions through 2026.3.1 2026-08-02 not yet calculated CVE-2026-18577 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-18577 ] Narrative Publisher--Narrativ=
e Publisher The Narrative Publisher WordPress plugin through 1.0.7 does not=
restrict write access to a REST-exposed post meta field or escape it when = rendering, allowing users with contributor-level access and above to store = JavaScript that executes in the browser of any higher-privileged user who v= iews the affected post. 2026-08-02 not yet calculated CVE-2026-16273 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-16273 ] netty--netty Netty is an as= ynchronous, event-driven network application framework. Prior to versions 4= .1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via = the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and o= mitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a = protocol switch that a proxy would not recognize as an Upgrade request and = enabling HTTP request smuggling / protocol-confusion attacks. This issue ha=
s been fixed in versions 4.1.136.Final and 4.2.16.Final. 2026-07-29 not yet=
calculated CVE-2026-59898 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59= 898 ] netty--netty Netty is an asynchronous, event-driven network applicati=
on framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpConten= tEncoder` (the superclass of the production handler `HttpContentCompressor`=
) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQ= ueue` that accumulates attacker-controlled data without any size limit. The=
queue is filled on the I/O thread for every inbound HTTP request and drain=
ed only when the application later writes a non-1xx response. This creates =
a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipe= lining to flood the connection with requests faster than the application pr= oduces responses. This issue has been fixed in versions 4.1.136.Final and 4= .2.16.Final. 2026-07-29 not yet calculated CVE-2026-59899 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-59899 ] netty--netty Netty is an asynchronous,=
event-driven network application framework. Prior to versions 4.1.136.Fina=
l and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2Str= eamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to dedupl= icate or validate `Host` headers when an HTTP/2 client supplies both the `:= authority` pseudo-header and a literal `host` header in a single HEADERS fr= ame. The translator maps `:authority` to `Host` and separately copies the l= iteral `host` header, producing an `HttpRequest` object containing two `Hos=
t` headers with attacker-controlled differing values. This issue has been f= ixed in versions 4.1.136.Final and 4.2.16.Final. 2026-07-29 not yet calcula= ted CVE-2026-59900 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59900 ] ne= tty--netty Netty is an asynchronous, event-driven network application frame= work. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` = handler in Netty's compression codec pipeline is vulnerable to a denial-of-= service attack through a malformed bzip2 stream that permanently captures t=
he event-loop thread in an infinite loop. The vulnerability exists in the r= un-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read= ()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.=
2026-07-29 not yet calculated CVE-2026-59901 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-59901 ] NewStatPress--NewStatPress The NewStatPress WordPr= ess plugin before 1.4.5 does not sanitise and escape data derived from unau= thenticated visitor requests before storing it and later outputting it in o=
ne of its widgets, which could allow unauthenticated attackers to perform S= tored Cross-Site Scripting attacks against users viewing the affected widge=
t. 2026-07-31 not yet calculated CVE-2026-14845 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-14845 ] ninenines--cowboy Allocation of Resources Withou=
t Limits or Throttling vulnerability in ninenines cowboy allows an unauthen= ticated remote attacker to exhaust connection process memory over HTTP/1.1.=
The HTTP/1.1 handler in cowboy_http enforces the max_headers limit by coun= ting the number of distinct header names in a map (maps:size(Headers)). Whe=
n a request contains multiple header lines with the same name, the values a=
re concatenated into a single ever-growing binary stored under that one map=
key (", " for regular headers, "; " for cookies), so the map size stays at=
one and the max_headers cap (default 100) is never reached. Because no acc= umulator bounds the total number of header lines or the total byte size of = the header block (only per-line max_header_name_length and max_header_value= _length apply), an unauthenticated client can send an arbitrary number of h= eader lines with the same name and grow the connection process's binary mem= ory to arbitrary size within the request window. The impact per connection =
is bounded by request_timeout (default 5 seconds, not reset by header data)=
, and by max_heap_size when set (the offending connection process is killed=
once its heap grows past the limit). When max_heap_size is left at the def= ault (unset), sustained abuse can drive the Erlang VM into out-of-memory co= nditions. This issue affects cowboy from 2.0.0-pre.4 before 2.18.0. 2026-07= -28 not yet calculated CVE-2026-65624 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-65624 ] ninenines--cowlib Allocation of resources without limits v= ulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or=
HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cau=
se a denial of service. The HPACK and QPACK prefixed-integer decoder cow_hp= ack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpac= k:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 i=
n src/cow_qpack.erl) reads continuation octets until it sees one whose high=
bit is clear, evaluating Int + (Value bsl M) at each step with the shift M=
growing by seven per octet. No limit is enforced on the number of continua= tion octets, on the resulting bit width, or on the value; the decoder consu= mes whatever encoded length the peer supplies. Because Erlang integers are = immutable, each intermediate Value bsl M and each accumulator update alloca= tes a fresh bignum whose digit width grows linearly with the number of octe=
ts processed so far. Summed across the whole decode, the transient bignum d= igit materialization is on the order of the square of the encoded length. A=
single maximal HPACK indexed representation carried inside one HTTP/2 HEAD= ERS plus one CONTINUATION frame at Cowboy's default max_frame_size_received=
can force hundreds of megabytes of transient allocation and garbage-collec= tion churn before the resulting header-table index is rejected as invalid. = Repeated or concurrent connections multiply the pressure and can drive the = Erlang VM to memory exhaustion. Cowlib is the HTTP parser used by Cowboy, R= abbitMQ's management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 = servers and clients, so any exposed endpoint that accepts HPACK or QPACK fr=
om an untrusted peer is reachable. This issue affects cowlib: from 2.0.0 be= fore 2.19.0. 2026-07-28 not yet calculated CVE-2026-59248 [ https://www.cve= .org/CVERecord?id=3DCVE-2026-59248 ] nodejs--node A flaw in Node.js Permiss= ion Model enforcement allows `trace_events.createTracing().enable()` Writes=
Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality im= pact or bypass of the intended security boundary under affected configurati= ons. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**. 2= 026-07-30 not yet calculated CVE-2026-56847 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-56847 ] nodejs--node A flaw in Node.js HTTPS Agent connectio=
n reuse can cause PFX object-array key collisions, allowing mutual TLS (mTL=
S) client identities to be reused across requests configured with different=
client certificates. This vulnerability affects Node.js **26.x**, **24.x**=
, and **22.x**. 2026-07-30 not yet calculated CVE-2026-56850 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-56850 ] nodejs--node A flaw in Node.js Perm= ission Model enforcement allows process.report writes (and overwrites) file=
s outside --allow-fs-write paths. This can lead to confidentiality impact o=
r bypass of the intended security boundary under affected configurations. T= his vulnerability affects Node.js **22.x**, **24.x**, and **26.x**. 2026-07= -31 not yet calculated CVE-2026-58039 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-58039 ] nodejs--node An incomplete fix has been identified in Node= .js: HTTPS Agent TLS session reuse skips hostname verification across ident= ity policies (incomplete fix of CVE-2026-48934). This vulnerability affects=
Node.js **22.x**, **24.x**, and **26.x**. 2026-07-30 not yet calculated CV= E-2026-58040 [ https://www.cve.org/CVERecord?id=3DCVE-2026-58040 ] nodejs--= node A flaw in Node.js Permission Model enforcement can over-grant filesyst=
em access across radix-tree prefix boundaries. Under `--permission`, an att= acker who is granted access to one path can abuse boundary handling to read=
from or write to paths outside the intended filesystem allowlist. This vul= nerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**. 2026= -07-30 not yet calculated CVE-2026-58043 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-58043 ] Online Scheduling and Appointment Booking Syste--Online=
Scheduling and Appointment Booking System The Online Scheduling and Appoin= tment Booking System WordPress plugin before 27.8 does not sanitize or prop= erly cast a user-supplied parameter from its unauthenticated front-end book= ing requests before using it in a SQL query, allowing unauthenticated attac= kers to perform SQL injection attacks and extract sensitive data such as pa= ssword hashes from the database. 2026-07-30 not yet calculated CVE-2026-133=
95 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13395 ] open-circle--valib=
ot Valibot helps validate data using a schema. Versions prior to 1.4.2 can = throw a TypeError inside its flatten() helper when validation issues contai=
n attacker-controlled object keys such as toString, valueOf, or hasOwnPrope= rty. The issue is reachable through normal record() validation. record() in= tentionally filters __proto__, prototype, and constructor, but it still acc= epts other own keys that collide with inherited Object.prototype properties=
. If the record key schema or value schema rejects such an entry, Valibot c= reates an issue path containing that key. Passing the resulting issues to V= alibot's documented flatten() helper causes flatErrors.nested[dotPath] to r= esolve to the inherited method instead of an own error array, and the helpe=
r calls .push(...) on that function. This is not a global prototype polluti=
on issue. The impact is availability/error handling: applications that vali= date user-controlled objects with record() and flatten validation errors fo=
r API responses can crash the request path with a TypeError instead of retu= rning structured validation errors. This issue has been fixed in version 1.= 4.2. 2026-07-30 not yet calculated CVE-2026-59952 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-59952 ] open-iscsi--open-iscsi An Improper Limitation =
of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in=
open-iscsi allows remote MITM attackers=C2=A0 to create root-owned files o= utside the database and inject lines into the record. This issue affects op= en-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e. 2026-07-29=
not yet calculated CVE-2026-44943 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-44943 ] open-iscsi--open-iscsi An Incorrect Authorization vulnerabili=
ty in open-iscsi allows=C2=A0unprivilidged local users to use the isscsiuio=
control socket. This issue affects open-iscsi: from ? through 668ca1df9c9a= 1e9bdd5c999ae1d67c9c8909237e. 2026-07-29 not yet calculated CVE-2026-44944 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-44944 ] open-iscsi--open-iscs=
i A Double Free vulnerability in open-iscsi allows an=C2=A0unauthenticated= =C2=A0MITM attacker to cause=C2=A0DoS. This issue affects open-iscsi: from =
? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb. 2026-07-29 not yet calc= ulated CVE-2026-55995 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55995 ]=
OpenSBI--OpenSBI An issue was discovered in OpenSBI 1.3 allowing attackers=
to cause a denial of service via crafted request to the SBI function #2 or=
the 'Find and configure a matching counter' function of SBI PMU extension.=
2026-07-27 not yet calculated CVE-2025-63913 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2025-63913 ] OpenSolution--Quick.Cart Quick.Cart stores hard-co= ded, plaintext admin credentials in a configuration file. This flaw allows = attackers with access to the server file system to retrieve authentication = details, potentially leading to privilege escalation. The vendor assessed t=
he likelihood of exploitation as very low and determined that a fix is=C2= =A0not necessary. Only version 6.7 was tested but all versions should be co= nsidered as vulnerable. 2026-07-28 not yet calculated CVE-2026-41874 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-41874 ] OpenSolution--Quick.CMS A B= lind SQL injection vulnerability has been identified in Quick.CMS. Improper=
neutralization of input provided by a high-privileged user into multiple f= ields in administration panel allows for Blind SQL Injection attacks. The v= endor states that this administration panel already allows for significant = modification capabilities. The SQL injection vulnerability primarily enable=
s bypassing front-end validation controls and potential database destructio=
n. Given the trust model in which this application is designed to be admini= stered, remediation of this issue was not deemed necessary by the vendor. T= his vulnerability has been found in version 6.8, but other versions might a= lso be vulnerable. 2026-07-29 not yet calculated CVE-2026-33385 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-33385 ] OpenSolution--Quick.CMS In Quick= .CMS, the administrative user interface restricts deletion of the primary l= anguage by omitting the corresponding option from the interface; however, t=
he underlying language-deletion API endpoint does not enforce an equivalent=
server-side authorization check. As a result, an authenticated administrat=
or can bypass the UI-level restriction and delete the primary language by s= ending a direct HTTP request to the API endpoint. Successful deletion of th=
e primary language results in a Denial of Service (DoS) of application. Cri= tically, when combined with a separate Cross-Site Request Forgery (CSRF) vu= lnerability (CVE-2026-1468)=C2=A0an unauthenticated remote attacker can cra=
ft a malicious link, which if visited by an authenticated administrator, wi=
ll trigger the DoS condition without direct access to the application The v= endor assessed the likelihood of exploitation as very low and determined th=
at a fix is=C2=A0not necessary. 2026-07-28 not yet calculated CVE-2026-6330=
1 [ https://www.cve.org/CVERecord?id=3DCVE-2026-63301 ] OpenSolution--Quick= .CMS Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php=
endpoint via the p parameter. An authenticated attacker with admin privile= ges can include arbitrary files located within the application's directory = structure via a crafted HTTP request. Successful exploitation allows disclo= sure of the server's directory structure and absolute file paths (path disc= losure). The vendor assessed the likelihood of exploitation as very low and=
determined that a fix is=C2=A0not necessary. 2026-07-28 not yet calculated=
CVE-2026-63302 [ https://www.cve.org/CVERecord?id=3DCVE-2026-63302 ] OpenS= olution--Quick.CMS A Path Traversal vulnerability exists in Quick.CMS throu=
gh the URI path component of HTTP requests, where the server fails to norma= lize dot-dot-slash (../) sequences before resolving and serving the request=
ed file. An authenticated attacker with admin privileges=C2=A0can use this = vulnerability to read contents of files located in the sibling directory of=
the webroot via a crafted HTTP request containing ../ sequences in the URI=
. The vendor assessed the likelihood of exploitation as very low and determ= ined that a fix is=C2=A0not necessary. 2026-07-28 not yet calculated CVE-20= 26-63303 [ https://www.cve.org/CVERecord?id=3DCVE-2026-63303 ] OpenVPN--Ope= nVPN OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allo=
ws attackers via an off-by-one buffer write in the NTLM proxy authenticatio=
n to potentially cause a crash via a crafted NTLM response from a malicious=
proxy server 2026-07-30 not yet calculated CVE-2026-11771 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-11771 ] OpenVPN--OpenVPN A memory leak in the=
tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7= _alpha1 through 2.7.4 allows remote attackers to cause a denial of service = (memory exhaustion) via a flood of crafted packets 2026-07-30 not yet calcu= lated CVE-2026-12932 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12932 ] = OpenVPN--OpenVPN A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_a= lpha1 through 2.7.4 allows remote authenticated peers to potentially cause =
a denial of service or leak memory via crafted packets during TLS session p= romotion or expiry 2026-07-30 not yet calculated CVE-2026-12996 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-12996 ] OpenVPN--OpenVPN An incomplete g= uard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows re= mote authenticated peers to trigger a use-after-free during TLS session pro= motion, potentially leading to a denial of service or memory leakage 2026-0= 7-30 not yet calculated CVE-2026-13117 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-13117 ] OpenVPN--OpenVPN The Windows interactive service in Ope= nVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent D=
NS state pollution or a service crash via a crafted search domain during th=
e disconnection process 2026-07-30 not yet calculated CVE-2026-13379 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-13379 ] Outstatic CMS--Outstatic CM=
S Outstatic CMS <=3D 2.1.9 contains a hardcoded JWT signing secret. When th=
e OST_TOKEN_SECRET environment variable is not set, the application falls b= ack to the default value which is publicly visible in the source code repos= itory. An unauthenticated remote attacker can exploit this by forging JWT s= ession tokens with arbitrary user data and full administrative permissions.=
2026-07-30 not yet calculated CVE-2026-52539 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-52539 ] Paid Membership Subscriptions--Paid Membership Sub= scriptions The Paid Membership Subscriptions WordPress plugin before 3.0.7 = does not perform capability or nonce checks on one of its payment-related A= JAX actions, allowing any authenticated user with Subscriber-level access a=
nd above to disclose the payment details of any member by enumerating the p= ayment identifier. 2026-07-31 not yet calculated CVE-2026-14847 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-14847 ] Paid Membership Subscriptions--P= aid Membership Subscriptions The Paid Membership Subscriptions WordPress pl= ugin before 3.0.7 does not protect the member and payment export files it w= rites to a predictable location in the uploads directory, allowing unauthen= ticated users to download the exported member and payment data (including P= II) while an export artifact is present. 2026-07-31 not yet calculated CVE-= 2026-14849 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14849 ] Participan=
ts Database--Participants Database The Participants Database WordPress plug=
in before 2.7.8.4 does not properly sanitize and escape a user-supplied par= ameter before using it in a SQL query, allowing unauthenticated attackers t=
o perform SQL injection attacks. 2026-08-01 not yet calculated CVE-2026-135=
96 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13596 ] PayU CommercePro P= lugin--PayU CommercePro Plugin The PayU CommercePro Plugin WordPress plugin=
through 3.8.9 does not verify the payment-gateway signature before applyin=
g order modifications, allowing unauthenticated attackers to tamper with th=
e totals, shipping and metadata of arbitrary WooCommerce orders. 2026-07-29=
not yet calculated CVE-2026-13692 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-13692 ] phoca.cz--Phoca Commander extension for Joomla Joomla Extensi=
on - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 =
- Improper validation of user inputs lead to a reflective XSS vulnerability=
. 2026-07-27 not yet calculated CVE-2026-65764 [ https://www.cve.org/CVERec= ord?id=3DCVE-2026-65764 ] phoca.cz--Phoca Commander extension for Joomla Jo= omla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander=
1.0.0-6.1.1 - Improper limitation of paths for save and download actions l= ead to path traversal vulnerabilities. 2026-07-27 not yet calculated CVE-20= 26-65765 [ https://www.cve.org/CVERecord?id=3DCVE-2026-65765 ] PhotoSwipe--= PhotoSwipe The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title a= ttribute of author-supplied link markup as a lightbox caption that is writt=
en into the page DOM without escaping. Because the title attribute survives=
the post-content sanitization applied to users who lack the unfiltered_htm=
l capability, an authenticated user with Author-level access can store a Ja= vaScript payload that executes in the browser of any visitor, including an = administrator, who clicks the link. 2026-07-29 not yet calculated CVE-2026-= 13605 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13605 ] PHP Group--PHP = Improper escaping of backslashes in attacker-provided parameters would allo=
w for trivial SQL injection in PHP versions=C2=A0from 8.2.* before 8.2.33, = from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8= .5.9. 2026-07-30 not yet calculated CVE-2026-17543 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-17543 ] PHP Group--PHP Attacker-provided inputs to bc= comp() could lead to an out-of-bounds write with stack and heap corruption =
in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9. 2026-= 07-30 not yet calculated CVE-2026-17544 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-17544 ] PHP Group--PHP Circular symbolic links in phar archives=
could lead to unbounded recursion, exhausting the C stack and crashing the=
PHP process,=C2=A0in PHP versions=C2=A0from 8.2.* before 8.2.33, from 8.3.=
* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9. 202= 6-07-30 not yet calculated CVE-2026-7260 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-7260 ] PHP Jabbers--Appointment Scheduler An authenticated SQL = injection vulnerability has been identified in multiple PHP Jabbers scripts=
. Improper neutralization of input provided by an authenticated user into p= arameters responsible for sorting functions allows an attacker to perform S=
QL Injection attacks. This issue was fixed in the versions specified in the=
affected products list. 2026-07-31 not yet calculated CVE-2025-67650 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2025-67650 ] PHP Jabbers--Appointment S= cheduler A Cross-Site Request Forgery (CSRF) vulnerability has been identif= ied in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate=
SameSite attributes allows an attacker to send unauthorized requests in th=
e context of an authenticated user, leading to unauthorized administrative = actions, such as creating new admin accounts. This issue was fixed in the v= ersions specified in the affected products list. 2026-07-31 not yet calcula= ted CVE-2025-67651 [ https://www.cve.org/CVERecord?id=3DCVE-2025-67651 ] PH=
P Jabbers--Car Rental Script A SQL injection vulnerability has been identif= ied in PHP Jabbers -=C2=A0Car Rental Script . Improper neutralization of in= put provided by user into parameters responsible for sorting functions allo=
ws an unauthenticated attacker to perform SQL Injection attacks. This issue=
was fixed in version 4.1. 2026-07-31 not yet calculated CVE-2025-67649 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2025-67649 ] PHP Jabbers--PHP Poll Sc= ript A SQL injection vulnerability has been identified in the PHP Jabbers -=
PHP Poll Script. Improper neutralization of input provided by user to=C2= =A0pjAdminPolls.controller.php endpoint allows an authenticated attacker to=
perform SQL Injection attacks. This issue was fixed in version 4.1. 2026-0= 7-31 not yet calculated CVE-2026-46593 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-46593 ] PHP Jabbers--PHP Poll Script A reflected cross-site scr= ipting (XSS) vulnerability has been identified in the PHP Jabbers - PHP Pol=
l Script. A malicious attacker can craft a specially crafted URL that, when=
opened, results in arbitrary JavaScript execution in the victim's browser.=
This issue was fixed in version 4.1. 2026-07-31 not yet calculated CVE-202= 6-46594 [ https://www.cve.org/CVERecord?id=3DCVE-2026-46594 ] Pivotick--Piv= otick Pivotick contains a cross-site scripting vulnerability in the inspect=
and edit node modals. Node labels and descriptions originating from graph = data were interpolated directly into HTML used to construct the modal heade= rs. An attacker able to supply or modify graph data could insert a maliciou=
s HTML or JavaScript payload into a node's label or description. The payloa=
d would be parsed and executed in the application's origin when a user open=
ed the affected node's inspect or edit modal. Successful exploitation could=
allow the attacker to access information available to the victim, modify a= pplication data, or perform actions using the victim's active session. The = vulnerability has been addressed by creating the modal elements without emb= edding graph data in HTML and assigning node labels and descriptions throug=
h textContent. 2026-07-28 not yet calculated CVE-2026-66919 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-66919 ] Pivotick--Pivotick Pivotick contains=
an uncontrolled-recursion vulnerability when processing caller-supplied gr= aph and node data. The affected graph algorithms recursively traversed grap=
h edges, while the JSON viewer recursively processed each level of a node's=
data structure. A specially crafted graph containing an excessively long p= ath, deeply nested properties, or circular object references could therefor=
e exhaust the JavaScript call stack when Pivotick calculates a layout or di= splays a node in the inspection modal. Successful exploitation may cause an=
uncaught exception, freeze the affected page, or crash the browser tab, re= sulting in a client-side denial of service. No confidentiality or integrity=
impact has been identified. The patch replaces the recursive graph travers= als with iterative stack-based implementations and limits the reachability = calculation to 1,000,000 edge traversals. It also limits JSON rendering to =
64 levels and detects circular references before descending further into an=
object. 2026-07-28 not yet calculated CVE-2026-66920 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-66920 ] pivotick--pivotick Pivotick contains a cro= ss-site scripting vulnerability in the sidebar property-list component. Val= ues associated with link-like properties, such as url, uri, href, link, web= site, or homepage, were rendered as hyperlinks without validating their URL=
scheme. An attacker able to supply or influence node or edge property data=
could provide a malicious value using the javascript: scheme, including va= riants obfuscated with whitespace or control characters. If a user clicked = the generated property link, attacker-controlled JavaScript could execute i=
n the context of the Pivotick application. Successful exploitation could al= low the attacker to access information available to the victim's browser se= ssion or perform actions with the victim's privileges. The vulnerability wa=
s addressed by normalizing property values and preventing URLs with non-all= owlisted schemes from being rendered as clickable links. 2026-07-27 not yet=
calculated CVE-2026-66825 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66= 825 ] pivotick--pivotick Pivotick fails to sanitize attacker-controlled SVG=
markup supplied through the per-node style.svgIcon property before inserti=
ng it into the document. When rendering a graph node, the vulnerable code a= ssigns the SVG icon markup directly to the innerHTML property of a live SVG=
element. An attacker able to influence graph data can provide crafted mark=
up containing executable event handlers, such as an <image> element with an=
onerror attribute. When a victim loads or renders the malicious graph, the=
payload may execute arbitrary JavaScript in the security context of the ap= plication embedding Pivotick. Successful exploitation could allow the attac= ker to access application data available to the victim, modify displayed co= ntent, or perform actions using the victim's authenticated session. Exploit= ation requires an application using Pivotick to render graph data that is c= ontrolled or modified by an attacker. 2026-07-28 not yet calculated CVE-202= 6-66918 [ https://www.cve.org/CVERecord?id=3DCVE-2026-66918 ] pivotick--piv= otick Pivotick's Markdown node-reference renderer failed to HTML-escape the=
attacker-controlled nodeName value before interpolating it into both the d= ata-node-name attribute and the body of a generated <span> element. Because=
the node-reference tokenizer rejected only square brackets, a crafted node=
name could still contain quotation marks, angle brackets, or other HTML me= tacharacters. An attacker could therefore terminate the quoted attribute or=
inject additional HTML elements and event-handler attributes. When malicio=
us node-reference content is rendered by a consumer that does not apply DOM= Purify or equivalent sanitization, arbitrary JavaScript may execute in the = victim's browser in the security context of the application. Successful exp= loitation requires a victim to open or render a crafted graph or note and c= ould allow the attacker to access same-origin information, modify displayed=
content, or perform actions using the victim's session. The patch resolves=
the issue by applying context-appropriate HTML escaping to node names befo=
re inserting them into either HTML text or quoted attribute values. The sha= red escaping function now encodes ampersands, angle brackets, and both type=
s of quotation marks. 2026-07-28 not yet calculated CVE-2026-66921 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-66921 ] pivotick--pivotick Pivotick u= sed plain JavaScript objects as lookup tables indexed by caller-controlled = graph node identifiers in its tree-layout and cycle-detection components. N= ode identifiers matching properties inherited from Object.prototype, such a=
s constructor, toString, or __proto__, were not handled as ordinary identif= iers. These values could be interpreted as existing inherited properties, r= esolve to values of an unexpected type, or-in the case of __proto__ assignm= ents-modify the prototype of an internal lookup object. An attacker who can=
supply graph data containing crafted node identifiers could consequently c= ause nodes or edges to be silently omitted, produce incorrect hierarchy lev= els, bypass or corrupt cycle-detection results, or trigger an exception tha=
t interrupts graph processing and rendering. This affects the integrity of = graph visualisations and analytics and may cause a client-side denial-of-se= rvice condition. The affected code also failed to safely handle edges whose=
source node was absent from the supplied node set. Furthermore, calculatin=
g the maximum tree depth by spreading all level values into Math.max() coul=
d exceed the JavaScript function-argument limit when processing a sufficien= tly large graph, resulting in an exception and denial of service. The patch=
replaces identifier-keyed plain objects with Map instances, ignores invali=
d edges during tree construction, and calculates the maximum depth iterativ= ely. 2026-07-28 not yet calculated CVE-2026-66922 [ https://www.cve.org/CVE= Record?id=3DCVE-2026-66922 ] pivotick--pivotick Pivotick did not validate t=
he URL scheme of node imagePath values derived from graph data before assig= ning them to SVG image resources. An attacker able to supply crafted graph = data could set an image path to a malicious URI. When a victim rendered the=
affected graph, the browser could resolve the attacker-controlled URI and = initiate an unintended request or invoke scheme-specific handling in the vi= ctim's context. Depending on the URI, browser behaviour, and installed prot= ocol handlers, exploitation could disclose limited client or network metada= ta, facilitate rendering-based tracking, or attempt to access local or inte= rnal resources. Exploitation requires a victim to load or render graph data=
containing the malicious imagePath. The patch normalizes ASCII whitespace = and control characters in URI schemes and restricts image paths to relative=
URLs or the http, https, data, and blob schemes. 2026-07-28 not yet calcul= ated CVE-2026-67173 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67173 ] p= ivotick--pivotick Pivotick contains a DOM-based cross-site scripting vulner= ability in its generic UI element resolution and icon-rendering utilities. = The tryResolveHTMLElement function treated any resolved string as HTML mark=
up by assigning it to a <template> element through innerHTML. Strings deriv=
ed from untrusted graph properties or custom rendering callbacks could ther= efore introduce arbitrary HTML or SVG elements into the live document. The = vulnerable function was used by multiple UI components, including headers, = property panels, extra panels, and tooltips. Additionally, createIcon inser= ted caller-supplied svgIcon markup into a template without sanitization. An=
application integrating Pivotick and deriving icon markup from untrusted d= ata could therefore expose a second script-execution path. An unauthenticat=
ed attacker able to provide a crafted graph, property value, rendering resu= lt, or SVG icon could execute JavaScript in another user's browser when the=
affected content is displayed or interacted with. Successful exploitation = could allow the attacker to access information available to the victim, man= ipulate graph data or application state, and perform actions with the victi= m's privileges. The patch changes string rendering to use textContent, requ= iring callers to explicitly return an Element when HTML rendering is intend= ed. It also sanitizes SVG icon markup before inserting it into the DOM. 202= 6-07-28 not yet calculated CVE-2026-67174 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-67174 ] Pixel Tag Manager for WooCommerce--Pixel Tag Manager f=
or WooCommerce The Pixel Tag Manager for WooCommerce WordPress plugin befor=
e 2.2.1 does not perform an authorization check on one of its AJAX actions,=
allowing unauthenticated users to submit forged e-commerce conversion even=
ts to the site's configured server-side advertising conversion APIs using t=
he site's stored credentials. 2026-08-01 not yet calculated CVE-2026-14315 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-14315 ] Pixelavo--Pixelavo Th=
e Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX = action, gated only by a nonce that it emits publicly on every front-end pag=
e, that forwards client-supplied event data to the configured Facebook Conv= ersions API using the administrator's stored access token. This allows an u= nauthenticated visitor to inject arbitrary conversion events into the admin= istrator's Facebook ads account and exhaust the configured API quota. 2026-= 08-01 not yet calculated CVE-2026-13604 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-13604 ] Podlove Podcast Publisher--Podlove Podcast Publisher Th=
e Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform = nonce validation on some of its administrative create and delete actions, a= llowing attackers to create rogue records or delete legitimate ones via a f= orged request (CSRF) when a logged-in administrator is tricked into visitin=
g a crafted page. 2026-08-01 not yet calculated CVE-2026-13729 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-13729 ] Points and Rewards for WooCommerc= e--Points and Rewards for WooCommerce The Points and Rewards for WooCommerc=
e WordPress plugin before 2.10.1 does not have authorisation checks in plac=
e on a wallet and points update action that is available to unauthenticated=
users, and does not verify that the requester owns the account being chang= ed, allowing unauthenticated attackers to arbitrarily modify or corrupt (in= cluding driving it negative) the stored wallet balance and loyalty points o=
f any user. Modifying the wallet balance additionally requires the companio=
n Wallet System for WooCommerce Points and Rewards for WooCommerce WordPres=
s plugin before 2.10.1 to be active. 2026-07-30 not yet calculated CVE-2026= -11782 [ https://www.cve.org/CVERecord?id=3DCVE-2026-11782 ] POUCO Import U= sers--POUCO Import Users The POUCO Import Users WordPress plugin through 1.= 0.0 does not perform any capability or nonce checks on AJAX actions availab=
le to unauthenticated users that create and update WordPress accounts, and =
it trusts an attacker-supplied role value, allowing unauthenticated attacke=
rs to create a new administrator account and take over the site. 2026-08-02=
not yet calculated CVE-2026-16256 [ https://www.cve.org/CVERecord?id=3DCVE= -2026-16256 ] PrestaShop--PrestaShop PrestaShop module, totadministrativema= ndate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF). The paymen=
t validation controller has no CSRF token. An attacker can confirm an order=
in an awaiting status by hijacking a link. 2026-07-31 not yet calculated C= VE-2026-50986 [ https://www.cve.org/CVERecord?id=3DCVE-2026-50986 ] pretix = GmbH--pretix The "quick setup" view presented to users after they first cre= ate an event allows to set up the most critical parts of an event in just a=
few clicks. This view did not properly check that the user has permission =
to change configuration for the given event. An attacker could use a well-t= imed request to create products, quotas, set bank transfer configuration, o=
r connect a stripe account to an event they do not have access to. 2026-07-=
28 not yet calculated CVE-2026-18028 [ https://www.cve.org/CVERecord?id=3DC= VE-2026-18028 ] pretix GmbH--pretix-girosolution Our payment integration wi=
th GiroCheckout did not properly validate payment status responses. An atta= cker could use a successful payment status response from one payment and su= pply it to the system for a different payment, gaining access to multiple v= alid tickets with only one payment. 2026-07-28 not yet calculated CVE-2026-= 18029 [ https://www.cve.org/CVERecord?id=3DCVE-2026-18029 ] Printcart Web t=
o Print Product Designer for WooCommerce--Printcart Web to Print Product De= signer for WooCommerce The Printcart Web to Print Product Designer for WooC= ommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL=
before fetching it server-side and does not enforce a valid authorization = check, allowing unauthenticated attackers to read arbitrary local files (in= cluding configuration files containing database credentials and secret keys=
) and to make server-side requests to internal resources. 2026-07-27 not ye=
t calculated CVE-2025-15662 [ https://www.cve.org/CVERecord?id=3DCVE-2025-1= 5662 ] ProfileGrid--ProfileGrid The ProfileGrid WordPress plugin before 5.9= .9.8 does not restrict which group an anonymous visitor may register into t= hrough its front-end registration, allowing unauthenticated users to regist=
er directly into a privileged group and be granted that group's configured = role, up to Administrator when such a group exists, leading to privilege es= calation. 2026-07-30 not yet calculated CVE-2026-12687 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-12687 ] ProfileGrid--ProfileGrid The ProfileGrid = WordPress plugin before 5.9.9.8 does not verify that a notification belongs=
to the requesting user before deleting it, allowing any authenticated user=
such as a Subscriber to delete other users' notifications by enumerating n= otification identifiers. 2026-08-02 not yet calculated CVE-2026-16291 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-16291 ] Python Packaging Authority= --pip pip would incorrectly handle doubly-encoded package URLs from indexes=
allowing for files to be installed to arbitrary locations on disk even whe=
n installing wheels. This vulnerability requires downloading or installing =
a package from a malicious package index to succeed, malicious packages alo=
ne are not able to exploit this vulnerability. Note that this vulnerability=
only materially impacts users running `pip download` with the `--only-bina= ry` option as installing source distributions from an untrusted index is al= ready an unsafe operation that executes code during install time. 2026-07-2=
9 not yet calculated CVE-2026-13346 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-13346 ] Python Software Foundation--CPython `Element.findall()` and = fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when u= sing XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML d= ocuments with many same-tag siblings. `Element.find()` is only affected whe=
n the first match is near the end=C2=A0 of the sibling list, such as with `= [last()]` or `[last()-N]`;=C2=A0 `.//item[1]` short-circuits after the firs=
t match. 2026-07-28 not yet calculated CVE-2026-6879 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-6879 ] Quest--KACE Systems Deployment Appliance An = issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.= 273. If a customer restricts access to the web console by IP address or sub= nets, the API endpoints are not restricted. If credentials/API keys are kno=
wn to an attacker, the appliance can still be accessed via the API, leading=
to a potential compromise of the entire environment that is configured for=
KACE. 2026-07-27 not yet calculated CVE-2021-32084 [ https://www.cve.org/C= VERecord?id=3DCVE-2021-32084 ] Quest--KACE Systems Deployment Appliance An = issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.= 273. It installs with default user credentials. The report and R1 MySQL acc= ounts have a password of box747, which is publicly known and documented. Th=
is allows remote attackers to trivially gain privileged access to the MySQL=
databases. Sensitive information is stored in the database, such as privil= eged credentials for other systems. 2026-07-27 not yet calculated CVE-2021-= 32085 [ https://www.cve.org/CVERecord?id=3DCVE-2021-32085 ] Quest--KACE Sys= tems Deployment Appliance An issue was discovered in Quest KACE Systems Dep= loyment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption = key to encrypt secrets in the MySQL databases. (This key is not unique for = each installation.) An attacker that gains access to the MySQL server or a = backup files can decrypt the secrets. Often, the decrypted secrets can be u= sed to escalate privileges within KACE, or gain privileged access to unrela= ted systems or services. 2026-07-27 not yet calculated CVE-2021-32086 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2021-32086 ] Quest--KACE Systems Deploy= ment Appliance An issue was discovered in Quest KACE Systems Deployment App= liance (SMA) 11.0.273. It installs with default user credentials. The kbftp=
account has a password of getbxf, which is publicly known and documented. = This allows remote attackers to trivially gain privileged access to the FTP=
service interface, which contains MySQL backups. Sensitive information is = stored in the database, such as privileged credentials for other systems. 2= 026-07-27 not yet calculated CVE-2021-32087 [ https://www.cve.org/CVERecord= ?id=3DCVE-2021-32087 ] Quest--KACE Systems Deployment Appliance An issue wa=
s discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Cer= tain API endpoints contain a rate-limiting feature to minimize a brute-forc=
e attack. This protection can be bypassed by removing the kboxid cookie. 20= 26-07-27 not yet calculated CVE-2021-32088 [ https://www.cve.org/CVERecord?= id=3DCVE-2021-32088 ] Quiz and Survey Master (QSM)--Quiz and Survey Master = (QSM) The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does = not implement rate limiting or standard failed-login auditing on its front-= end credential-check functionality and returns distinct responses for valid=
and invalid accounts, allowing unauthenticated attackers to enumerate vali=
d usernames and to brute-force passwords while bypassing brute-force protec= tion Quiz and Survey Master (QSM) WordPress plugin before 11.1.3. 2026-07-2=
7 not yet calculated CVE-2026-14820 [ https://www.cve.org/CVERecord?id=3DCV= E-2026-14820 ] Quiz and Survey Master (QSM)--Quiz and Survey Master (QSM) T=
he Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not per= form a capability check before deleting output templates, allowing users wi=
th contributor-level access and above to delete arbitrary templates. 2026-0= 7-28 not yet calculated CVE-2026-14821 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-14821 ] rails--rails Action Pack is a framework for handling an=
d responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1= .3.1, Active Storage does not disable libvips operations marked unsafe for = untrusted content, allowing a crafted upload to invoke such an operation. C= onsuming applications are affected when configured to use libvips and accep=
t image uploads from untrusted users. An unauthenticated attacker may explo=
it this behavior to read arbitrary files accessible to the Rails process, i= ncluding environment variables and application secrets. Exposure of credent= ials such as secret_key_base or external-service tokens may enable remote c= ode execution or lateral movement. This issue has been fixed in versions 7.= 2.3.2, 8.0.5.1 and 8.1.3.1. 2026-07-30 not yet calculated CVE-2026-66066 [ = https://www.cve.org/CVERecord?id=3DCVE-2026-66066 ] Realtyna Organic IDX pl= ugin + WPL Real Estate--Realtyna Organic IDX plugin + WPL Real Estate The R= ealtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 = does not validate the type of uploaded files, and its file upload functiona= lity is gated only by an API that is enabled by default and authenticated w= ith hardcoded credentials shipped identically across all installations. Thi=
s makes it possible for unauthenticated attackers to upload arbitrary PHP f= iles and achieve remote code execution. 2026-07-27 not yet calculated CVE-2= 026-13714 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13714 ] Registratio= nMagic--RegistrationMagic The RegistrationMagic WordPress plugin before 6.0= .9.4 does not properly validate that a one-time password presented in a coo= kie belongs to the identity being requested before returning front-end form=
submissions, allowing unauthenticated attackers to read other users' form = submission data, including personal information. 2026-07-30 not yet calcula= ted CVE-2026-15255 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15255 ] Re= gistrationMagic--RegistrationMagic The RegistrationMagic WordPress plugin b= efore 6.0.9.4 does not perform authorization, ownership or nonce checks on =
a front-end submission-editing action, allowing unauthenticated attackers t=
o overwrite other users' form submissions and the profile fields of the ass= ociated non-administrator WordPress accounts. 2026-07-30 not yet calculated=
CVE-2026-15257 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15257 ] remix= -run--react-router React Router is a router for React. Versions 6.0.0 throu=
gh 7.17.0 are vulnerable to Open Redirtect through use of backslashes in <L=

and useNavigate. This issue is a follow up to CVE-2025-68470 and has b=

een fixed in version 7.18.0. 2026-07-27 not yet calculated CVE-2026-53669 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-53669 ] remix-run--react-route=
r React Router is a router for React. In versions 7.0.0 through 7.17.0, the=
manifest endpoint could be accessed via unauthenticated targeted requests = that would put heavy load on the server and slow down response times. This = issue is a follow up to CVE-2026-42342, and does not does not impact React = Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (= createBrowserRouter/<RouterProvider>). This issue has been fixed in version=
7.18.0. 2026-07-27 not yet calculated CVE-2026-55685 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-55685 ] Remote API--Remote API The Remote API Word= Press plugin through 0.2 does not authenticate a request before deserializi=
ng user-supplied input, allowing unauthenticated attackers to inject arbitr= ary PHP objects, which can lead to remote code execution when a suitable ga= dget chain is present through another installed Remote API WordPress plugin=
through 0.2. 2026-07-30 not yet calculated CVE-2026-14602 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-14602 ] RFC--Hiawatha v.12.1 An issue in Hugo=
Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arb= itrary code via a crafted request 2026-07-31 not yet calculated CVE-2026-51= 785 [ https://www.cve.org/CVERecord?id=3DCVE-2026-51785 ] Rocket.Chat--Rock= et.Chat Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, = 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not=
bind the validated signature to samlp:Response / saml:Assertion. An attack=
er could submit a wrapped document carrying forged identity attributes alon= gside any valid signature made by the trusted IdP certificate, and log in a=
s an arbitrary user. 2026-07-30 not yet calculated CVE-2026-58066 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-58066 ] rolandd.com--RO CSVI extension=
for Joomla Joomla Extension - rolandd.com - Unauthenticated directory crea= tion RO CSVI < 9.11.0 2026-07-29 not yet calculated CVE-2026-65943 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-65943 ] rolandd.com--RO CSVI extensio=
n for Joomla Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint=
handlers RO CSVI < 9.11.0 2026-07-29 not yet calculated CVE-2026-65944 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-65944 ] rolandd.com--RO CSVI ext= ension for Joomla Joomla Extension - rolandd.com - XSS vectors in AJAX endp= oint handlers RO CSVI < 9.11.0 2026-07-29 not yet calculated CVE-2026-65946=
[ https://www.cve.org/CVERecord?id=3DCVE-2026-65946 ] Roskus--Prospero Flo=
w CRM Cross-site Scripting in the lead index view in Roskus Prospero Flow C=
RM before 5.3.7 allows authenticated users holding the create or update lea=
d permission to execute arbitrary JavaScript in the application origin via = HTML markup stored in the lead name field, which the view renders through B= lade's unescaped output directive and inside a JavaScript string literal in=
an onclick attribute. 2026-07-31 not yet calculated CVE-2026-59232 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-59232 ] Roskus--Prospero Flow CRM St= ored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero F= low CRM before 5.4.4 allows a remote, authenticated low-privileged user to = execute arbitrary JavaScript in another user's browser, including administr= ators, leading to session compromise and account takeover, via a payload st= ored in an email body that is persisted without sanitization and rendered u= nescaped with {!! $email->body !!} when the recipient opens the message. 20= 26-07-27 not yet calculated CVE-2026-59239 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-59239 ] Roskus--Prospero Flow CRM The vulnerability involves =
an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationContro= ller::delete()` method at endpoint `GET /notification/delete/{id}`. The fla=
w allows any authenticated user, regardless of company or permissions, to d= elete notifications belonging to any other user in the system. The controll=
er retrieves the target record with `Notification::findOrFail($id)` and del= etes it without validating `user_id` or `company_id` ownership, unlike the = sibling `SetNotificationReadAjaxController`, which correctly scopes lookups=
by `Auth::id()`. Because notification identifiers are sequential, an attac= ker can iterate over IDs to systematically delete notifications belonging t=
o any user, denying them visibility of ticket alerts, task assignments, and=
other system events. 2026-07-27 not yet calculated CVE-2026-59240 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-59240 ] RRWO--Data::Entropy Data::Ent= ropy versions before 0.010 for Perl read remote entropy sources over plain = HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource:= :RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::E= ntropy::RawSource::RandomOrg integrity check trivially matches any non-empt=
y byte string. Any on-path attacker, such as open WiFi, a compromised ISP, = captive portal, or a hostile egress proxy substitutes the response and ther= eby chooses the bytes returned by rand_bits and rand_int for every applicat= ion that selected one of these sources via with_entropy_source. The _checkb=
uf method response is equally attacker-controlled, so the retry/sleep behav= iour is steerable too. 2026-08-01 not yet calculated CVE-2026-18536 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-18536 ] RRWO--Plack::App::Prerender = Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitr= ary host via unvalidated REQUEST_URI concatenation in call. When the rewrit=
e base is a plain string, the REQUEST_URI is appended to it, with no check = that the path starts with a forward slash ('/'). When the rewrite base does=
not contain a path (which is the standard given in the SYNOPSIS), an attac= ker can create a request that changes the hostname. A request target starti=
ng with an at-sign ('@') changes the base to a RFC 3986 userinfo component.=
For example, a rewrite base of "https://example.com" with the submitted re= quest "GET @192.168.1.2/" will send a request to "https://example.com@192.1= 68.1.2/", with the rendered content returned to the attacker. This allows a=
n attacker to access internal or restricted hosts that only the webserver h=
as access to. 2026-07-27 not yet calculated CVE-2026-17552 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-17552 ] RT Mega Menu--RT Mega Menu The RT Meg=
a Menu WordPress plugin before 1.5.2 does not perform a capability check on=
the AJAX action that saves mega-menu configuration and per-menu-item setti= ngs; its only gate is a nonce that any logged-in user can read from a stand= ard admin page. A subscriber-level user can therefore enable the mega menu =
on a site menu and store a menu-item style value that is rendered, without = output escaping, into a style attribute on the public navigation. By breaki=
ng out of that attribute the user persists a JavaScript event handler that = executes for every visitor who hovers the navigation, including administrat= ors, leading to session/site takeover. 2026-08-02 not yet calculated CVE-20= 26-15385 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15385 ] Samsung Mobi= le--Samsung Mobile Devices Out-of-bounds write in ImsService prior to SMR J= ul-2026 Release 1 allows remote attackers to potentially execute arbitrary = code. 2026-07-28 not yet calculated CVE-2026-21047 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-21047 ] SBECK--Date::Manip Date::Manip versions throu=
gh 6.99 for Perl return corrupted dates via non-ASCII decimal digits that p= ass the numeric range tests in check. The parse regexes capture year, month=
and day with the `\d` shorthand, which on a character string matches the w= hole Unicode decimal digit property `\p{Nd}` and not just `[0-9]`. Date::Ma= nip::Base::check then validates the captured fields with numeric comparison=
s alone (`$y<1 || $y>9999`, `$m<1 || $m>12`, `$d<1 || $d>$days`), and _pars= e_check stores the numified fields (`$y+0`). Perl truncates a string at the=
first character that is not an ASCII digit, so a field whose leading chara= cters are ASCII digits numifies to an in-range prefix and satisfies every t= est: a year field of three ASCII digits followed by U+0664 ARABIC-INDIC DIG=
IT FOUR numifies to 202, giving the year 0202, and one non-ASCII digit in t=
he month or day field shifts those fields the same way. The hour, minute an=
d second fields match explicit ASCII character classes (`0?[0-9]`, `[0-5][0= -9]`) and do not shift, though a non-ASCII digit in a fractional hour or mi= nute field truncates the fraction. Any caller that passes an untrusted char= acter string to ParseDate() or Date::Manip::Date->parse() can get back a da=
te that differs from the string it parsed, with no parse error. Where the p= arsed date gates logic such as an expiry check or a retention window, the s= hift goes unnoticed. 2026-07-30 not yet calculated CVE-2026-60074 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-60074 ] SBECK--Date::Manip Date::Manip=
versions through 6.99 for Perl allow CPU exhaustion via quadratic backtrac= king in the unanchored time substitution in _parse_time. _parse_time remove=
s a time from anywhere in the string with the unanchored substitution `s/$t= imerx/ /`, where $timerx is an auto-generated alternation of time patterns = reached through a leading `(?:$atrx|^|\s+)`. The engine therefore retries t=
he match at every position of an interior whitespace run: at each start pos= ition the leading `\s+` consumes the rest of the run greedily, the time alt= ernation fails because the run holds no digits, and the engine backtracks a=
space at a time across the run before advancing the start position, which =
is quadratic in the length of the run. No time need be present in the strin=
g for this to happen, only a long run of whitespace, and the parse time ris=
es about fourfold for each doubling of the run: a few kilobytes of whitespa=
ce costs seconds of CPU per parse and tens of kilobytes costs minutes. Any = caller that passes an untrusted string of unbounded length to ParseDate(), = Date::Manip::Date->parse() or ->parse_time() can be made to spend unbounded=
CPU in a single parse, a denial of service. 2026-07-30 not yet calculated = CVE-2026-60075 [ https://www.cve.org/CVERecord?id=3DCVE-2026-60075 ] Schnei= der Electric--EcoStruxure Cybersecurity Admin Expert CWE-522 Insufficiently=
Protected Credentials vulnerability exists that could cause authentication=
bypass and unauthorized credential modification, potentially leading to co= mpromise of managed devices, when a local privileged attacker leverages wea= knesses in the handling and protection of stored credentials within the app= lication. 2026-07-29 not yet calculated CVE-2026-14354 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-14354 ] Schneider Electric--IGSS Definition (Def.= exe) CWE-787 Out-of-bounds write vulnerability exists that could cause loss=
of data or potentially risk arbitrary code execution when a malicious CGF = file is imported to IGSS Definition. 2026-07-29 not yet calculated CVE-2026= -12927 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12927 ] Schneider Elec= tric--SCADAPack 47x CWE-754: Improper Check for Unusual or Exceptional Cond= itions vulnerability that could cause arbitrary code execution, denial of s= ervice and loss of confidentiality & integrity when communicating over the = Modbus TCP protocol. 2026-07-29 not yet calculated CVE-2026-0667 [ https://= www.cve.org/CVERecord?id=3DCVE-2026-0667 ] Search Atlas SEO--Search Atlas S=
EO The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a c= apability or nonce check in one of its AJAX handlers, allowing any authenti= cated user such as a Subscriber to invoke the site's Google Indexing API in= tegration, submitting or removing the site's URLs from Google's index and c= onsuming its indexing quota. 2026-07-30 not yet calculated CVE-2026-15252 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-15252 ] SGLang--SGLang SGLang = contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypa=
ss of SafeUnpickler's incomplete denylist, allowing arbitrary command execu= tion through crafted base64-encoded pickle payloads. 2026-07-30 not yet cal= culated CVE-2026-15969 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15969 =
] SGLang--SGLang SGLang contains an RCE vulnerability when the optional dum= per subsystem is enabled, allowing for a sandbox escape when DUMPER_SERVER_= PORT is set, enabling code execution on inference requests. 2026-07-30 not = yet calculated CVE-2026-15971 [ https://www.cve.org/CVERecord?id=3DCVE-2026= -15971 ] SGLang--SGLang SGLang contains an SSRF and local file read in the = multimodal generation endpoint /v1/chat/completions due to unsanitized imag= e_url, allowing access to internal metadata, secrets, and services. 2026-07= -30 not yet calculated CVE-2026-15974 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-15974 ] SGLang--SGLang SGLang contains a RCE vulnerability when at= tempting to load model weights from a HuggingFace repository, specifically = within the /update_weights_from_disk, where torch.load(..., weights_only=3D= False) fallback enables pickle deserialization of .bin files. 2026-07-30 no=
t yet calculated CVE-2026-15976 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-15976 ] SGLang--SGLang SGLang contains a credential leakage vulnerabilit=
y in the /server_info endpoint, which will return API keys and SSL keyfile = information when only the --admin-api-key is configured. 2026-07-30 not yet=
calculated CVE-2026-15977 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15= 977 ] SGLang--SGLang SGLang contains a model weight exfiltration vulnerabil= ity when no API keys are configured, as SGLang will expose two endpoints th=
at allow a remote attacker to trigger distributed weight broadcasting using=
NCCL and then triggering data transfer, attackers can exfiltrate all model=
weights. 2026-07-30 not yet calculated CVE-2026-15978 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-15978 ] ShinyStat Analytics--ShinyStat Analytics = The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any=
authorization check on one of its REST API endpoints, allowing unauthentic= ated users to retrieve information about non-published (e.g. draft, pending=
or private) WooCommerce products. 2026-07-29 not yet calculated CVE-2026-1= 1351 [ https://www.cve.org/CVERecord?id=3DCVE-2026-11351 ] ShopMonitor.io--= ShopMonitor.io The ShopMonitor.io WordPress plugin before 1.2.0 does not pr= operly restrict its email-rerouting test mode, gating it behind a trusted-s= ource check that is satisfiable with client-supplied request headers, allow= ing unauthenticated attackers to redirect outgoing emails, including the Wo= rdPress administrator password-reset email, to an address they control and = take over the administrator account. 2026-07-31 not yet calculated CVE-2026= -14919 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14919 ] Simple Restric= t--Simple Restrict The Simple Restrict WordPress plugin before 1.2.9 does n=
ot enforce its content-restriction permission check on the REST API the way=
it does on the front end, relying there on a generic capability check inst= ead of the Simple Restrict WordPress plugin before 1.2.9's own permission s= ystem, allowing users with contributor-level access or above to read the co= ntent of restricted posts and pages they were never granted access to. 2026= -08-02 not yet calculated CVE-2026-15939 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-15939 ] Simply Schedule Appointments--Simply Schedule Appointme= nts Simply Schedule Appointments is vulnerable to unauthenticated Stored Cr= oss-Site Scripting in all versions up to and including 1.6.12.2. The root c= ause is a sanitization-ordering defect: the rendered notification content i=
s decoded back into live HTML after it has already passed through the Simpl=
y Schedule Appointments WordPress plugin before 1.6.12.4's wp_kses_post() f= ilter, so a double-encoded payload survives intake and is reintroduced as a=
n executable element at render time. 2026-07-27 not yet calculated CVE-2026= -13400 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13400 ] Simply Schedul=
e Appointments--Simply Schedule Appointments The Simply Schedule Appointmen=
ts WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appo= intment operation to the requester's own records, allowing unauthenticated = users to retrieve the personal data of all appointments across the site and=
, on premium editions, to permanently delete them. 2026-08-02 not yet calcu= lated CVE-2026-16540 [ https://www.cve.org/CVERecord?id=3DCVE-2026-16540 ] = Sina Extension for Elementor--Sina Extension for Elementor The Sina Extensi=
on for Elementor WordPress plugin before 3.10.2 does not escape a value rec= onstructed from request input in one of its unauthenticated AJAX handlers b= efore reflecting it into the HTML response, allowing unauthenticated attack= ers to execute arbitrary JavaScript in the browser of anyone who triggers a=
crafted request. 2026-07-27 not yet calculated CVE-2026-14190 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-14190 ] Smart Manager--Smart Manager The = Smart Manager WordPress plugin before 8.92.0 does not properly encode a pos=
t field before rendering it into an HTML attribute in its management grid, = allowing users with the Contributor role or above to inject JavaScript that=
executes in the browser session of an administrator who views the grid. 20= 26-07-27 not yet calculated CVE-2026-14203 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-14203 ] SMS Alert--SMS Alert The SMS Alert WordPress plugin b= efore 3.9.8 does not bind its "mobile verified" session flag to the phone n= umber that was actually verified: after an attacker verifies an OTP sent to=
their own phone, the signup/login handler reads a fresh, attacker-supplied=
phone number to select the account and logs them in. An unauthenticated at= tacker can therefore log in as any user, including an administrator, who ha=
s a billing phone on file. 2026-08-02 not yet calculated CVE-2026-15206 [ h= ttps://www.cve.org/CVERecord?id=3DCVE-2026-15206 ] so-fancy--diff-so-fancy = diff so fancy does not properly sanitize non SGR terminal control sequences=
before outputting diff data. The application only strips ANSI SGR sequence=
s while allowing other control characters, including carriage return (\r) a=
nd escape sequences (e.g., OSC, CSI), to pass through unsanitized. An attac= ker can embed malicious control sequences in filenames, diff metadata, or f= ile content that are rendered directly in the terminal during diff viewing.=
This can lead to output manipulation, including filename spoofing, termina=
l screen clearing, and clipboard injection via supported escape sequences. = Successful exploitation may mislead users during code review, alter termina=
l state, or result in unintended command execution through clipboard hijack= ing. This issue has been fixed in the commit=C2=A09c81294 2026-07-29 not ye=
t calculated CVE-2026-50642 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5= 0642 ] Sourcecodester--Advocate Office Management System https://www.source= codester.com Advocate office management system 1.0 is affected by: SQL Inje= ction. The impact is: execute arbitrary code (remote). The component is: co= ntrol/activate_case.php,?id=3D1. The attack vector is: A SQL Injection vuln= erability exists in the activate_case.php in parameter id endpoint of Advoc= ate office management system. Unsanitized user input in the specified param= eter is interpolated directly into an SQL query, allowing attackers to infe=
r or extract data and, in some cases, execute stacked/time-based payloads. = =C3=82=C2=B6=C3=82=C2=B6 Affected Component & Parameter Affected Endpoint U= RL: http://localhost/advocate/kortex_lite/control/activate_case.php?id=3D1 = HTTP Method: GET Vulnerable File: activate_case.php Parameter: id Vector Lo= cation: GET Injection Techniques (as identified by sqlmap) Type: error-base=
d Title: MySQL >=3D 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP =
BY clause (EXTRACTVALUE) Payload: id=3D1 AND EXTRACTVALUE(6268,CONCAT(0x5c,= 0x71766b6a71,(SELECT (ELT(6268=3D6268,1))),0x716a7a6b71)) Type: time-based = blind Title: MySQL >=3D 5.0.12 AND time-based blind (query SLEEP) Payload: = id=3D1 AND (SELECT 4464 FROM (SELECT(SLEEP(5)))aHqo) Proof of Concept (Burp=
Repeater) 2026-07-29 not yet calculated CVE-2025-67406 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2025-67406 ] Sourcecodester--CASAP Automated Enrollme=
nt System Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerabl=
e to SQL Injection in update_class.php via the parameter class_name. 2026-0= 7-29 not yet calculated CVE-2025-67403 [ https://www.cve.org/CVERecord?id= =3DCVE-2025-67403 ] Sourcecodester--CASAP Automated Enrollment System Sourc= ecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Inject= ion in save_stud.php via the parameters fname, lname, and student_class. 20= 26-07-29 not yet calculated CVE-2025-67404 [ https://www.cve.org/CVERecord?= id=3DCVE-2025-67404 ] Sourcecodester--CASAP Automated Enrollment System Sou= rcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Inje= ction in update_password.php via the parameter new_password. 2026-07-29 not=
yet calculated CVE-2025-67405 [ https://www.cve.org/CVERecord?id=3DCVE-202= 5-67405 ] Sourcecodester--CASAP Automated Enrollment System Sourcecodester = CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in upd= ate_student.php via parameters fname and student_class. 2026-07-29 not yet = calculated CVE-2025-67407 [ https://www.cve.org/CVERecord?id=3DCVE-2025-674=
07 ] Sourcecodester--CASAP Automated Enrollment System Sourcecodester CASAP=
Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save_us= er.php via the parameter status. 2026-07-29 not yet calculated CVE-2025-674=
08 [ https://www.cve.org/CVERecord?id=3DCVE-2025-67408 ] Sourcecodester--Fa= ntastic Blog CMS Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cro=
ss Site Scripting (XSS) in pageEditMember.php via the address field. 2026-0= 7-29 not yet calculated CVE-2025-65337 [ https://www.cve.org/CVERecord?id= =3DCVE-2025-65337 ] SourceCodester--Modern Loan Management System SourceCod= ester Modern Loan Management System 1.0 is vulnerable to SQL Injection in a= jaxData.php via the parameters district_id , division_id, region_id, and wa= rd_id. 2026-07-31 not yet calculated CVE-2025-69946 [ https://www.cve.org/C= VERecord?id=3DCVE-2025-69946 ] SourceCodester--Modern Loan Management Syste=
m SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Inj= ection in /admin/delete_group.php?id=3D1. 2026-07-31 not yet calculated CVE= -2025-69948 [ https://www.cve.org/CVERecord?id=3DCVE-2025-69948 ] SourceCod= ester--Tailor Management System SourceCodester Tailor Management System 1.0=
is vulnerable to SQL Injection in addmeasurement.php?id=3D1. 2026-07-30 no=
t yet calculated CVE-2025-69941 [ https://www.cve.org/CVERecord?id=3DCVE-20= 25-69941 ] SourceCodester--Tailor Management System SourceCodester Tailor M= anagement System 1.0 is vulnerable to SQL Injection in customeredit.php?id= =3D1. 2026-07-30 not yet calculated CVE-2025-69947 [ https://www.cve.org/CV= ERecord?id=3DCVE-2025-69947 ] sparklemotion--sqlite3-ruby sqlite3 provides = Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earli= er, redefining a SQLite function with a different arity frees the previousl=
y registered function handler while SQLite may still reference it, resultin=
g in a use-after-free. This issue is fixed in version 2.9.5. 2026-07-28 not=
yet calculated CVE-2026-54619 [ https://www.cve.org/CVERecord?id=3DCVE-202= 6-54619 ] sparklemotion--sqlite3-ruby sqlite3 provides Ruby bindings for th=
e SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQ= Lite aggregate functions can be freed while still referenced during aggrega= tion, resulting in a use-after-free. This issue is fixed in version 2.9.5. = 2026-07-28 not yet calculated CVE-2026-54620 [ https://www.cve.org/CVERecor= d?id=3DCVE-2026-54620 ] Spectra Legacy--Spectra Legacy The Spectra Legacy W= ordPress plugin before 2.20.0 does not validate or escape several block sty=
le attributes before using them to build the CSS it outputs on the front en=
d, allowing users with the Contributor role and above to inject arbitrary C=
SS into the pages that render the affected block. The injected styles are s= erved to anonymous visitors of those pages and can force external resource = loads, deface/redress the page, or exfiltrate data via CSS attribute select= ors. JavaScript execution is not possible at this role (the script-tag brea= kout is removed by KSES), so the impact is limited to CSS injection. 2026-0= 8-01 not yet calculated CVE-2026-10827 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-10827 ] Streamit--Streamit The Streamit WordPress theme through=
4.5.0 does not perform any authorization or nonce verification on one of i=
ts unauthenticated AJAX routes, which invokes an attacker-supplied PHP func= tion with an attacker-supplied argument array, allowing unauthenticated att= ackers to call arbitrary functions (for example to create an administrator = account), leading to privilege escalation and remote code execution. 2026-0= 7-29 not yet calculated CVE-2026-13423 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-13423 ] Streamsoft--Business Intelligence Streamsoft Business I= ntelligence (BI) stores users' passwords in plaintext form in the database = This issue was fixed in version=C2=A06.8.0.0, users were also requested to = change their password on the first login. 2026-07-29 not yet calculated CVE= -2026-50641 [ https://www.cve.org/CVERecord?id=3DCVE-2026-50641 ] Support G= enix--Support Genix The Support Genix WordPress plugin before 1.4.48 does n=
ot properly authorize access to support-ticket attachment downloads, allowi=
ng unauthenticated users who obtain the stored attachment file name to down= load other users' private ticket attachments. 2026-07-31 not yet calculated=
CVE-2026-14862 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14862 ] Suppo=
rt Genix--Support Genix The Support Genix WordPress plugin before 1.4.48 do=
es not prevent directory traversal in its ticket-attachment download route,=
allowing unauthenticated attackers to read arbitrary files with an allowli= sted extension - including other users' private ticket attachments - from t=
he server. 2026-08-01 not yet calculated CVE-2026-15932 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-15932 ] Sync Post--Sync Post With Other Site The=
Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly=
enforce the page-editing capability on a REST route that creates and updat=
es posts, because of an operator-precedence flaw in its authorization check=
. An authenticated user holding only the post-editing capability (such as a=
Contributor) can create, publish, and overwrite arbitrary Pages, including=
modifying content authored by higher-privileged users. 2026-07-30 not yet = calculated CVE-2026-14923 [ https://www.cve.org/CVERecord?id=3DCVE-2026-149=
23 ] Tablesome Table--Tablesome Table The Tablesome Table WordPress plugin = before 1.1.31 does not perform any authentication, capability, or nonce che= cks in one of its AJAX actions, allowing unauthenticated users to create ne=
w published posts and to overwrite arbitrary existing posts and pages. 2026= -07-28 not yet calculated CVE-2026-14924 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-14924 ] tbc--tbc Full details and mitigation steps are currentl=
y restricted and will be published at a later date. 2026-07-31 not yet calc= ulated CVE-2026-43829 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43829 ]=
tbc--tbc Full details and mitigation steps are currently restricted and wi=
ll be published at a later date. 2026-07-31 not yet calculated CVE-2026-438=
30 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43830 ] tbc--tbc Full deta= ils and mitigation steps are currently restricted and will be published at =
a later date. 2026-07-31 not yet calculated CVE-2026-43831 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-43831 ] tbc--tbc Full details and mitigation = steps are currently restricted and will be published at a later date. 2026-= 07-31 not yet calculated CVE-2026-43832 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-43832 ] tbc--tbc Full details and mitigation steps are currentl=
y restricted and will be published at a later date. 2026-07-31 not yet calc= ulated CVE-2026-43833 [ https://www.cve.org/CVERecord?id=3DCVE-2026-43833 ]=
Tenda--W6-S 1.0.0.4 Tenda W6-S 1.0.0.4(510) contains a stack-based buffer = overflow vulnerability in the /goform/wifiSSIDset endpoint. The function fo= rmwrlSSIDset uses sprintf to copy user-controlled 'GO' and 'index' paramete=
rs into a 64-byte stack buffer without length restriction, leading to stack=
overflow. 2026-07-31 not yet calculated CVE-2026-67822 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-67822 ] The Events Calenda--The Events Calendar = The Events Calendar WordPress plugin before 6.16.5.1 does not perform an au= thorization check on one of its Event Aggregator import REST API routes and=
skips an integrity check for a particular status value, allowing unauthent= icated attackers to mark existing import records as failed and to store arb= itrary content in a hidden comment record. 2026-07-27 not yet calculated CV= E-2026-13390 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13390 ] The HDF = Group--HDF5 Heap-based buffer overflow in the SOHM list-index deserializati=
on code in HDF5 through 2.1.1 on all platforms allows attackers to cause a = denial of service (crash) via a crafted HDF5 file whose shared-message list=
index declares a num_messages count exceeding list_max, triggering out-of-= bounds heap reads and writes in H5SM__cache_list_deserialize and H5SM__cach= e_list_verify_chksum. 2026-07-27 not yet calculated CVE-2026-17572 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-17572 ] The HDF Group--HDF5 A double = free vulnerability was discovered in the HDF5 library. Processing a crafted=
HDF5 file containing an oversized chunk size field via h5repack may cause = the application to abort due to a double free. 2026-07-27 not yet calculate=
d CVE-2026-17573 [ https://www.cve.org/CVERecord?id=3DCVE-2026-17573 ] The = HDF Group--HDF5 HDF5 contains a NULL pointer dereference vulnerability. Pro= cessing a crafted HDF5 file containing an attribute with an invalid variabl= e-length datatype type field may cause the application to crash when the at= tribute is read. 2026-07-27 not yet calculated CVE-2026-17574 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-17574 ] Theme Demo Import--Theme Demo Impo=
rt The Demo Import WordPress plugin through 1.1.3 does not validate the typ=
e of files uploaded during demo-content import (the WordPress file-type tes=
t is disabled), allowing high-privilege users (Administrator by default, in= cluding non-super-admin site administrators on multisite) to upload executa= ble PHP files to the uploads directory. 2026-08-01 not yet calculated CVE-2= 026-13157 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13157 ] thorsten--p= hpMyFAQ phpMyFAQ before 4.1.6 fails to validate path traversal sequences in=
the existing_image field during category updates, allowing authenticated a= ttackers to delete arbitrary files by exploiting insufficient sanitization =
in Image::delete(). Attackers can delete the database.php configuration fil=
e to disable the installation gate and access the public setup wizard to cr= eate new superadmin accounts. 2026-07-27 not yet calculated CVE-2026-66397 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-66397 ] thorsten--phpMyFAQ ph= pMyFAQ before v4.1.6 contains a remote code execution vulnerability in the = configuration API that allows authenticated administrators with CONFIGURATI= ON_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manip= ulating the upgrade.lastDownloadedPackage setting. Attackers can upload a m= alicious ZIP file as an attachment, point the updater configuration to its = stored path, and extract it into the application root to achieve code execu= tion as the web server user. 2026-07-27 not yet calculated CVE-2026-66398 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-66398 ] thumbor--thumbor Thumb=
or is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, = file_loader decodes percent-encoded path segments after its root-boundary v= alidation, allowing traversal outside FILE_LOADER_ROOT_PATH through waterma=
rk or frame filter input. This issue is fixed in 7.8.0. 2026-07-31 not yet = calculated CVE-2026-53502 [ https://www.cve.org/CVERecord?id=3DCVE-2026-535=
02 ] Tigera--Calico When Calico's shared debug server is enabled (disabled =
by default), the Calico kube-controllers and Goldmane components bind their=
Go pprof debug listener to 0.0.0.0 without authentication. Any pod with ne= twork reachability to the listener can retrieve the process heap, goroutine=
stacks (including function arguments), and command-line arguments. Dependi=
ng on the process's in-memory state, the heap may contain sensitive materia=
l. The debug listener is opt-in but is unsafe when enabled because it offer=
s no authentication and no safe localhost-only binding option. 2026-07-30 n=
ot yet calculated CVE-2026-41186 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-41186 ] Tigera--Calico Calico's apiserver wraps tier-scoped resources s=
o that every operation runs through AuthorizeTierOperation, but the Delete = override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants i=
s not invoked for DeleteCollection requests. A user holding the deletecolle= ction verb or wildcard verbs on tier-scoped policy resources can bulk-delet=
e policies in tiers they otherwise have no rights on, breaking the tier aut= horization boundary. 2026-07-30 not yet calculated CVE-2026-41187 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-41187 ] Tigera--Calico Calico's Applic= ation Layer Policy (disabled by default), which enforces HTTP rules through=
Dikastes, fails to perform URL path normalization. As a result, HTTP reque= sts using path-traversal segments, encoded slashes, or repeated slashes are=
not correctly evaluated by Prefix path rules. Dikastes authorizes the requ= est under the permitted prefix while the downstream workload or a fronting = proxy normalizes the path and serves the restricted endpoint. An attacker w= ith network access and no special RBAC can potentially reach HTTP endpoints=
the policy was intended to restrict. 2026-07-30 not yet calculated CVE-202= 6-6540 [ https://www.cve.org/CVERecord?id=3DCVE-2026-6540 ] tourmaster--tou= rmaster The tourmaster WordPress plugin before 5.4.8 does not perform a non=
ce check when storing a custom-filter label taken from a request parameter,=
and does not escape that label when echoing it on the filter admin page, a= llowing an unauthenticated attacker to trick a logged-in administrator into=
storing JavaScript that then executes in the admin area (stored Cross-Site=
Scripting via CSRF). 2026-07-30 not yet calculated CVE-2026-14239 [ https:= //www.cve.org/CVERecord?id=3DCVE-2026-14239 ] TP-Link Systems Inc.--AXE75 V=
1 An OS command injection vulnerability exists in the VPN module of TP-Link=
AXE75 V1 routers. This vulnerability allows an adjacent, authenticated att= acker to execute arbitrary commands on the device by importing a specially = crafted VPN client configuration file. The issue arises from=C2=A0improper = filtering of special characters.=C2=A0 Successful exploitation of this vuln= erability may enable an attacker to gain full control of the affected devic=
e, potentially compromising configuration integrity, network security, and = service availability. 2026-07-31 not yet calculated CVE-2026-9044 [ https:/= /www.cve.org/CVERecord?id=3DCVE-2026-9044 ] TP-Link Systems Inc.--TL-WR850N=
v3 A hardcoded credential vulnerability exists in the firmware of multiple=
TP-Link routers (TL-WR845N v4, TL-WR850N v3, Archer C20 v6 & Archer MR200 = v5). =C2=A0Authentication-related credential material is embedded within a = password file in the firmware image and may be recovered through firmware a= nalysis. Successful exploitation could result in unauthorized access to pri= vileged functions on affected devices. 2026-07-27 not yet calculated CVE-20= 26-12001 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12001 ] TP-Link Syst= ems Inc.--TL-WR940N v6 The TL-WR940N v6 router contains a vulnerability in = its RTSP connection tracking module that can lead to a stack-based buffer o= verflow. The issue occurs when a LAN client initiates a connection to a mal= icious RTSP server controlled by an attacker. A specially crafted RTSP mess= age may trigger improper memory handling within the kernel module Successfu=
l exploitation of this vulnerability may result in a denial-of-service (DoS=
) condition or allow remote code execution (RCE), potentially leading to fu=
ll compromise of the device. This vulnerability can be exploited by an unau= thenticated attacker under the device's default configuration. 2026-07-29 n=
ot yet calculated CVE-2026-12935 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-12935 ] traefik--traefik Traefik versions >=3D v3.7.0 and <=3D v3.7.7 c= ontain a path traversal vulnerability in the Kubernetes Ingress NGINX provi= der's RewriteTarget middleware (generated from the nginx.ingress.kubernetes= .io/rewrite-target annotation). When an Ingress path uses a regex that capt= ures attacker-controlled text without requiring a path separator (e.g., pat=
h /api(.*) with rewrite target /$1), a crafted request such as /api../admin=
matches the public router, is rewritten to a dot-segment traversal path (/= ../admin), and is forwarded without post-replacement normalization validati= on. A backend that normalizes dot segments resolves the path to a protected=
endpoint (e.g., /admin) reachable only through a separate router secured w= ith BasicAuth, DigestAuth, or ForwardAuth, resulting in route-level authent= ication bypass. The issue is fixed in v3.7.8. 2026-08-01 not yet calculated=
CVE-2026-67309 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67309 ] TrueB= ooker--TrueBooker The TrueBooker WordPress plugin before 1.2.4 does not val= idate account ownership when resetting a user's password through one of its=
front-end account handlers, allowing unauthenticated attackers to set an a= rbitrary password on any account, including an administrator, and take over=
the site. 2026-07-28 not yet calculated CVE-2026-14545 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-14545 ] Tutor LMS--Tutor LMS The Tutor LMS WordP= ress plugin before 4.0.0 does not properly verify that a user has access to=
the course a Q&A thread belongs to before returning or writing to that thr= ead, allowing authenticated users with subscriber-level access and above wh=
o can access any single course to read the Q&A threads of other courses and=
to inject replies into them. 2026-07-30 not yet calculated CVE-2026-14310 =
[ https://www.cve.org/CVERecord?id=3DCVE-2026-14310 ] ueberauth--guardian A= llocation of Resources Without Limits or Throttling in ueberauth guardian a= llows denial of service via unbounded atom creation from attacker-influence=
d binary input. Guardian.Plug.Keys derives connection and session namespace=
keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/= guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>"=
, and the derived helpers claims_key/1, resource_key/1, and token_key/1 cre= ate a second atom on top of that. key_from_other/1 likewise converts a rege= x-captured binary through String.to_atom/1. The public specs advertise Stri= ng.t() as a valid argument, so passing a string is documented usage, and hi= gher-level entry points such as Guardian.Plug.current_token(conn, key: key)=
thread the caller-supplied key straight into these functions. String.to_at= om/1 creates a brand-new atom for every previously unseen binary, atoms are=
never garbage collected, and the BEAM atom table is fixed at roughly 1,048= ,576 entries by default. An application that routes attacker-influenced dat=
a (a tenant identifier, header, or other request input) into a Guardian key=
therefore mints one permanent atom per distinct value. A modest stream of = varied, unauthenticated input permanently consumes the atom table and crash=
es the BEAM node, taking down every application running on it. This issue a= ffects guardian: from 0.1.0 before 2.4.1. 2026-08-01 not yet calculated CVE= -2026-54894 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54894 ] ueberauth= --guardian Allocation of Resources Without Limits or Throttling in ueberaut=
h guardian allows denial of service via unbounded atom creation from attack= er-controlled binary input. Guardian.Permissions.AtomEncoding encodes permi= ssion scopes by passing arbitrary binaries to String.to_atom/1. When encode=
/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each=
binary entry is handled by the encode_value/3 binary clause, which calls S= tring.to_atom(value) with no allow-list check. The perm_set argument (the a= pplication's small, finite set of legitimate permission names) is discarded=
, so any external string flows straight into atom creation. This encoder is=
selected with use Guardian.Permissions, encoding: Guardian.Permissions.Ato= mEncoding and reached through the imported encode/3 entry point. String.to_= atom/1 creates a brand-new atom for every previously unseen binary, atoms a=
re never garbage collected, and the BEAM atom table is fixed at roughly 1,0= 48,576 entries by default. An application that funnels attacker-influenced = permission scopes (from a request body, a JWT claim, or other external inpu=
t) into encode/3 therefore mints one permanent atom per distinct value. A m= odest stream of varied, unauthenticated input permanently consumes the atom=
table and crashes the BEAM node with system_limit, taking down every appli= cation running on it. The default encoder is Guardian.Permissions.BitwiseEn= coding, which is not affected. This issue affects guardian: from 2.0.0 befo=
re 2.4.1. 2026-08-01 not yet calculated CVE-2026-55733 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-55733 ] ueberauth--guardian Allocation of Resourc=
es Without Limits or Throttling vulnerability in ueberauth guardian (Guardi= an.Permissions module) allows a denial of service via BEAM atom-table exhau= stion. This vulnerability is associated with program file lib/guardian/perm= issions.ex and program routines 'Elixir.Guardian.Permissions':encode_permis= sions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, = 'Elixir.Guardian.Permissions':do_encode_permissions!/2. The Guardian.Permis= sions mixin installs a public encode_permissions!/1 function on every modul=
e that does use Guardian.Permissions. For each key of the supplied map, enc= ode_permissions!/1 calls String.to_atom(to_string(k)) before any validation=
runs. The integer-value clause of do_encode_permissions!/2 then short-circ= uits straight to encoding without validating the key against the configured=
permission set, so a key with an integer value is interned as a fresh atom=
with no exception raised. Atoms are never garbage collected and the BEAM a= tom table is a fixed-size resource (default roughly 1,048,576 entries), so = each unique attacker-chosen key permanently consumes one slot. An attacker = who can influence a permission map that reaches encode_permissions!/1 (for = example a permissions map read from a request body and passed into token is= suance via encode_permissions_into_claims!/2) can mint an unbounded number =
of atoms and exhaust the atom table, crashing the entire BEAM node and ever=
y service running on it. The sibling decode_permissions/1 is not affected b= ecause it skips keys absent from the configured permission set. This issue = affects guardian: from 2.0.0 before 2.4.1. 2026-08-01 not yet calculated CV= E-2026-55734 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55734 ] ueberaut= h--guardian Improper Verification of Cryptographic Signature in ueberauth g= uardian allows an unauthenticated attacker to revoke a victim's session wit=
h a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied=
token with peek/1, which performs no signature verification (it only base6= 4-decodes the JWT header and payload). The resulting unverified claims are = forwarded directly to the configured token module's revoke callback and the=
implementation's on_revoke callback, a state-mutating sink. The sibling op= erations refresh/2 and exchange/4 both call decode_and_verify first, so the=
signature is checked before anything acts on the claims; revoke/3 is the o= nly state-mutating path that acts on claims without verifying the signature=
. An attacker who knows or guesses a victim's identifying claim values (jti=
, sub) can forge a JWT carrying those claims, sign it with an arbitrary key=
, and submit it to any endpoint that funnels a caller-supplied token into G= uardian.revoke/3 (the standard logout / session-revocation pattern). When t=
he token module mutates state keyed by the claims (whitelist deletion or bl= acklist insertion, for example a GuardianDb-style store), the victim's legi= timate session is evicted. This is an unauthenticated session-revocation de= nial of service; the attacker never needs the signing secret. This issue af= fects guardian: from 1.0.0 before 2.4.1. 2026-08-01 not yet calculated CVE-= 2026-55735 [ https://www.cve.org/CVERecord?id=3DCVE-2026-55735 ] ufirstgrou= p--ymlr Improper Neutralization of CRLF Sequences vulnerability in ufirstgr= oup ymlr (Elixir.Ymlr module) allows attackers to inject arbitrary content = into generated YAML documents through document comments. Ymlr.document!/2 i= nterpolates each caller-supplied comment string into the output behind a si= ngle # prefix without validating it or escaping line breaks. Because a YAML=
comment is terminated by a line break, the first carriage return or line f= eed in the comment string ends the comment context and everything after it =
is emitted at column 0 of the document body. An attacker who controls text = that the host application passes as a comment can forge top-level mapping k= eys, override values the application itself set, and emit --- or ... marker=
s that split the output into additional documents. Downstream consumers of = the generated YAML, such as configuration loaders, deployment manifests, CI=
pipelines and data importers, parse the injected content as legitimate dat=
a. The same clause backs Ymlr.document/2, Ymlr.documents!/2 and Ymlr.docume= nts/2, so every document encoding entry point is affected. This vulnerabili=
ty is associated with program files lib/ymlr.ex and program routines 'Elixi= r.Ymlr':document!/2, 'Elixir.Ymlr':documents!/2. This issue affects ymlr fr=
om 0.0.1 before 5.1.6. 2026-07-31 not yet calculated CVE-2026-65636 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-65636 ] Ultimate Addons for WPBakery=
Page Builder--Ultimate Addons for WPBakery Page Builder The Ultimate Addon=
s for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-re= ndering function, Ultimate_VC_Addons::uavc_link_init(), 2026-07-31 not yet = calculated CVE-2026-14921 [ https://www.cve.org/CVERecord?id=3DCVE-2026-149=
21 ] Ultimate Addons for WPBakery Page Builder--Ultimate Addons for WPBaker=
y Page Builder The Ultimate Addons for WPBakery Page Builder WordPress plug=
in before 3.21.4 does not perform a capability or nonce check before deleti=
ng a site's custom-uploaded icon font packs, allowing unauthenticated attac= kers to permanently delete all of a site's custom icon fonts with a single = request. 2026-07-30 not yet calculated CVE-2026-15382 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-15382 ] Ultimate Member--Ultimate Member The Ultim= ate Member WordPress plugin before 2.12.1 does not filter administrator-lev=
el capabilities from the roles it makes selectable on its registration form=
s, and its post-registration safeguard against elevated accounts is disable=
d by default, allowing unauthenticated users to register with a site-define=
d role that carries administrator capabilities and gain administrative acce= ss, when such a role exists and a role-selection field is present on a publ= ished registration form. 2026-07-31 not yet calculated CVE-2026-12251 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-12251 ] User Frontend--User Fronte= nd: AI Powered Frontend Post Submission, User Directory, User Profile, Memb= ership & User Registration The User Frontend: AI Powered Frontend Post Subm= ission, User Directory, User Profile, Membership & User Registration WordPr= ess plugin before 4.3.8 does not correctly verify ownership before deleting=
an attachment, allowing unauthenticated attackers to permanently delete au= thor-less attachments such as guest uploads and User Frontend: AI Powered F= rontend Post Submission, User Directory, User Profile, Membership & User Re= gistration WordPress plugin before 4.3.8-installed placeholder media. 2026-= 07-27 not yet calculated CVE-2026-14568 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-14568 ] User Profile Builder--User Profile Builder The User Pro= file Builder WordPress plugin before 3.16.4 does not correctly bind the aut= omatic login performed after user registration to the newly created account=
, allowing unauthenticated attackers to obtain an authenticated session for=
an arbitrary existing user, including administrators, on sites using a sup= ported but non-default configuration. 2026-08-01 not yet calculated CVE-202= 6-15368 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15368 ] UsersWP--User= sWP The UsersWP WordPress plugin before 1.2.67 does not validate the select=
ed authentication provider in its two-factor login handler, allowing an att= acker who already knows a user's credentials to bypass the second authentic= ation factor and log in as that user. 2026-07-29 not yet calculated CVE-202= 6-13690 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13690 ] veraPDF--vera= PDF-parser veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 = and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in v= eraPDF-parser/src/main/java/org/verapdf/pd/font/cmap/CMapParser.java and ve= raPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java, w= here a crafted Type 0 font /Encoding or /ToUnicode CMap stream can execute = unbounded PostScript array allocation or a zero-increment for loop and exha= ust validator memory or CPU. This issue is fixed in versions 1.30.2 and 1.3= 1.23. 2026-07-29 not yet calculated CVE-2026-54080 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-54080 ] veraPDF--veraPDF-parser veraPDF PDF parser is=
a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser cont= ains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/= verapdf/pd/font/type1/Type1FontProgram.java and veraPDF-parser/src/main/jav= a/org/verapdf/parser/postscript/PSOperator.java, where a crafted Type 1 fon=
t /FontDescriptor /FontFile program can execute unbounded PostScript array = allocation, a zero-increment for loop, or self-recursive toExecute user dic= tionary lookups and exhaust validator memory, CPU, or stack. This issue is = fixed in versions 1.30.2 and 1.31.23. 2026-07-29 not yet calculated CVE-202= 6-54081 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54081 ] veraPDF--vera= PDF-validation veraPDF validation model is an implementation of the veraPDF=
validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validatio=
n contains an XML External Entity (XXE) vulnerability in validation-model/s= rc/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in getRic= hTextStringOrStreamEntryStringRepresentation(), where a crafted PDF contain= ing a malicious rich-text /RC or /RV entry can cause external entity expans= ion and reflect local file contents into the validation report. This issue =
is fixed in versions 1.30.2 and 1.31.71. 2026-07-29 not yet calculated CVE-= 2026-54078 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54078 ] veraPDF--v= eraPDF-validation veraPDF validation provides PDF/A and PDF/UA validation, = feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.= 71, veraPDF-validation contains an XML External Entity (XXE) vulnerability =
in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm= .java in the getdynamicRender() method, where a crafted PDF containing a ma= licious XFA stream can cause external entity expansion during PDF/UA-1 vali= dation and allow local file disclosure or outbound server-side requests. Th=
is issue is fixed in versions 1.30.2 and 1.31.71. 2026-07-29 not yet calcul= ated CVE-2026-54079 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54079 ] v= ercel--next.js Next.js is a React framework for building full-stack web app= lications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, c= rafted requests targeting Next.js applications using App Router with at lea=
st one Server Action can lead to excessive CPU usage blocking processing of=
further requests in the same process. This issue has been fixed in version=
s 15.5.21 and 16.2.11. 2026-07-27 not yet calculated CVE-2026-64641 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-64641 ] vercel--next.js Next.js is a=
React framework for building full-stack web applications. In versions 16.0=
.0 through 16.2.10, crafted requests targeting Next.js applications using A=
pp Router built with Turbopack and a single entry in config.i18n.locales ca=
n bypass middleware/proxy based authentication. This issue has been fixed i=
n version 16.2.11. 2026-07-27 not yet calculated CVE-2026-64642 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-64642 ] vercel--next.js Next.js is a Rea=
ct framework for building full-stack web applications. In versions 12.0.0 t= hrough 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App R= outer, Server Actions (use server) or use cache endpoints can be disclosed = bypassing any authentication on the pages where these endpoints are usually=
used. Server Action IDs can be disclosed to unauthenticated users via publ= icly served client artifacts (for example, static chunks containing action = references). Affected users are applications using App Router and Server Ac= tions. By itself, this disclosure is typically a recon/enumeration primitiv=
e; however, it can increase risk when combined with other weaknesses. This = issue has been fixed in versions 15.5.21 and 16.2.11. 2026-07-27 not yet ca= lculated CVE-2026-64643 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64643=
] vercel--next.js Next.js is a React framework for building full-stack web=
applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.1=
0, when self-hosting Next.js with the default image loader, the Image Optim= ization API can optimize remotely hosted images if configured (not enabled =
by default). If those images contain malicious content, they can cause CPU = exhaustion in /_next/image endpoints.Only config.images.remotePatterns is a= ffected, and just the patterns in that array, whereas config.images.unoptim= ized: true, config.images.loader: 'custom', and Vercel are not impacted. Th=
is issue has been fixed in versions 15.5.21 and 16.2.11. 2026-07-27 not yet=
calculated CVE-2026-64644 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64= 644 ] vercel--next.js Next.js is a React framework for building full-stack = web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.= 2.10, a rewrites() or redirects() rule that builds its external destination=
hostname from request-controlled input can be pointed at an arbitrary host= name, regardless of the rule's hostname suffix. For a rewrite, Next.js prox= ies the request to that arbitrary host and serves the response from the app= lication's origin, leading to Server-Side Request forgery. A redirects() ru=
le configured this way is vulnerable to an Open Redirect. This issue has be=
en fixed in versions 15.5.21 and 16.2.11. 2026-07-27 not yet calculated CVE= -2026-64645 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64645 ] vercel--n= ext.js Next.js is a React framework for building full-stack web application=
s. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests = targeting Next.js applications using App Router with at least one Server Ac= tion can lead to excessive memory consumption if that Server Actions uses t=
he Edge runtime. This issue has been fixed in versions 15.5.21 and 16.2.11.=
2026-07-27 not yet calculated CVE-2026-64646 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-64646 ] vercel--next.js Next.js is a React framework for b= uilding full-stack web applications. In versions 12.0.0 through 15.5.20 and=
16.0.0 through 16.2.10, a server-side fetch with a request body may return=
a cached response body from a different request to the same URL but differ= ent body. Confidential data in the POST's response body would then leak to = unauthorized requests. Though the request itself will not be deduped. This =
is only an issue when receiving request bodies with a content type charset = other than UTF-8. For example, the UTF-16 byte sequences for =C3=AC=E2=80= =9A=C6=92=C3=AC=E2=80=9A=C6=92 and =C3=AC=E2=80=9E=E2=80=9E=C3=AC=E2=80=9E= =E2=80=9E in the request body would share the same cache. This issue has be=
en fixed in versions 15.5.21 and 16.2.11. 2026-07-27 not yet calculated CVE= -2026-64647 [ https://www.cve.org/CVERecord?id=3DCVE-2026-64647 ] vercel--n= ext.js Next.js is a React framework for building full-stack web application=
s. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-= side fetch with a request body may return a cached response body from a dif= ferent request to the same URL but different body. Confidential data in the=
POST's response body would then leak to unauthorized requests. Though the = request itself will not be deduped. This only applies to fetch calls with a=
request that has a different init than the one passed to fetch. A safe req= uest would be: fetch(new Request(init), init). An unsafe request would be: = fetch(new Request(init), aDifferentInit). This issue has been fixed in vers= ions 15.5.21 and 16.2.11. 2026-07-27 not yet calculated CVE-2026-64648 [ ht= tps://www.cve.org/CVERecord?id=3DCVE-2026-64648 ] vercel--next.js Next.js i=
s a React framework for building full-stack web applications. In versions 1= 4.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forw= ards or redirects a request, an attacker can cause the server to send that = outbound request to a malicious host (Server-Side Request Forgery). This re= quires the attacker's request to control Host-associated headers. In some c= onfigurations, it's also possible to obtain internal values that weaken mid= dleware/proxy authorization. Applications that use Server Actions are affec= ted when the incoming host header is not fixed to a trusted value. This typ= ically occurs on custom servers, or on deployments not behind a proxy that = pins the host. Managed hosting pins the host upstream and is not affected; = next start and standalone output do the same from version 14.2 onward. This=
issue has been fixed in versions 15.5.21 and 16.2.11. 2026-07-27 not yet c= alculated CVE-2026-64649 [ https://www.cve.org/CVERecord?id=3DCVE-2026-6464=
9 ] VPS.org--Supabase template Deployment of the VPS.org one-click Supabase=
template deploys a PostgreSQL instance that is published on all interfaces=
(0.0.0.0:5432) with a default database password set to "postgres". Because=
Docker installs its own iptables rules, this exposure bypasses a standard = host UFW configuration. 2026-07-31 not yet calculated CVE-2026-16503 [ http= s://www.cve.org/CVERecord?id=3DCVE-2026-16503 ] VPS.org--Zulip template Dep= loyment of the VPS.org one-click Zulip template deploys a hardcoded applica= tion signing key, a default database password ("zulip"), and DISABLE_HTTPS= =3DTrue. 2026-07-31 not yet calculated CVE-2026-16504 [ https://www.cve.org= /CVERecord?id=3DCVE-2026-16504 ] wazuh--wazuh Wazuh workflows before 44bf11=
4 contain a shell injection vulnerability in GitHub Actions that allows att= ackers to execute arbitrary commands by submitting pull requests with craft=
ed VERSION.json files. Attackers can inject shell metacharacters into envir= onment variables that are directly interpolated into run steps, enabling co= mmand execution and exfiltration of secrets including GITHUB_TOKEN and AWS = credentials on self-hosted runners. 2026-08-01 not yet calculated CVE-2026-= 67308 [ https://www.cve.org/CVERecord?id=3DCVE-2026-67308 ] WebPros--cPanel=
HTTP Smuggling in cPanel allows potential leak of credentials. 2026-07-31 = not yet calculated CVE-2026-58047 [ https://www.cve.org/CVERecord?id=3DCVE-= 2026-58047 ] WebPros--cPanel Improper preservation of SQL mode when renamin=
g databases in cPanel allows execution of SQL in root context. 2026-07-31 n=
ot yet calculated CVE-2026-58048 [ https://www.cve.org/CVERecord?id=3DCVE-2= 026-58048 ] webtoffee-cookie-consent--webtoffee-cookie-consent The webtoffe= e-cookie-consent WordPress plugin before 3.5.3 does not perform authorizati=
on checks on several of its REST API routes, allowing unauthenticated attac= kers to export and delete stored visitor consent records, create posts, and=
modify the webtoffee-cookie-consent WordPress plugin before 3.5.3's licens= ing state. 2026-08-02 not yet calculated CVE-2026-13389 [ https://www.cve.o= rg/CVERecord?id=3DCVE-2026-13389 ] withastro--astro Astro is a web framewor=
k for content-driven websites. In versions 3.10.0 through 7.0.3, when a tra= nsition:persist, transition:scope, or transition:persist-props directive is=
applied to a client-hydrated (client:*) component, Astro copied the direct= ive value onto the rendered <astro-island> element without HTML-escaping it=
. If a developer reflects attacker-controlled input into one of these direc= tives, an attacker can break out of the attribute and inject arbitrary HTML= /JavaScript into the server-rendered output, resulting in reflected cross-s= ite scripting (XSS). Exploitation requires the application developer to hav=
e written a non-idiomatic pattern - passing untrusted, request-derived inpu=
t directly into a transition directive. Astro applications that do not rout=
e untrusted input into these directives are unaffected. This issue has been=
fixed in version 7.0.4. 2026-07-27 not yet calculated CVE-2026-59727 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-59727 ] withastro--astro Astro is =
a web framework for content-driven websites. Versions prior to 7.0.6 are vu= lnerable to XSS through unescaped spread attribute names in renderHTMLEleme= nt. The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_= NAME_CHAR guard to addAttribute() so that spread-prop attribute names conta= ining "' >/=3D or whitespace are dropped. A second attribute-rendering path=
, renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts, h=
as its own inline attribute loop that does not go through addAttribute() an=
d was not updated. It interpolates the attribute name unescaped and only es= capes the value, so untrusted prop keys spread onto a native-HTMLElement-su= bclass component can still break out of the attribute context. This issue h=
as been fixed in version 7.0.6. 2026-07-27 not yet calculated CVE-2026-5972=
9 [ https://www.cve.org/CVERecord?id=3DCVE-2026-59729 ] withastro--astro As= tro is a web framework for content-driven websites. In versions 8.1.0 throu=
gh 11.0.1, when trailingSlash: 'always' is configured, the @astrojs/node st= andalone server's static file handler appends a trailing slash to request p= aths and issues a 301 redirect. Paths beginning with /\ (slash-backslash) w= ere not recognized as internal paths, so the handler would echo the raw pat=
h back in the Location header. Because browsers treat \ as / per the WHATWG=
URL specification, the resulting redirect could resolve to an external hos=
t. Preconditions for exploitation: trailingSlash: 'always' must be set (non= -default; the default is 'ignore'), the request path must not have a file e= xtension in its final segment, and an attacker must deliver the crafted lin=
k to a user. This issue has been fixed in version 11.0.2. 2026-07-27 not ye=
t calculated CVE-2026-59730 [ https://www.cve.org/CVERecord?id=3DCVE-2026-5= 9730 ] WOLF--WOLF The WOLF WordPress plugin before 1.1.0 does not perform a=
nonce or capability check on one of its AJAX actions, allowing an unauthen= ticated attacker to trick a logged-in administrator into writing arbitrary = content, including a malicious script, into a post via a cross-site request=
, resulting in stored Cross-Site Scripting. 2026-07-29 not yet calculated C= VE-2026-14234 [ https://www.cve.org/CVERecord?id=3DCVE-2026-14234 ] WooComm= erce--Event Booking Manager for WooCommerce The Event Booking Manager for W= ooCommerce WordPress plugin before 5.3.7 does not prevent the deserializati=
on of user-controlled input in some of its event content fields, allowing u= sers with Contributor-level access and above to inject PHP objects. No POP = chain is present in the Event Booking Manager for WooCommerce WordPress plu= gin before 5.3.7 itself, but if one is present via another installed Event = Booking Manager for WooCommerce WordPress plugin before 5.3.7 or , this cou=
ld lead to actions such as arbitrary file deletion, sensitive data retrieva=
l, or remote code execution. This is an incomplete fix of the Event Booking=
Manager for WooCommerce WordPress plugin before 5.3.7's earlier object-inj= ection advisories. 2026-08-02 not yet calculated CVE-2026-16062 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-16062 ] WooCommerce--Event Booking Manag=
er for WooCommerce The Event Booking Manager for WooCommerce WordPress plug=
in before 5.3.7 does not sanitise or escape event timeline content submitte=
d by users with post-editing access before storing it and rendering it on t=
he public event page, allowing users with the Author role and above to inje=
ct arbitrary JavaScript that executes in the browser of any visitor viewing=
the event, including administrators. 2026-08-02 not yet calculated CVE-202= 6-16063 [ https://www.cve.org/CVERecord?id=3DCVE-2026-16063 ] WooCommerce--= Event Booking Manager for WooCommerce The Event Booking Manager for WooComm= erce WordPress plugin before 5.3.7 does not properly verify authorization o=
n the object being modified when quick-editing events, only checking a glob=
al capability, allowing users with the Contributor role and above to modify=
the title and publication status of arbitrary posts and pages on the site,=
including content they do not own. 2026-08-02 not yet calculated CVE-2026-= 16064 [ https://www.cve.org/CVERecord?id=3DCVE-2026-16064 ] WooCommerce--Pr= oduct Attachment for WooCommerce The Product Attachment for WooCommerce Wor= dPress plugin before 2.3.3 does not perform any authorization check before = streaming media library files, allowing unauthenticated users to download a=
ny attachment - including private or unlinked uploads - by enumerating its = numeric ID. 2026-08-02 not yet calculated CVE-2026-16285 [ https://www.cve.= org/CVERecord?id=3DCVE-2026-16285 ] WooCommerce--Product Feed Manager For W= ooCommerce The Product Feed Manager For WooCommerce WordPress plugin before=
7.6.1 does not properly sanitise and escape product-feed custom filter rul=
es before using them in a SQL query, allowing users with the Contributor ro=
le and above to perform SQL injection attacks. 2026-07-31 not yet calculate=
d CVE-2026-15258 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15258 ] Word= Press--WeChat WordPress plugin The =C3=A5=C2=BE=C2=AE=C3=A4=C2=BF=C2=A1=C3= =A4=C2=BA=C5=92=C3=A7=C2=BB=C2=B4=C3=A7=C2=A0=C2=81=C3=A7=E2=84=A2=C2=BB=C3= =A9=E2=84=A2=E2=80=A0 WordPress plugin through 1.3 does not properly valida=
te WeChat webhook requests, as its signature check always passes, and it di= scloses the generated login code in the webhook response. This allows an un= authenticated attacker to forge a login event for any existing username, re=
ad the login code, and redeem it through an unauthenticated AJAX action to = log in as that user, including an administrator, without a password. 2026-0= 7-27 not yet calculated CVE-2026-13597 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-13597 ] WP Delicious--WP Delicious The WP Delicious WordPress p= lugin before 1.10.2 does not perform an authorization check on one of its A= JAX actions, allowing unauthenticated users to modify limited post metadata=
(a like counter and an associated identifier list) on arbitrary posts, inc= luding inflating the counter and growing the stored metadata without bound.=
2026-07-30 not yet calculated CVE-2026-14305 [ https://www.cve.org/CVEReco= rd?id=3DCVE-2026-14305 ] WP Ghost (Hide My WP Ghost)--WP Ghost (Hide My WP = Ghost) The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does = not verify that client IP information comes from a trusted proxy before tru= sting attacker-controllable HTTP headers, allowing unauthenticated attacker=
s to spoof their IP address to bypass the WP Ghost (Hide My WP Ghost) WordP= ress plugin before 7.0.05's own brute-force protection and to downgrade its=
firewall by matching a hardcoded whitelisted IP range. 2026-07-30 not yet = calculated CVE-2026-11870 [ https://www.cve.org/CVERecord?id=3DCVE-2026-118=
70 ] WP Go Maps--WP Go Maps The WP Go Maps WordPress plugin before 10.1.04 = does not properly sanitise and escape a parameter before using it in a SQL = query, allowing unauthenticated users to perform SQL injection attacks. 202= 6-07-31 not yet calculated CVE-2026-15381 [ https://www.cve.org/CVERecord?i= d=3DCVE-2026-15381 ] WP Hotel Booking--WP Hotel Booking The WP Hotel Bookin=
g WordPress plugin before 2.3.2 does not sanitise and escape a search param= eter on an administrative listing before using it in a SQL query, allowing = users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-= management roles to perform SQL injection attacks. 2026-07-30 not yet calcu= lated CVE-2026-15153 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15153 ] =
WP Photo Album Plus--WP Photo Album Plus WP Photo Album Plus is vulnerable =
to stored Cross-Site Scripting in all versions up to, and including, 9.2.03= .001 through a decode-after-sanitize (double-encoding) flaw in the photo-co= mment pipeline. On write, `wppa_do_comment()` sanitizes the comment with `w= ppa_filter_html()` (wp_kses) followed by `wp_strip_all_tags()` (`wppa-funct= ions.php:2623-2624`). Because `wp_strip_all_tags()` only removes *real* tag=
s, an attacker who submits a **double HTML-entity-encoded** payload (e.g. `= &amp;lt;img src=3D... onload=3D...&amp;gt;`) passes the write filters as ha= rmless entity text and is stored one decode-level down (`&lt;img ... onload= =3D...&gt;`). 2026-07-31 not yet calculated CVE-2026-14922 [ https://www.cv= e.org/CVERecord?id=3DCVE-2026-14922 ] WP Real IP-based Access Control--WP R= eal IP-based Access Control The WP Real IP-based Access Control WordPress p= lugin through 1.3.1 does not perform any capability or nonce checks before = storing one of its option values, and does not escape that value on output =
on its settings page, allowing unauthenticated users to store arbitrary Jav= aScript that executes in the context of any administrator who views the pag=
e. 2026-07-30 not yet calculated CVE-2026-14592 [ https://www.cve.org/CVERe= cord?id=3DCVE-2026-14592 ] WP Travel Engine--WP Travel Engine The WP Travel=
Engine WordPress plugin before 6.8.2 does not perform a capability check o=
n an AJAX action that updates a WP Travel Engine WordPress plugin before 6.= 8.2 option, allowing unauthenticated users to overwrite a site-wide WP Trav=
el Engine WordPress plugin before 6.8.2 option (the public nonce that gates=
the action is served to anonymous visitors). 2026-07-30 not yet calculated=
CVE-2026-12500 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12500 ] WP Tr= avel--WP Travel The WP Travel WordPress plugin before 11.8.1 does not verif=
y PayPal Instant Payment Notifications through the PayPal post-back handsha=
ke before marking a booking paid, allowing unauthenticated attackers to for=
ge a notification that flips an arbitrary pending booking to a paid and boo= ked state at an attacker-chosen amount. 2026-07-30 not yet calculated CVE-2= 026-13143 [ https://www.cve.org/CVERecord?id=3DCVE-2026-13143 ] WP Travel--=
WP Travel The WP Travel WordPress plugin before 11.8.1 does not verify that=
the booking requested on its customer account dashboard belongs to the cur= rent user, allowing any logged-in user to read another customer's booking d= etails, including billing address information, by supplying an arbitrary bo= oking identifier. 2026-07-30 not yet calculated CVE-2026-13145 [ https://ww= w.cve.org/CVERecord?id=3DCVE-2026-13145 ] wp-graphql--wp-graphql WPGraphQL = provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the de= precated user field on SendPasswordResetEmailPayload lets an unauthenticate=
d caller distinguish existing author-class accounts through the sendPasswor= dResetEmail mutation and obtain public profile fields. This issue is fixed =
in version 2.15.1. 2026-07-31 not yet calculated CVE-2026-54768 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-54768 ] wp-media-folder-addon--wp-media-= folder-addon The wp-media-folder-addon WordPress plugin through 4.1.6 does = not validate a user-supplied parameter before using it in a file read opera= tion in two AJAX actions available to unauthenticated users, leading to Arb= itrary File Disclosure and Server-Side Request Forgery on sites where a clo=
ud storage connection has been configured. This is an incomplete fix of CVE= -2026-9690, whose patch hardened only one of the affected cloud-storage han= dlers and left the others unpatched. 2026-07-29 not yet calculated CVE-2026= -11974 [ https://www.cve.org/CVERecord?id=3DCVE-2026-11974 ] WPBot--WPBot T=
he WPBot WordPress plugin before 8.5.2 does not validate administrator-conf= igured field identifiers before using them in a SQL query, allowing users w= ith administrator access to perform SQL injection that executes when a visi= tor triggers a search. 2026-07-27 not yet calculated CVE-2026-14189 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-14189 ] wpForo Forum--wpForo Forum T=
he wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape =
a user profile field before outputting it inside an HTML attribute on the p= ublic participant profile page, allowing users with a subscriber-level acco= unt to inject JavaScript that executes in the browser of any visitor who vi= ews the profile, including a logged-in administrator. 2026-08-01 not yet ca= lculated CVE-2026-12696 [ https://www.cve.org/CVERecord?id=3DCVE-2026-12696=
] wpForo Forum--wpForo Forum The wpForo Forum WordPress plugin before 3.1.=
2 does not verify that an AI chat conversation belongs to the requesting us=
er before deleting its messages, allowing users with a subscriber-level acc= ount to permanently delete the stored AI chat message history of any other = user. 2026-07-31 not yet calculated CVE-2026-12697 [ https://www.cve.org/CV= ERecord?id=3DCVE-2026-12697 ] xdan--jodit Jodit Editor is a WYSIWYG editor = with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean= -html denyTags filter does not normalize foreign SVG or MathML script node = names, allowing a script element nested directly in SVG or MathML to remain=
in editor.value and execute when content is loaded. This issue is fixed in=
version 4.13.6. 2026-07-31 not yet calculated CVE-2026-65841 [ https://www= .cve.org/CVERecord?id=3DCVE-2026-65841 ] Xen--Xen Xenstore, to have an up-t= o-date picture of the entire system, wants to know of domains appearing and=
disappearing. To make this more robust, a new XEN_DOMCTL_get_domain_state = was introduced. The management of the bitmap underlying that operation is t= ied into the binding of the VIRQ_DOM_EXC virtual IRQ. Unfortunately an erro=
r path there would tear down the bitmap even in cases when it wasn't set up=
. Unprivileged domains can trigger that error path. 2026-07-28 not yet calc= ulated CVE-2026-42492 [ https://www.cve.org/CVERecord?id=3DCVE-2026-42492 ]=
Xen--Xen Addressing certain issues, in particular related to operations wh= ich may take excessively long and therefore would need preemption, has turn=
ed out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commo= nly available, the decision was to deprecate the functionality, while still=
retaining it for people to use at their own (security) risk. Memory-wise s= mall enough guests may still be okay to run. 2026-07-28 not yet calculated = CVE-2026-42493 [ https://www.cve.org/CVERecord?id=3DCVE-2026-42493 ] Xen--X=
en [This CNA information record relates to multiple CVEs; the text explains=
which aspects/vulnerabilities correspond to which CVE.] The directory and = Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengt=
hs directly from attacker-controlled on-disk fields without validating them=
: * The directory loop itself assumes a good record length. This is CVE-202= 6-42494. * The calculation of the System Use area may underflow. This is CV= E-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record=
length. This is CVE-2026-62423. * The Rock Ridge NM record processing assu= mes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE record=
processing assumes a good size and offset. This is CVE-2026-62425. 2026-07= -28 not yet calculated CVE-2026-42494 [ https://www.cve.org/CVERecord?id=3D= CVE-2026-42494 ] Xen--Xen [This CNA information record relates to multiple = CVEs; the text explains which aspects/vulnerabilities correspond to which C= VE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 drive=
r derives several lengths directly from attacker-controlled on-disk fields = without validating them: * The directory loop itself assumes a good record = length. This is CVE-2026-42494. * The calculation of the System Use area ma=
y underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assume=
s a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM=
record processing assumes a good entry length. This is CVE-2026-62424. * T=
he Rock Ridge CE record processing assumes a good size and offset. This is = CVE-2026-62425. 2026-07-28 not yet calculated CVE-2026-42495 [ https://www.= cve.org/CVERecord?id=3DCVE-2026-42495 ] Xen--Xen [This CNA information reco=
rd relates to multiple CVEs; the text explains which aspects/vulnerabilitie=
s correspond to which CVE.] The directory and Rock Ridge / SUSP walk in lib= fsimage's iso9660 driver derives several lengths directly from attacker-con= trolled on-disk fields without validating them: * The directory loop itself=
assumes a good record length. This is CVE-2026-42494. * The calculation of=
the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridg=
e extension loop assumes a good (inner) record length. This is CVE-2026-624= 23. * The Rock Ridge NM record processing assumes a good entry length. This=
is CVE-2026-62424. * The Rock Ridge CE record processing assumes a good si=
ze and offset. This is CVE-2026-62425. 2026-07-28 not yet calculated CVE-20= 26-62423 [ https://www.cve.org/CVERecord?id=3DCVE-2026-62423 ] Xen--Xen [Th=
is CNA information record relates to multiple CVEs; the text explains which=
aspects/vulnerabilities correspond to which CVE.] The directory and Rock R= idge / SUSP walk in libfsimage's iso9660 driver derives several lengths dir= ectly from attacker-controlled on-disk fields without validating them: * Th=
e directory loop itself assumes a good record length. This is CVE-2026-4249=
4. * The calculation of the System Use area may underflow. This is CVE-2026= -42495. * The Rock Ridge extension loop assumes a good (inner) record lengt=
h. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a = good entry length. This is CVE-2026-62424. * The Rock Ridge CE record proce= ssing assumes a good size and offset. This is CVE-2026-62425. 2026-07-28 no=
t yet calculated CVE-2026-62424 [ https://www.cve.org/CVERecord?id=3DCVE-20= 26-62424 ] Xen--Xen [This CNA information record relates to multiple CVEs; = the text explains which aspects/vulnerabilities correspond to which CVE.] T=
he directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver deri= ves several lengths directly from attacker-controlled on-disk fields withou=
t validating them: * The directory loop itself assumes a good record length=
. This is CVE-2026-42494. * The calculation of the System Use area may unde= rflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a go=
od (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM recor=
d processing assumes a good entry length. This is CVE-2026-62424. * The Roc=
k Ridge CE record processing assumes a good size and offset. This is CVE-20= 26-62425. 2026-07-28 not yet calculated CVE-2026-62425 [ https://www.cve.or= g/CVERecord?id=3DCVE-2026-62425 ] Xen--Xen [This CNA information record rel= ates to multiple CVEs; the text explains which aspects/vulnerabilities corr= espond to which CVE.] To manage the system, sysctl and platform operations = are used by the control domain or a possible Xenstore domain. Some of these=
operations may not be executed in parallel, so a system-wide lock each is = used. The way those locks are acquired is, however, not providing any fairn= ess. Furthermore, with XSM/Flask in use, the lock acquire will, for some op= erations, occur ahead of any permission checking. The sysctl issue is CVE-2= 026-62426. The platform-op issue is CVE-2026-62427. 2026-07-28 not yet calc= ulated CVE-2026-62426 [ https://www.cve.org/CVERecord?id=3DCVE-2026-62426 ]=
Xen--Xen [This CNA information record relates to multiple CVEs; the text e= xplains which aspects/vulnerabilities correspond to which CVE.] To manage t=
he system, sysctl and platform operations are used by the control domain or=
a possible Xenstore domain. Some of these operations may not be executed i=
n parallel, so a system-wide lock each is used. The way those locks are acq= uired is, however, not providing any fairness. Furthermore, with XSM/Flask =
in use, the lock acquire will, for some operations, occur ahead of any perm= ission checking. The sysctl issue is CVE-2026-62426. The platform-op issue =
is CVE-2026-62427. 2026-07-28 not yet calculated CVE-2026-62427 [ https://w= ww.cve.org/CVERecord?id=3DCVE-2026-62427 ] Xen--Xen When grant-copy operati= ons are processed, the respective grant may or may not already be in use by=
another operation (a mapping or another copy). For all copy operations the=
referenced guest frame is looked up. When another operation is already act= ive for the grant (the grant is "pinned"), what is being supplied back to a= ctually carry out permission checks and copy operation may not be consisten=
t: The permission check may be carried out on a page different from the one=
involved in the copy. 2026-07-28 not yet calculated CVE-2026-62428 [ https= ://www.cve.org/CVERecord?id=3DCVE-2026-62428 ] Xen--Xen Accessing the vNUMA=
configuration data of a guest is still possible when domain destruction ha=
s already started. The cleaning up of that configuration information is not=
synchronized with its retrieval by a device model controlling the guest. 2= 026-07-28 not yet calculated CVE-2026-62429 [ https://www.cve.org/CVERecord= ?id=3DCVE-2026-62429 ] Xen--Xen Accesses to the CMOS memory contents are do=
ne using an indirect IO port pair. Therefore Xen needs to cache the guest c= hosen index, and one of the usages of the index didn't take the necessary l= ocking to avoid concurrent changes. As a result, a guest could change the i= ndex after it being checked, causing a subsequent out-of-bound read access =
to the contents of an array. 2026-07-28 not yet calculated CVE-2026-62430 [=
https://www.cve.org/CVERecord?id=3DCVE-2026-62430 ] Xen--Xen The logic to = handle periodic Viridian STIMERs performs a division with an unchecked user= -controlled divisor value, that can be set to zero to cause a #DE fault. 20= 26-07-28 not yet calculated CVE-2026-62431 [ https://www.cve.org/CVERecord?= id=3DCVE-2026-62431 ] Xen--Xen The EVTCHNOP_expand_array hypercall checks f=
or whether FIFO event channels are enabled, but without holding the correct=
lock. It can race with EVTCHNOP_reset, resulting in dereferencing a NULL p= ointer. 2026-07-28 not yet calculated CVE-2026-62432 [ https://www.cve.org/= CVERecord?id=3DCVE-2026-62432 ] Xen--Xen Parts of the DM_OP handling code a= ssumes the caller has provided the required number of buffers for the given=
operation without any checking being done. As a result, certain operations=
might access stack rubble as structures are possibly uninitialized. 2026-0= 7-28 not yet calculated CVE-2026-62433 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-62433 ] Xen--Xen A guest started with Populated on Demand enabl=
ed (PoD) can attempt to reclaim pages which aren't regular guest RAM. This = can cause corruption of memory management state in Xen. 2026-07-28 not yet = calculated CVE-2026-62434 [ https://www.cve.org/CVERecord?id=3DCVE-2026-624=
34 ] Xen--Xen [This CNA information record relates to multiple CVEs; the te=
xt explains which aspects/vulnerabilities correspond to which CVE.] With th=
e introduction of Grant Table v2 came the requirement to be able to switch = between versions. Switching from v1 to v2 reduces the number of valid grant=
references, as a bigger shared entry structure is then needed while the sh= ared table doesn't change size. Switching from v2 back to v1 the status fra= mes, which are separate in v2, go away. Code holding, but intermediately dr= opping and then re-acquiring the grant table lock, sometimes wrongly assume=
s that said properties wouldn't change across the window in time where the = lock is not being held. The v1 -> v2 issue is CVE-2026-62435. The v2 -> v1 = issue is CVE-2026-62436. 2026-07-28 not yet calculated CVE-2026-62435 [ htt= ps://www.cve.org/CVERecord?id=3DCVE-2026-62435 ] Xen--Xen [This CNA informa= tion record relates to multiple CVEs; the text explains which aspects/vulne= rabilities correspond to which CVE.] With the introduction of Grant Table v=
2 came the requirement to be able to switch between versions. Switching fro=
m v1 to v2 reduces the number of valid grant references, as a bigger shared=
entry structure is then needed while the shared table doesn't change size.=
Switching from v2 back to v1 the status frames, which are separate in v2, =
go away. Code holding, but intermediately dropping and then re-acquiring th=
e grant table lock, sometimes wrongly assumes that said properties wouldn't=
change across the window in time where the lock is not being held. The v1 =

v2 issue is CVE-2026-62435. The v2 -> v1 issue is CVE-2026-62436. 2026-0=

7-28 not yet calculated CVE-2026-62436 [ https://www.cve.org/CVERecord?id= =3DCVE-2026-62436 ] XMLRPC-C--XMLRPC-C XMLRPC-C Library versions 1.07 throu=
gh 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnera= bility in the error page component. 2026-07-27 not yet calculated CVE-2026-= 15928 [ https://www.cve.org/CVERecord?id=3DCVE-2026-15928 ] xxl-job--xxl-jo=
b v3.4.0 A Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/= trigger component of xxl-job v3.4.0 allows authenticated attackers to scan = resources via supplying a crafted HTTP request. 2026-07-31 not yet calculat=
ed CVE-2026-52371 [ https://www.cve.org/CVERecord?id=3DCVE-2026-52371 ] YOP=
Poll--YOP Poll The YOP Poll WordPress plugin before 7.0.6 does not validat=
e the connection's origin IP address and instead trusts client-controlled f= orwarding headers when enforcing its per-IP vote restriction, allowing unau= thenticated attackers to bypass the vote limit and cast unlimited votes on =
a public poll. 2026-08-01 not yet calculated CVE-2026-14840 [ https://www.c= ve.org/CVERecord?id=3DCVE-2026-14840 ] zitadel--zitadel ZITADEL is an open = source identity management platform. From 2.43.0 through 2.71.19, from 3.0.=
0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone self-manag= ement API paths in internal/command/user_v2_email.go, internal/command/user= _v2_phone.go, and internal/command/user_v2_human.go allowed users to reques=
t returned verification codes without the required permission, allowing use=
rs to claim ownership of email addresses or phone numbers they do not contr=
ol and bypass email-based or phone-based security policies. This issue is f= ixed in versions 3.4.11 and 4.15.1. 2026-07-29 not yet calculated CVE-2026-= 54693 [ https://www.cve.org/CVERecord?id=3DCVE-2026-54693 ] =C2=A0libiec618= 50--libiec61850 v1.6 An issue in the parseGoosePayload() function (/goose/g= oose_receiver.c) of libiec61850 v1.6 allows attackers to bypass authenticat= ion via a captured GOOSE frame. 2026-07-31 not yet calculated CVE-2026-5213=
4 [ https://www.cve.org/CVERecord?id=3DCVE-2026-52134 ]=20

Back to top [ #top ]

body { font-size: 1em; font-family: Arial, Verdana, sans-serif; font-weight=
: normal; font-style: normal; color: #333333; }=20

Having trouble viewing this message?=C2=A0View it as a webpage [ https://co= ntent.govdelivery.com/accounts/USDHSCISA/bulletins/423638a ].=C2=A0 [ https= ://content.govdelivery.com/accounts/USDHS/bulletins/292141e ]

You are subscribed to updates from the Cybersecurity and Infrastructure Sec= urity Agency [ https://www.cisa.gov ] (CISA)
Manage Subscriptions [ https://public.govdelivery.com/accounts/USDHSCISA/su= bscriber/edit?preferences=3Dtrue#tab1 ]=C2=A0=C2=A0|=C2=A0=C2=A0Privacy Pol= icy [ https://www.cisa.gov/privacy-policy ]=C2=A0=C2=A0|=C2=A0 Help [ https= ://subscriberhelp.granicus.com/s/article/Subscriber-Help-Center ] [ https:/= /insights.govdelivery.com/Communications/Subscriber_Help_Center ]

Connect with CISA:=20
Facebook [ https://www.facebook.com/CISA ]=C2=A0 |=C2=A0 Twitter [ https://= twitter.com/CISAgov ]=C2=A0 |=C2=A0 Instagram [ https://Instagram.com/cisag=
ov ]=C2=A0 |=C2=A0 LinkedIn [ https://www.linkedin.com/company/cybersecurit= y-and-infrastructure-security-agency ]=C2=A0 |=C2=A0=C2=A0 YouTube [ https:= //www.youtube.com/channel/UCxyq9roe-npgzrVwbpoAy0A ]

________________________________________________________________________


This email was sent to cisa@toolazy.synchro.net using Granicus Communicatio=
ns Cloud, on behalf of: Cybersecurity and Infrastructure Security Agency = =C2=B7 707 17th St, Suite 4000 =C2=B7 Denver, CO 80202 GovDelivery logo [ h= ttps://granicus.com/solution/digital-communication-engagement/ ]=20
body .abe-column-block { min-height: 5px; } table.gd_combo_table img {margi= n-left:10px; margin-right:10px;} table.gd_combo_table div.govd_image_displa=
y img, table.gd_combo_table td.gd_combo_image_cell img {margin-left:0px; ma= rgin-right:0px;}

--===============5520073085980316267==
Content-Type: text/html; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns=3D"http://www.w3.org/1999/xhtml" xml:lang=3D"en" lang=3D"en"> <head>
<title> Vulnerability Summary for the Week of July 27, 2026
</title>


</head>
<body style=3D"">

<table width=3D"700" border=3D"0" cellspacing=3D"0" cellpadding=3D"0"=
align=3D"center">
<tr>
<td>

<!--[if (gte mso 9)|(IE)]>
<table style=3D"display:none"><tr><td><a name=3D"gd_top" id=3D"gd_top"></= a></td></tr></table>
<![endif]-->
<a name=3D"gd_top" id=3D"gd_top"></a>

=20



<p><img src=3D"https://content.govdelivery.com/attachments/fancy_images/U= SDHSCISA/2020/06/3486054/05152023-gov-delivery-banner-copy_original.png" al= t=3D"Cybersecurity and Infrastructure Security Agency (CISA)" title=3D"" wi= dth=3D"600" height=3D"100"></p>
<p>You are subscribed to Vulnerability Bulletins for Cybersecurity and In= frastructure Security Agency. This information has recently been updated an=
d is now available.</p>
<p>The CISA Vulnerability Bulletin provides a summary of new vulnerabilitie=
s that have been recorded in the past week. In some cases, the vulnerabilit= ies in the bulletin may not yet have assigned CVSS scores.</p> <p>Vulnerabilities are based on the=C2=A0<a href=3D"https://www.cve.org/" t= arget=3D"_blank" title=3D"Common Vulnerabilities and Exposures" class=3D"ex=
t" data-extlink=3D"" rel=3D"noopener">Common Vulnerabilities and Exposures<= /a>=C2=A0(CVE) vulnerability naming standard and are organized according to=
severity, determined by the=C2=A0<a href=3D"https://www.cve.org/about/rela= tedefforts" target=3D"_blank" title=3D"Common Vulnerability Scoring System"=
rel=3D"noopener">Common Vulnerability Scoring System</a>=C2=A0(CVSS) stand= ard. The division of high, medium, and low severities correspond to the fol= lowing scores:</p>


<strong>High</strong>: vulnerabilities with a CVSS base score of 7.0=E2=80= =9310.0</li>

<strong>Medium</strong>: vulnerabilities with a CVSS base score of 4.0=E2= =80=936.9</li>

<strong>Low</strong>: vulnerabilities with a CVSS base score of 0.0=E2=80= =933.9</li>
</ul>
<p>Entries may include additional information provided by organizations and=
efforts sponsored by CISA. This information may include identifying inform= ation, values, definitions, and related links. Patch information is provide=
d when available. Please note that some of the information in the bulletin =
is compiled from external, open-source reports and is not a direct result o=
f CISA analysis.</p>
<div class=3D"rss_item" style=3D"margin-bottom: 2em;">
<div class=3D"rss_title" style=3D"font-weight: bold; font-size: 120%; margi=
n: 0 0 0.3em; padding: 0;"><a href=3D"https://www.cisa.gov/news-events/bull= etins/sb26-215" target=3D"_blank" title=3D"Vulnerability Summary for the We=
ek of July 27, 2026" rel=3D"noopener">Vulnerability Summary for the Week of=
July 27, 2026</a></div>
<div class=3D"rss_pub_date" style=3D"font-size: 90%; font-style: italic; co= lor: #666666; margin: 0 0 0.3em; padding: 0;">08/03/2026 11:00 AM EDT</div> <div class=3D"rss_description" style=3D"margin: 0 0 0.3em; padding: 0;">

<div id=3D"high_v">
<h2 id=3D"high_v_title">High Vulnerabilities</h2>
<table class=3D"table no-tablesaw" style=3D"table-layout: fixed; width: 100= %;" border=3D"1" summary=3D"High Vulnerabilities">
<thead>

<th class=3D"vendor-product" style=3D"width: 24%;" scope=3D"col">
<span class=3D"primary-vendor">Primary</span><br><span class=3D"primary-ven= dor">Vendor</span> -- Product</th>
<th style=3D"width: 44%;" scope=3D"col">Description</th>
<th style=3D"width: 10%;" scope=3D"col">Published</th>
<th style=3D"width: 8%;" scope=3D"col">CVSS Score</th>
<th style=3D"width: 7%;" scope=3D"col">Source Info</th>
</tr>
</thead>
<tbody>

<td class=3D"vendor-product">@fastify/rate-limit--@fastify/rate-limit</td> <td>@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbat=
im client IP string returned from request.ip. Because a single IPv6 client = can control a large address range (a /64 holds 2^64 distinct addresses) and=
the same address has multiple valid textual representations, an IPv6 capab=
le client can defeat the rate-limit boundary by rotating addresses or by re= writing the same address in different forms. Applications that use @fastify= /rate-limit to protect endpoints such as authentication, password reset, OT=
P delivery, or expensive API calls can be bypassed by IPv6 clients behind a=
proxy that surfaces IPv6 to the origin when trustProxy is enabled. The iss=
ue is fixed in @fastify/rate-limit 11.2.0, where the default key generator = normalizes IPv6 addresses to their canonical form, collapses IPv4 mapped IP=
v6 to IPv4, and applies a configurable prefix mask (default /64) via a new = ipv6Subnet option.</td>
<td>2026-07-29</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15144" target=3D= "_blank" rel=3D"noopener">CVE-2026-15144</a></td>
</tr>

<td class=3D"vendor-product">acacode--swagger-typescript-api</td> <td>swagger-typescript-api generates API clients for Fetch or Axios from an=
OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios= -http-client.ejs interpolates servers[0].url from src/code-gen-process.ts i= nto the HttpClient constructor without escaping, allowing an attacker-contr= olled OpenAPI spec to inject code that executes when new HttpClient() or ne=
w Api() is constructed. This issue is fixed in version 13.12.2.</td> <td>2026-07-29</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54661" target=3D= "_blank" rel=3D"noopener">CVE-2026-54661</a></td>
</tr>

<td class=3D"vendor-product">acacode--swagger-typescript-api</td> <td>swagger-typescript-api generates API clients for Fetch or Axios from Op= enAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiCo= nfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-= clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the gener= ated HttpClient baseUrl field without escaping, allowing an attacker-contro= lled OpenAPI spec to inject TypeScript static field code that executes when=
the generated fetch client module is imported. This issue is fixed in vers= ion 13.12.2.</td>
<td>2026-07-29</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54662" target=3D= "_blank" rel=3D"noopener">CVE-2026-54662</a></td>
</tr>

<td class=3D"vendor-product">acacode--swagger-typescript-api</td> <td>swagger-typescript-api generates API clients for Fetch or Axios from an=
OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-par= sers/enum.ts passes components.schemas.*.enum[i] values to Ts.StringValue i=
n src/configuration.ts without escaping before templates/base/enum-data-con= tract.ejs renders TypeScript enum declarations, allowing an attacker-contro= lled OpenAPI spec to inject code that executes when the generated module is=
imported. This issue is fixed in version 13.12.2.</td>
<td>2026-07-29</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54664" target=3D= "_blank" rel=3D"noopener">CVE-2026-54664</a></td>
</tr>

<td class=3D"vendor-product">acacode--swagger-typescript-api</td> <td>swagger-typescript-api generates API clients for Fetch or Axios from an=
OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.t=
s passes OpenAPI path keys through parseRouteName to templates/default/proc= edure-call.ejs and templates/modular/procedure-call.ejs without escaping Ja= vaScript template literal interpolation, allowing an attacker-controlled pa=
th containing ${...} to execute when the generated method is called. This i= ssue is fixed in version 13.12.2.</td>
<td>2026-07-29</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54666" target=3D= "_blank" rel=3D"noopener">CVE-2026-54666</a></td>
</tr>

<td class=3D"vendor-product">acacode--swagger-typescript-api</td> <td>swagger-typescript-api generates API clients for Fetch or Axios from Op= enAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getR= emoteRequestHeaders forwards --authorizationToken to every URL fetched by f= etchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $= ref URLs, allowing an attacker-controlled OpenAPI spec to exfiltrate the de= veloper or CI bearer token to a cross-origin endpoint. This issue is fixed =
in version 13.12.2.</td>
<td>2026-07-29</td>
<td>7.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54660" target=3D= "_blank" rel=3D"noopener">CVE-2026-54660</a></td>
</tr>

<td class=3D"vendor-product">acowebs--Dynamic Pricing With Discount Rules f=
or WooCommerce</td>
<td>Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Disc= ount Rules for WooCommerce &lt;=3D 4.5.11 versions.</td>
<td>2026-07-27</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59556" target=3D= "_blank" rel=3D"noopener">CVE-2026-59556</a></td>
</tr>

<td class=3D"vendor-product">Adobe--Adobe Bridge</td>
<td>Bridge is affected by an Incorrect Authorization vulnerability that cou=
ld result in privilege escalation. An attacker could leverage this vulnerab= ility to gain unauthorized read and write access. Exploitation of this issu=
e requires user interaction in that a victim must open a malicious file. Sc= ope is changed.</td>
<td>2026-07-28</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48390" target=3D= "_blank" rel=3D"noopener">CVE-2026-48390</a></td>
</tr>

<td class=3D"vendor-product">Adobe--Adobe Bridge</td>
<td>Bridge is affected by an Untrusted Search Path vulnerability that could=
result in arbitrary code execution in the context of the current user. A l= ow-privileged attacker could exploit this vulnerability to execute arbitrar=
y code. Exploitation of this issue requires user interaction in that a vict=
im must open a malicious file. Scope is changed.</td>
<td>2026-07-28</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48391" target=3D= "_blank" rel=3D"noopener">CVE-2026-48391</a></td>
</tr>

<td class=3D"vendor-product">Adobe--Adobe Bridge</td>
<td>Bridge is affected by an Untrusted Search Path vulnerability that could=
result in arbitrary code execution in the context of the current user. An = attacker could exploit this vulnerability to execute arbitrary code. Exploi= tation of this issue requires user interaction in that a victim must open a=
malicious file. Scope is changed.</td>
<td>2026-07-28</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48395" target=3D= "_blank" rel=3D"noopener">CVE-2026-48395</a></td>
</tr>

<td class=3D"vendor-product">Adobe--Adobe Bridge</td>
<td>Bridge is affected by an Incorrect Authorization vulnerability that cou=
ld result in arbitrary code execution in the context of the current user. A=
n attacker could exploit this vulnerability to execute arbitrary code. Expl= oitation of this issue requires user interaction in that a victim must open=
a malicious file. Scope is changed.</td>
<td>2026-07-28</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48396" target=3D= "_blank" rel=3D"noopener">CVE-2026-48396</a></td>
</tr>

<td class=3D"vendor-product">Adobe--Adobe Bridge</td>
<td>Bridge is affected by an Improper Limitation of a Pathname to a Restric= ted Directory ('Path Traversal') vulnerability that could lead to arbitrary=
file system read. An attacker could exploit this vulnerability to access s= ensitive files and directories outside the intended access scope. Exploitat= ion of this issue requires user interaction in that a victim must open a ma= licious file.</td>
<td>2026-07-28</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48374" target=3D= "_blank" rel=3D"noopener">CVE-2026-48374</a></td>
</tr>

<td class=3D"vendor-product">Adobe--Adobe Bridge</td>
<td>Bridge is affected by an out-of-bounds write vulnerability that could r= esult in arbitrary code execution in the context of the current user. Explo= itation of this issue requires user interaction in that a victim must open =
a malicious file.</td>
<td>2026-07-28</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48392" target=3D= "_blank" rel=3D"noopener">CVE-2026-48392</a></td>
</tr>

<td class=3D"vendor-product">Adobe--Adobe Bridge</td>
<td>Bridge is affected by an out-of-bounds write vulnerability that could r= esult in arbitrary code execution in the context of the current user. Explo= itation of this issue requires user interaction in that a victim must open =
a malicious file.</td>
<td>2026-07-28</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48393" target=3D= "_blank" rel=3D"noopener">CVE-2026-48393</a></td>
</tr>

<td class=3D"vendor-product">Adobe--Adobe Bridge</td>
<td>Bridge is affected by an out-of-bounds write vulnerability that could r= esult in arbitrary code execution in the context of the current user. Explo= itation of this issue requires user interaction in that a victim must open =
a malicious file.</td>
<td>2026-07-28</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48394" target=3D= "_blank" rel=3D"noopener">CVE-2026-48394</a></td>
</tr>

<td class=3D"vendor-product">Adobe--Adobe Campaign Classic</td>
<td>Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization = vulnerability that could result in arbitrary code execution in the context =
of the current user. Exploitation of this issue does not require user inter= action. Scope is changed.</td>
<td>2026-07-30</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48449" target=3D= "_blank" rel=3D"noopener">CVE-2026-48449</a></td>
</tr>

<td class=3D"vendor-product">Adobe--Adobe Campaign Classic</td>
<td>Adobe Campaign Classic (ACC) is affected by an Improper Neutralization =
of Special Elements used in an SQL Command ('SQL Injection') vulnerability = that could lead to disclosure of sensitive memory. An attacker could levera=
ge this vulnerability to gain file system read access. Exploitation of this=
issue does not require user interaction. Scope is changed.</td>

<td>2026-07-30</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48448" target=3D= "_blank" rel=3D"noopener">CVE-2026-48448</a></td>
</tr>

<td class=3D"vendor-product">Adobe--Adobe Photoshop Installer</td>
<td>Adobe Photoshop Installer was affected by an Uncontrolled Search Path E= lement vulnerability that could have resulted in arbitrary code execution i=
n the context of the current user. An attacker could have exploited this vu= lnerability by placing a malicious library in a directory searched by the i= nstaller. Exploitation of this issue required user interaction in that a vi= ctim must have been running the installer. Scope is changed.</td> <td>2026-07-28</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48388" target=3D= "_blank" rel=3D"noopener">CVE-2026-48388</a></td>
</tr>

<td class=3D"vendor-product">Adobe--Format Plugins</td>
<td>Format Plugins is affected by a Heap-based Buffer Overflow vulnerabilit=
y that could result in arbitrary code execution in the context of the curre=
nt user. Exploitation of this issue requires user interaction in that a vic= tim must open a malicious file.</td>
<td>2026-07-28</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48372" target=3D= "_blank" rel=3D"noopener">CVE-2026-48372</a></td>
</tr>

<td class=3D"vendor-product">Adobe--Premiere</td>
<td>Premiere Pro is affected by an out-of-bounds write vulnerability that c= ould result in arbitrary code execution in the context of the current user.=
Exploitation of this issue requires user interaction in that a victim must=
open a malicious file.</td>
<td>2026-07-31</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34641" target=3D= "_blank" rel=3D"noopener">CVE-2026-34641</a></td>
</tr>

<td class=3D"vendor-product">ads-tec Industrial IT--DVG-IRF1401</td>
<td>A low privileged remote attacker can perform privileged configuration c= hanges reserved for the administrator level including permission management=
due to incorrect authorization.</td>
<td>2026-07-28</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14167" target=3D= "_blank" rel=3D"noopener">CVE-2026-14167</a></td>
</tr>

<td class=3D"vendor-product">ads-tec Industrial IT--DVG-IRF1401</td>
<td>A low privileged remote attacker can gain administrator privileges due =
to missing authorization at the insert path of the configuration table resu= lting in gaining full system access.</td>
<td>2026-07-28</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14168" target=3D= "_blank" rel=3D"noopener">CVE-2026-14168</a></td>
</tr>

<td class=3D"vendor-product">ads-tec Industrial IT--DVG-IRF1401</td>
<td>Due to incorrect behavior order a low privileged remote attacker could = trigger account inconsistent state via crafted input and overwrites existin=
g user passwords which could result in complete administrative unavailabili=
ty of the device.</td>
<td>2026-07-28</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14169" target=3D= "_blank" rel=3D"noopener">CVE-2026-14169</a></td>
</tr>

<td class=3D"vendor-product">An unrestricted SCORM file upload vulnerabilit=
y in Koollab LMS allowed an authenticated module designer to upload a SCORM=
package containing a PHP webshell to a publicly accessible directory and e= xecute arbitrary code on the server.--Koollab LMS</td>
<td>An unrestricted SCORM file upload vulnerability in Koollab LMS allowed =
an authenticated module designer to upload a SCORM package containing a PHP=
webshell to a publicly accessible directory and execute arbitrary code on = the server.</td>
<td>2026-07-29</td>
<td>9.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63227" target=3D= "_blank" rel=3D"noopener">CVE-2026-63227</a></td>
</tr>

<td class=3D"vendor-product">Anchore--Anchore Enterprise</td>
<td>Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an = improper privilege escalation vulnerability in the user management API. An = authenticated attacker who is able to access the Anchore Enterprise API cou=
ld issue an API call capable of modifying user permissions to gain access t=
o additional resources and operations. It is not possible to grant the syst= em-admin role, but a read only user could be granted write access. This iss=
ue is fixed in Anchore Enterprise 5.27.2 and 6.0.1.</td>
<td>2026-07-28</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63727" target=3D= "_blank" rel=3D"noopener">CVE-2026-63727</a></td>
</tr>

<td class=3D"vendor-product">ANDRITZ--HIPASE-250</td>
<td>A provisioning script used when installing HIPASE-250 (formerly 250 SCA= LA) engineering workstations sets a fixed, hard-coded x11vnc password. Beca= use the same credential is applied to every workstation provisioned this wa=
y, an attacker with adjacent-network access who knows the password can gain=
VNC access to affected workstations.</td>
<td>2026-07-31</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65313" target=3D= "_blank" rel=3D"noopener">CVE-2026-65313</a></td>
</tr>

<td class=3D"vendor-product">ANDRITZ--HIPASE-250</td>
<td>ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and=
transmits user passwords using a reversible format instead of a one-way pa= ssword hash. This allows an attacker able to read the credential store or c= apture network traffic to recover all stored passwords.</td> <td>2026-07-31</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65309" target=3D= "_blank" rel=3D"noopener">CVE-2026-65309</a></td>
</tr>

<td class=3D"vendor-product">ANDRITZ--HIPASE-250</td>
<td>ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration o=
f affected versions, exposes its data and configuration endpoint without an=
y authentication and permissive CORS on every response. An unauthenticated = attacker with network access can read live process values and server config= uration.</td>
<td>2026-07-31</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65310" target=3D= "_blank" rel=3D"noopener">CVE-2026-65310</a></td>
</tr>

<td class=3D"vendor-product">Anh Tran--Falcon WordPress Optimizations &amp;=
Tweaks</td>
<td>Unauthenticated Unknown in Falcon - WordPress Optimizations &amp; Tweak=
s &lt;=3D 2.10.0 versions.</td>
<td>2026-07-27</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59531" target=3D= "_blank" rel=3D"noopener">CVE-2026-59531</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Thrift</td> <td>Improper Handling of Highly Compressed Data (Data Amplification) vulner= ability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: b= efore 0.24.0. Users are recommended to upgrade to version 0.24.0, which fix=
es the issue.</td>
<td>2026-07-27</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-49158" target=3D= "_blank" rel=3D"noopener">CVE-2026-49158</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Improper Input Validation vulnerability in Apache Traffic Server. This = issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0=
through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1= .4, which fixes the issue.</td>
<td>2026-07-29</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-33267" target=3D= "_blank" rel=3D"noopener">CVE-2026-33267</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Apache Traffic Server allows request smuggling if chunked messages are = malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1= .9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recomm= ended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.</td> <td>2026-07-29</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57834" target=3D= "_blank" rel=3D"noopener">CVE-2026-57834</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 reque= sts, allowing downgrade request smuggling. This issue affects Apache Traffi=
c Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 = through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.=
4, which fix the issue.</td>
<td>2026-07-29</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58150" target=3D= "_blank" rel=3D"noopener">CVE-2026-58150</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>The Apache Traffic Server certifier plugin generates certificates based=
on attacker-controlled client SNI. This issue affects Apache Traffic Serve=
r: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through=
10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, whic=
h fix the issue.</td>
<td>2026-07-29</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58162" target=3D= "_blank" rel=3D"noopener">CVE-2026-58162</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Improper Access Control vulnerability in Apache Traffic Server. This is= sue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 t= hrough 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4=
, which fixes the issue.</td>
<td>2026-07-29</td>
<td>9.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-41920" target=3D= "_blank" rel=3D"noopener">CVE-2026-41920</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Apache Traffic Server truncates over-long header names, allowing header=
aliasing, request smuggling, and policy bypass. This issue affects Apache = Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 1= 0.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or=
10.1.4, which fix the issue.</td>
<td>2026-07-29</td>
<td>9.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58155" target=3D= "_blank" rel=3D"noopener">CVE-2026-58155</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Regular Expression without Anchors vulnerability in Apache Traffic Serv= er. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, f= rom 9.0.X through 9.2.14. Users are recommended to upgrade to version 9.2.1=
5 or 10.1.4, which fixes the issue.</td>
<td>2026-07-29</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-22068" target=3D= "_blank" rel=3D"noopener">CVE-2026-22068</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients=
without proper chunked framing when converting HTTP/2 to HTTP/1. This issu=
e affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are reco= mmended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.</td> <td>2026-07-29</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58153" target=3D= "_blank" rel=3D"noopener">CVE-2026-58153</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Apache Traffic Server can write out of bounds or overflow integers whil=
e parsing MIME and HTTP headers. This issue affects Apache Traffic Server: = from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10= .1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which f=
ix the issue.</td>
<td>2026-07-29</td>
<td>8.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58154" target=3D= "_blank" rel=3D"noopener">CVE-2026-58154</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Apache Traffic Server can reuse server sessions and tunnels improperly,=
exposing data across client connections. This issue affects Apache Traffic=
Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 t= hrough 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4=
, which fix the issue.</td>
<td>2026-07-29</td>
<td>8.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58157" target=3D= "_blank" rel=3D"noopener">CVE-2026-58157</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Apache Traffic Server can bypass IP access controls on UDS listeners an=
d through ACL matching errors. This issue affects Apache Traffic Server: fr=
om 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1= .3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix=
the issue.</td>
<td>2026-07-29</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58159" target=3D= "_blank" rel=3D"noopener">CVE-2026-58159</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>The Apache Traffic Server Cripts framework has out-of-bounds writes, pa=
th traversal, and use-after-free errors. This issue affects Apache Traffic = Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to ver= sion 10.1.4, which fix the issue.</td>
<td>2026-07-29</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58177" target=3D= "_blank" rel=3D"noopener">CVE-2026-58177</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>The Apache Traffic Server regex_remap plugin overflows the stack and in= tegers from substitution input. This issue affects Apache Traffic Server: f= rom 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.= 1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi=
x the issue.</td>
<td>2026-07-29</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58179" target=3D= "_blank" rel=3D"noopener">CVE-2026-58179</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>The Apache Traffic Server ts_lua plugin mishandles initialization, tran= sform context, and per-instance state. This issue affects Apache Traffic Se= rver: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 thro= ugh 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, w= hich fix the issue.</td>
<td>2026-07-29</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58182" target=3D= "_blank" rel=3D"noopener">CVE-2026-58182</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>The Apache Traffic Server header_rewrite plugin can crash or corrupt me= mory during cookie operations and CIDR condition matching. This issue affec=
ts Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.= 14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version=
9.2.15 or 10.1.4, which fix the issue.</td>
<td>2026-07-29</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58184" target=3D= "_blank" rel=3D"noopener">CVE-2026-58184</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Several Apache Traffic Server experimental plugins have memory-safety a=
nd limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.=
0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Use=
rs are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the is= sue.</td>
<td>2026-07-29</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58188" target=3D= "_blank" rel=3D"noopener">CVE-2026-58188</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Sm= uggling') vulnerability in Apache Traffic Server. This issue affects Apache=
Traffic Server: from 10.0.0 through 10.1.3, from 9.0.0 through 9.2.14. Use=
rs are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the = issue.</td>
<td>2026-07-29</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-24033" target=3D= "_blank" rel=3D"noopener">CVE-2026-24033</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Apache Traffic Server can be crashed or driven to resource exhaustion b=
y abusive HTTP/2 framing and flow-control. This issue affects Apache Traffi=
c Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 = through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.=
4, which fix the issue.</td>
<td>2026-07-29</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58151" target=3D= "_blank" rel=3D"noopener">CVE-2026-58151</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Apache Traffic Server can crash from null dereferences and dangling ref= erences in TLS and SNI handling. This issue affects Apache Traffic Server: = from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10= .1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which f=
ix the issue.</td>
<td>2026-07-29</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58161" target=3D= "_blank" rel=3D"noopener">CVE-2026-58161</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Apache Traffic Server mishandles on-disk cache fields and object lifeti= mes, corrupting state or crashing. This issue affects Apache Traffic Server=
: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through = 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which=
fix the issue.</td>
<td>2026-07-29</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58163" target=3D= "_blank" rel=3D"noopener">CVE-2026-58163</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Apache Traffic Server has use-after-free and time-of-check/time-of-use = errors in remap configuration handling. This issue affects Apache Traffic S= erver: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 thr= ough 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, = which fix the issue.</td>
<td>2026-07-29</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58164" target=3D= "_blank" rel=3D"noopener">CVE-2026-58164</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Apache Traffic Server leaks memory when handling HostDB SRV records. Th=
is issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.=
0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgr= ade to version 9.2.15 or 10.1.4, which fix the issue.</td>
<td>2026-07-29</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58175" target=3D= "_blank" rel=3D"noopener">CVE-2026-58175</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>The Apache Traffic Server ESI plugin can recurse without bound and fetc=
h attacker-controlled URLs. This issue affects Apache Traffic Server: from = 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.=
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix th=
e issue.</td>
<td>2026-07-29</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58178" target=3D= "_blank" rel=3D"noopener">CVE-2026-58178</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>The Apache Traffic Server txn_box plugin overflows the stack from attac= ker-controlled input. This issue affects Apache Traffic Server: from 8.0.0 = through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users=
are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issu= e.</td>
<td>2026-07-29</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58180" target=3D= "_blank" rel=3D"noopener">CVE-2026-58180</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>The Apache Traffic Server uri_signing and url_sig plugins can exhaust t=
he stack or crash on attacker input. This issue affects Apache Traffic Serv= er: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 throug=
h 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, whi=
ch fix the issue.</td>
<td>2026-07-29</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58181" target=3D= "_blank" rel=3D"noopener">CVE-2026-58181</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>The Apache Traffic Server webp_transform plugin can decode unsafely and=
serve mislabeled, cacheable responses. This issue affects Apache Traffic S= erver: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 thr= ough 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, = which fix the issue.</td>
<td>2026-07-29</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58186" target=3D= "_blank" rel=3D"noopener">CVE-2026-58186</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Apache Traffic Server allows redirect-limit bypass when plugins reset t=
he retry counter, enabling SSRF amplification. This issue affects Apache Tr= affic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.= 0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 1= 0.1.4, which fix the issue.</td>
<td>2026-07-29</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58189" target=3D= "_blank" rel=3D"noopener">CVE-2026-58189</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Apache Traffic Server drops the per-stream buffer cap when dechunking H= TTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. Thi=
s issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0=
through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgra=
de to version 9.2.15 or 10.1.4, which fix the issue.</td>
<td>2026-07-29</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65324" target=3D= "_blank" rel=3D"noopener">CVE-2026-65324</a></td>
</tr>

<td class=3D"vendor-product">appium--java-client</td>
<td>Appium Java Client is the Java language binding for writing Appium test=
s that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when=
directConnect(true) is enabled, AppiumCommandExecutor.setDirectConnect() r= eads the directConnectHost, directConnectPort, and directConnectPath fields=
from the server's NEW_SESSION response and rebuilds the client's server UR=
L from them, validating only that the protocol is https, with no host allow= list or IP validation; a rogue or compromised server can therefore redirect=
all subsequent session traffic to an arbitrary destination, enabling full = interception of session traffic and a server-side request forgery pivot to = internal hosts, including cloud metadata (IMDS) credential theft. This vuln= erability is fixed in 10.1.1.</td>
<td>2026-07-28</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43910" target=3D= "_blank" rel=3D"noopener">CVE-2026-43910</a></td>
</tr>

<td class=3D"vendor-product">ArcadeData--arcadedb</td>
<td>ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look=
up host classes in java.lang.* (via Java.type) because ScriptTriggerExecut=
or adds java.lang.* to the allowed packages. An authenticated user with UPD= ATE_SCHEMA permission can create a JavaScript trigger that invokes java.lan= g.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command exe= cution when the trigger fires.</td>
<td>2026-08-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67340" target=3D= "_blank" rel=3D"noopener">CVE-2026-67340</a></td>
</tr>

<td class=3D"vendor-product">ArcadeData--arcadedb</td>
<td>ArcadeDB versions before 26.7.2 fail to enforce scripting authorization=
checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers wi=
th database access can execute arbitrary JavaScript code by submitting DEFI=
NE FUNCTION statements, bypassing security controls intended to restrict sc= ripting to administrators.</td>
<td>2026-08-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67341" target=3D= "_blank" rel=3D"noopener">CVE-2026-67341</a></td>
</tr>

<td class=3D"vendor-product">ArcadeData--arcadedb</td>
<td>ArcadeDB versions before 26.7.2 contain an authorization bypass vulnera= bility in HTTP handlers for time series, batch, Prometheus, and Grafana end= points that fail to validate database access permissions. Attackers can acc= ess and modify databases they are not authorized to use by directly calling=
affected endpoints with arbitrary database parameters.</td> <td>2026-08-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67342" target=3D= "_blank" rel=3D"noopener">CVE-2026-67342</a></td>
</tr>

<td class=3D"vendor-product">ArcadeData--arcadedb</td>
<td>ArcadeDB versions before 26.7.2 fail to properly redact the cluster tok=
en in the GET /api/v1/server endpoint, allowing authenticated users to retr= ieve the arcadedb.ha.clusterToken value in cleartext. Attackers can use the=
leaked token with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User h= eaders to impersonate root and execute administrative actions including use=
r creation, database operations, and server shutdown.</td>
<td>2026-08-01</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67343" target=3D= "_blank" rel=3D"noopener">CVE-2026-67343</a></td>
</tr>

<td class=3D"vendor-product">ArcadeData--arcadedb</td>
<td>ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScr= ipt trigger contexts with HostAccess.ALL, allowing schema-admins to call ge= tSecurity().createUser() without permission checks. Attackers with UPDATE_S= CHEMA permission can create triggers that execute JavaScript to create serv= er-wide admin users, escalating privileges beyond their authorization level= .</td>
<td>2026-08-02</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67356" target=3D= "_blank" rel=3D"noopener">CVE-2026-67356</a></td>
</tr>

<td class=3D"vendor-product">ArcadeData--arcadedb</td>
<td>ArcadeDB versions before 26.7.3 contain an information disclosure vulne= rability in the MCP get_server_settings tool that leaks the arcadedb.ha.clu= sterToken in cleartext. Attackers with MCP access can retrieve the cluster = token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-Use=
r headers to impersonate root and achieve full server compromise.</td> <td>2026-08-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67357" target=3D= "_blank" rel=3D"noopener">CVE-2026-67357</a></td>
</tr>

<td class=3D"vendor-product">ArcadeData--arcadedb</td>
<td>ArcadeDB versions before 26.7.3 fail to bind the authenticated principa=
l in the MCP HTTP transport, causing all engine permission checks to silent=
ly pass as no-ops. Non-root MCP-allowed users can perform arbitrary databas=
e writes, DDL, schema mutations, and execute arbitrary JavaScript code via = the query tool.</td>
<td>2026-08-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-68578" target=3D= "_blank" rel=3D"noopener">CVE-2026-68578</a></td>
</tr>

<td class=3D"vendor-product">Arista Networks--VeloCloud Orchestrator On-Pre= m</td>
<td>VeloCloud Orchestrator (VCO) on-prem has a security issue where this is= sue may allow a remote attacker to access privileged internal functionality=
and impact the VCO host. Successful exploitation may compromise the confid= entiality, integrity, and availability of the orchestrator and data managed=
by the orchestrator. This functionality was intended to be for internal us=
e only and is not intended to be remotely accessible. Hosted and Dedicated = versions of VCO have already been patched in advance of this notice going o= ut. This issue was discovered externally and is known to be actively exploi= ted.</td>
<td>2026-07-27</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16812" target=3D= "_blank" rel=3D"noopener">CVE-2026-16812</a></td>
</tr>

<td class=3D"vendor-product">Arista Networks--VeloCloud Orchestrator On-Pre= m</td>
<td>An input validation vulnerability exists in an API component of the orc= hestrator. An authenticated user can exploit this flaw to manipulate backen=
d queries, which may result in unauthorized access to data beyond their int= ended privileges and cause the underlying system to initiate unintended out= bound network connections. This issue was discovered internally by Arista a=
nd the company is not aware of any malicious uses of this issue in customer=
networks.</td>
<td>2026-07-27</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17191" target=3D= "_blank" rel=3D"noopener">CVE-2026-17191</a></td>
</tr>

<td class=3D"vendor-product">Arista Networks--VeloCloud Orchestrator On-Pre= m</td>
<td>A VCO feature does not sufficiently validate caller-supplied input, all= owing requests to be made on behalf of authenticated tenant accounts to int= ernal services that are not otherwise accessible. This vulnerability requir=
es a minimum role of Enterprise Standard Admin. This issue was discovered i= nternally by Arista and the company is not aware of any malicious uses of t= his issue in customer networks.</td>
<td>2026-07-27</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17192" target=3D= "_blank" rel=3D"noopener">CVE-2026-17192</a></td>
</tr>

<td class=3D"vendor-product">ArkSigner Software and Hardware Industry and T= rade Inc.--ArkSigner Desktop Client</td>
<td>Uncontrolled Search Path Element vulnerability in ArkSigner Software an=
d Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search O= rder Hijacking. This issue affects ArkSigner Desktop Client: from v2.2.16.1=
0 through 17062026.</td>
<td>2026-07-28</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8164" target=3D"= _blank" rel=3D"noopener">CVE-2026-8164</a></td>
</tr>

<td class=3D"vendor-product">ArticaTech--Artica Proxy</td>
<td>Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 2026072= 4-02) contains a session fixation vulnerability that allows unauthenticated=
attackers to hijack administrative sessions by setting a known PHPSESSID o=
n a victim's browser prior to authentication. Attackers can pre-set a contr= olled session identifier and wait for a victim to authenticate through fw.l= ogin.php, after which the attacker gains a fully authenticated administrati=
ve session on port 9000.</td>
<td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66745" target=3D= "_blank" rel=3D"noopener">CVE-2026-66745</a></td>
</tr>

<td class=3D"vendor-product">ASE--Admin and Site Enhancements (ASE) Pro</td=

<td>The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulne= rable to Remote Code Execution in all versions up to, and including, 8.9.0 = via the recursive_html function. This is due to the frontend save handler e= nforces only a publicly emitted nonce with no authentication check, CAPTCHA=
validation is bypassable by omitting an attacker-supplied key, and repeate=
r row keys from cfgroup[input] are stored verbatim and later spliced into a=
n eval() call in recursive_html without any sanitization or identifier vali= dation. This makes it possible for unauthenticated attackers to execute cod=
e on the server. This requires the [post_cf_form] shortcode to be present o=
n at least one publicly accessible page, as the nonce and session ID needed=
to reach the vulnerable save handler are emitted to unauthenticated visito=
rs by that shortcode.</td>
<td>2026-07-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16610" target=3D= "_blank" rel=3D"noopener">CVE-2026-16610</a></td>
</tr>

<td class=3D"vendor-product">Aurovrata Venet--Post My CF7 Form</td> <td>Unauthenticated Broken Access Control in Post My CF7 Form &lt;=3D 6.2.0=
versions.</td>
<td>2026-07-27</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59534" target=3D= "_blank" rel=3D"noopener">CVE-2026-59534</a></td>
</tr>

<td class=3D"vendor-product">Autodesk--AutoCAD</td>
<td>A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, c=
an force a Heap-Based Overflow vulnerability. A malicious actor can leverag=
e this vulnerability to cause a crash, read sensitive data, or execute arbi= trary code in the context of the current process.</td>
<td>2026-07-29</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16463" target=3D= "_blank" rel=3D"noopener">CVE-2026-16463</a></td>
</tr>

<td class=3D"vendor-product">AWS--Amplify Codegen UI</td>
<td>Improper control of code generation in Amazon @aws-amplify/codegen-ui-r= eact before 2.20.6 might allow a remote authenticated user to execute arbit= rary code in end-user browsers, developer machines, CI/CD environments, and=
server-side rendering contexts via crafted Studio component or theme schem=
a values due to insufficient coverage and effectiveness of the input valida= tion introduced for CVE-2025-4318. To remediate this issue, users should up= grade to version=C2=A02.20.6</td>
<td>2026-07-30</td>
<td>9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18245" target=3D= "_blank" rel=3D"noopener">CVE-2026-18245</a></td>
</tr>

<td class=3D"vendor-product">AWS--AWS Ops Wheel</td>
<td>Stored cross-site scripting in the participant URL handling in AWS Ops = Wheel before PR #168 might allow an authenticated remote user to steal sess= ion tokens and escalate to full administrative control of the deployed inst= ance via a crafted participant_url value containing a dangerous URI scheme.=
To remediate this issue, users should redeploy from the latest version of = aws-ops-wheel.</td>
<td>2026-07-31</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18481" target=3D= "_blank" rel=3D"noopener">CVE-2026-18481</a></td>
</tr>

<td class=3D"vendor-product">AWS--aws-smithy-json</td>
<td>Uncontrolled recursion in the unknown-key skip path of the aws-smithy-j= son runtime crate before 0.62.7, which the smithy-rs code generator invokes=
from every generated struct deserializer, might allow remote unauthenticat=
ed users to cause a denial of service (process abort via stack exhaustion) = via a single small HTTP request containing deeply nested JSON to a smithy-r=
s generated server. To remediate this issue, users should upgrade to aws-sm= ithy-json 0.62.7 or later and rebuild.</td>
<td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18140" target=3D= "_blank" rel=3D"noopener">CVE-2026-18140</a></td>
</tr>

<td class=3D"vendor-product">AWS--Strands Agents Tools</td>
<td>Incorrect authorization in the http_request tool in Strands Agents Tool=
s before 0.8.2 might allow remote attackers to obtain credentials configure=
d via HTTP_REQUEST_TOKEN_CONFIG by influencing the LLM to route requests th= rough actor-controlled proxy infrastructure. To remediate this issue, users=
should upgrade to version 0.8.2.</td>
<td>2026-07-31</td>
<td>7.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18394" target=3D= "_blank" rel=3D"noopener">CVE-2026-18394</a></td>
</tr>

<td class=3D"vendor-product">bablilayoub--openhole</td>
<td>openhole exposes localhost to the internet in one command. In 0.1.1 and=
earlier, openhole-server in internal/server/public_proxy.go forwarded r.UR= L.Path instead of preserving the original request target with r.URL.Escaped= Path(), allowing percent encoded dot segments %2e and separators %2f to rea=
ch tunneled local services as ../ and / for path traversal. This issue is f= ixed in version 0.1.2.</td>
<td>2026-07-28</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54650" target=3D= "_blank" rel=3D"noopener">CVE-2026-54650</a></td>
</tr>

<td class=3D"vendor-product">bank-vaults--vault-secrets-webhook</td> <td>vault-secrets-webhook is a Kubernetes mutating webhook that makes direc=
t secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig() =
in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-ad=
dr annotation, MutateConfigMap and MutateSecret call newVaultClient in pkg/= webhook/webhook.go, and vault.security.banzaicloud.io/vault-serviceaccount = can cause a ServiceAccount JWT to be sent to an attacker-controlled Vault a= ddress. This issue is fixed in version 1.23.1.</td>
<td>2026-07-31</td>
<td>9.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54725" target=3D= "_blank" rel=3D"noopener">CVE-2026-54725</a></td>
</tr>

<td class=3D"vendor-product">better-auth--better-auth</td>
<td>Better Auth relies on better-call, which uses the rou3 router library. =
In affected versions of rou3, paths are normalized by removing empty segmen= ts, so /path, //path, and ///path resolve to the same route. In Better Auth=
versions prior to 1.4.5 (which bundles the fixed rou3), this can allow att= ackers to bypass disabledPaths configuration and path-based rate limits by = submitting requests with extra slashes in the URL path. The issue does not = apply in deployments where the proxy or platform normalizes URLs by collaps= ing multiple slashes.</td>
<td>2026-08-02</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71399" target=3D= "_blank" rel=3D"noopener">CVE-2025-71399</a></td>
</tr>

<td class=3D"vendor-product">better-auth--better-auth</td>
<td>better-auth versions &gt;=3D 1.1.3 and &lt; 1.6.22 (and pre-release ver= sions &gt;=3D 1.7.0-beta.0 and &lt; 1.7.0-beta.10) are vulnerable to accoun=
t takeover via pre-account hijacking on magic-link and email-OTP sign-in wh=
en open email/password registration is enabled. An attacker registers an ac= count with the victim's email address and an attacker-chosen password; the = account remains unverified. When the legitimate owner later signs in via th=
e magic-link or email-OTP passwordless flow, the account is marked verified=
without removing the pre-existing password or revoking existing sessions, =
so the attacker's password remains valid, granting persistent access to the=
victim's account. Fixed in 1.6.22 and 1.7.0-beta.10.</td>
<td>2026-08-01</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67327" target=3D= "_blank" rel=3D"noopener">CVE-2026-67327</a></td>
</tr>

<td class=3D"vendor-product">better-auth--better-auth</td>
<td>better-auth versions before 1.6.11 contain insecure cryptographic defau= lts in the oidcProvider and mcp plugins that advertise the none algorithm a=
nd accept plain PKCE by default. Attackers can exploit algorithm negotiatio=
n to accept unsigned tokens or intercept authorization codes when PKCE plai=
n is used instead of the required S256 method.</td>
<td>2026-08-01</td>
<td>8.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67336" target=3D= "_blank" rel=3D"noopener">CVE-2026-67336</a></td>
</tr>

<td class=3D"vendor-product">better-auth--better-auth</td>
<td>better-auth versions before 1.1.20 contain a bypass vulnerability in tr= ustedOrigins validation logic affecting absolute URLs and wildcard domains.=
Attackers can construct malicious callbackURL parameters that pass origin = checks and trigger open redirects to steal sensitive tokens for account tak= eover.</td>
<td>2026-08-01</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71403" target=3D= "_blank" rel=3D"noopener">CVE-2025-71403</a></td>
</tr>

<td class=3D"vendor-product">better-auth--better-auth</td>
<td>better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through = 1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via t=
he deprecated oidc-provider plugin and the mcp plugin (which wraps the same=
provider). An attacker can register an OAuth client with a javascript: red= irect_uri, which the authorization server later returns unchanged in the co= nsent response. If the deployment's consent page navigates the browser to t=
he returned redirectURI (e.g. assigning it to window.location.href), the at= tacker's JavaScript executes in the authorization-server origin, exposing t=
he victim's session and enabling account takeover.</td>

<td>2026-08-01</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67333" target=3D= "_blank" rel=3D"noopener">CVE-2026-67333</a></td>
</tr>

<td class=3D"vendor-product">better-auth--passkey</td>
<td>better-auth passkey versions before 1.4.0 contain an insecure direct ob= ject reference vulnerability in the passkey deletion endpoint that allows a= uthenticated users to delete arbitrary passkeys by ID. Attackers with valid=
sessions can submit crafted requests to the delete-passkey endpoint with e= numerated passkey IDs to remove other users' passkeys.</td>
<td>2026-08-02</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71400" target=3D= "_blank" rel=3D"noopener">CVE-2025-71400</a></td>
</tr>

<td class=3D"vendor-product">better-auth--scim</td>
<td>@better-auth/scim (a better-auth plugin) versions &gt;=3D 1.4.0-beta.27=
through &lt;=3D 1.6.21 and &gt;=3D 1.7.0-beta.0 through &lt;=3D 1.7.0-beta=
.9 contain an authorization bypass. SCIM token issuance did not reject prov= ider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social=
account providers, and the same logical provider ID was used for both SCIM=
provider configuration and account ownership. An authenticated user could = mint a SCIM token whose provider ID collided with an existing provider name= space, causing SCIM user routes to resolve account rows the token never pro= visioned. This allowed listing, reading, updating (including rewriting glob=
al profile/email fields without uniqueness checks), and deleting global use=
r accounts and sessions, resulting in account takeover and unauthorized dep= rovisioning. Fixed in 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0).</td> <td>2026-08-01</td>
<td>9.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67330" target=3D= "_blank" rel=3D"noopener">CVE-2026-67330</a></td>
</tr>

<td class=3D"vendor-product">better-auth--scim</td>
<td>better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind n= on-organization SCIM providers to their creator by default, allowing authen= ticated users to manage other users' providers. Attackers can regenerate SC=
IM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM AP=
I routes with the attacker-controlled token.</td>
<td>2026-08-01</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67331" target=3D= "_blank" rel=3D"noopener">CVE-2026-67331</a></td>
</tr>

<td class=3D"vendor-product">better-auth--sso</td>
<td>@better-auth/sso versions before 1.6.21 contain multiple authentication=
bypass vulnerabilities in SSO provider handling that allow attackers to si=
gn in as arbitrary users. Attackers can exploit domain verification parsing=
mismatches, orphaned provider accounts, unbound SAML assertions, or reflec= ted XSS on logout endpoints to gain unauthorized session access and account=
takeover.</td>
<td>2026-08-01</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67328" target=3D= "_blank" rel=3D"noopener">CVE-2026-67328</a></td>
</tr>

<td class=3D"vendor-product">better-auth--stripe</td>
<td>@better-auth/stripe versions &gt;=3D 1.4.11 and &lt; 1.6.21, and &gt;=
=3D 1.7.0-beta.0 and &lt; 1.7.0-beta.10, contain an authorization bypass in=
organization subscription actions. The middleware validates the organizati=
on ID taken from the request query string against the authorizeReference ca= llback, but the handler reads the organization ID only from the request bod=
y and falls back to the caller's active organization from their session. Wh=
en these differ, an authenticated member of multiple organizations can perf= orm subscription actions (cancel, change plan, restore, billing portal acce= ss) against an organization they belong to but should not manage, and can a= ccess another organization's billing details including payment methods, inv= oices, and subscription state.</td>
<td>2026-08-01</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67329" target=3D= "_blank" rel=3D"noopener">CVE-2026-67329</a></td>
</tr>

<td class=3D"vendor-product">bitpressadmin--Bit integrations Form Integrati= on, Webhook, Spreadsheets, CRM, LMS &amp; Email Automation</td>
<td>The Bit integrations - Form Integration, Webhook, Spreadsheets, CRM, LM=
S &amp; Email Automation plugin for WordPress is vulnerable to Directory Tr= aversal in all versions up to, and including, 2.9.0 via the processAttachme=
nt function. This makes it possible for unauthenticated attackers to read t=
he contents of arbitrary files on the server, which can contain sensitive i= nformation.</td>
<td>2026-08-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15006" target=3D= "_blank" rel=3D"noopener">CVE-2026-15006</a></td>
</tr>

<td class=3D"vendor-product">BlackBerry Ltd--QNX Software Development Platf= orm</td>
<td>Improper Input Validation in the decode() function of the traceparser l= ibrary could allow an attacker with a corrupted kernel trace event log (.ke=
v) file, to execute arbitrary code or cause a crash in processes that use l= ibtraceparser in QNX hosts or targets.</td>
<td>2026-07-29</td>
<td>7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-40272" target=3D= "_blank" rel=3D"noopener">CVE-2026-40272</a></td>
</tr>

<td class=3D"vendor-product">boazsegev--facil.io</td>
<td>facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerabilit=
y in the multipart MIME body parser that allows unauthenticated remote atta= ckers to crash the server process by sending a crafted Content-Disposition = header with an empty field name. Attackers can trigger a uint32_t wraparoun=
d in http_mime_parser.h causing an out-of-bounds memory read past the name = pointer, resulting in a bus fault that crashes the handling worker with a s= ingle POST request.</td>
<td>2026-07-27</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66729" target=3D= "_blank" rel=3D"noopener">CVE-2026-66729</a></td>
</tr>

<td class=3D"vendor-product">boazsegev--facil.io</td>
<td>facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability=
in the multipart body parser that allows an unauthenticated remote attacke=
r to permanently freeze worker processes at 100% CPU by sending a multipart= /form-data request with a partial closing boundary. The missing progress gu= ard in the parser loop causes http_mime_parse to return 0 bytes consumed wi= thout setting done or error flags, causing the calling loop to re-invoke th=
e parser on the same buffer indefinitely, exhausting all workers and perman= ently disabling the server until manually restarted.</td>

<td>2026-07-27</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66730" target=3D= "_blank" rel=3D"noopener">CVE-2026-66730</a></td>
</tr>

<td class=3D"vendor-product">boazsegev--facil.io</td>
<td>facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability=
in the HTTP/1.1 chunked transfer encoding parser that allows unauthenticat=
ed remote attackers to crash the server by sending a negative chunk size va= lue. Attackers can send a single POST request with a Transfer-Encoding: chu= nked header containing a leading minus sign in the chunk size field, causin=
g the parser in http1_parser.h to compute a large positive integer from the=
negated value, corrupting internal state and moving the read pointer into = unmapped memory resulting in a fault.</td>
<td>2026-07-27</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66731" target=3D= "_blank" rel=3D"noopener">CVE-2026-66731</a></td>
</tr>

<td class=3D"vendor-product">Bosch--BSH ELP (Electronic Platform) Modules</=

<td>The SSH service on BSH ELP (Electronic Platform) modules contains a pla= tform-specific vulnerability due to an improperly secured default configura= tion. An insecure, non-revocable SSH public key is included in the firmware=
's authorized_keys file for the root user. An attacker in possession of the=
corresponding private key could leverage it to bypass authentication and g= ain root-level access to the appliance.</td>
<td>2026-07-30</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56428" target=3D= "_blank" rel=3D"noopener">CVE-2026-56428</a></td>
</tr>

<td class=3D"vendor-product">britcoder--Single Sign On For TNG</td>
<td>The Single Sign On For TNG plugin for WordPress is vulnerable to Authen= tication Bypass via unauthenticated password reset in all versions up to, a=
nd including, 2.0.0. This is due to the `ssoprocess_ajax()` function - regi= stered on `wp_ajax_nopriv_ssoprocess_ajax` and therefore reachable without = authentication - accepting an attacker-supplied `email` parameter with the = `setnewpassword` operation and calling `reset_password()` on the resolved a= ccount without any ownership token, email confirmation link, or capability = check. The sole guard is a call to `check_ajax_referer()`, which provides n=
o authorization barrier because the `ssoajaxnonce` nonce is publicly broadc= ast on every front-end page via `wp_localize_script()` into the `SSOPWDREQU= IREMENT` JavaScript object; since WordPress computes nonces for logged-out = visitors against a shared anonymous session context, any unauthenticated vi= sitor can scrape a valid nonce from the homepage and use it to authenticate=
the request. This makes it possible for unauthenticated attackers to chang=
e the password of any WordPress account, including administrator accounts, = enabling complete site takeover.</td>
<td>2026-08-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15964" target=3D= "_blank" rel=3D"noopener">CVE-2026-15964</a></td>
</tr>

<td class=3D"vendor-product">buddypress--BuddyPress</td>
<td>The BuddyPress plugin for WordPress is vulnerable to Deserialization of=
Untrusted Data in all versions up to, and including, 14.5.0 This is due to=
the `bp_unserialize_profile_field()` function using `@unserialize()` witho=
ut the `allowed_classes` parameter on user-controlled XProfile field data. = This makes it possible for authenticated attackers, with subscriber-level a= ccess and above, to inject arbitrary PHP objects via XProfile textbox field=
s, which could lead to remote code execution if a suitable POP chain is ava= ilable in the WordPress environment.</td>
<td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-1360" target=3D"= _blank" rel=3D"noopener">CVE-2026-1360</a></td>
</tr>

<td class=3D"vendor-product">Byteflows--Byteflows Travel &amp; Hotel Bookin= g</td>
<td>Unauthenticated Sensitive Data Exposure in Byteflows Travel &amp;amp; H= otel Booking &lt;=3D 1.0.0 versions.</td>
<td>2026-07-27</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59548" target=3D= "_blank" rel=3D"noopener">CVE-2026-59548</a></td>
</tr>

<td class=3D"vendor-product">Canon Production Printing--PRISMAproduction</t=

<td>A deserialization vulnerability in PRISMAproduction Version 6.5 or earl= ier that may lead to arbitrary code execution.</td>
<td>2026-08-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-3245" target=3D"= _blank" rel=3D"noopener">CVE-2026-3245</a></td>
</tr>

<td class=3D"vendor-product">Care Everywhere LLC--Care Everywhere Gateway</=

<td>Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulne= rability in the bundled WildFly 8.2.0.Final management interface that allow=
s unauthenticated remote attackers to gain administrative access by using d= efault credentials identical across all installations. Attackers can authen= ticate to the exposed WildFly management console on port 20990 and deploy a=
malicious Web Application Archive file through the Deployments interface t=
o achieve remote code execution as the Windows machine account. Version 14.= x.x was declared end-of-life (EOL) in 2017 and future releases have address=
ed the vulnerable finding.</td>
<td>2026-07-29</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-41939" target=3D= "_blank" rel=3D"noopener">CVE-2026-41939</a></td>
</tr>

<td class=3D"vendor-product">Christoph Vielgrader--Relevanssi Light</td>

<td>Unauthenticated SQL Injection in Relevanssi Light &lt;=3D 1.2.2 version= s.</td>
<td>2026-07-27</td>
<td>9.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59533" target=3D= "_blank" rel=3D"noopener">CVE-2026-59533</a></td>
</tr>

<td class=3D"vendor-product">clastix--kamaji</td>
<td>Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.= 7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database us= er, and etcd key prefix from a lossy namespace-and-name normalization in Ge= tDefaultDatastoreSchema() and GetDefaultDatastoreUsername(), allowing disti= nct tenants with colliding normalized identifiers to share control-plane st= ate and read, modify, or destroy another tenant's Kubernetes data. This iss=
ue is fixed in version 26.7.4-edge.</td>
<td>2026-07-30</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62246" target=3D= "_blank" rel=3D"noopener">CVE-2026-62246</a></td>
</tr>

<td class=3D"vendor-product">CleanTalk Inc--Spam protection, AntiSpam, Fire= Wall by CleanTalk</td>
<td>Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam=
, FireWall by CleanTalk &lt;=3D 6.82 versions.</td>
<td>2026-07-27</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65437" target=3D= "_blank" rel=3D"noopener">CVE-2026-65437</a></td>
</tr>

<td class=3D"vendor-product">cloudreve--cloudreve</td>
<td>Cloudreve is a self-hosted file management and sharing system. Prior to=
4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read ev=
en though GetOauthRedirectService persists caller-supplied OneDrive secret = and app_id values, allowing an OAuth token without Admin.Write to modify st= orage policy credentials. The route is inside the admin group that requires=
Admin.Read, but it does not add the local Admin.Write guard used by siblin=
g policy mutation routes. Its handler persists attacker-supplied secret and=
app_id values into the selected OneDrive storage policy before returning a=
n OAuth URL. This issue is fixed in version 4.17.0.</td>

<td>2026-07-31</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55502" target=3D= "_blank" rel=3D"noopener">CVE-2026-55502</a></td>
</tr>

<td class=3D"vendor-product">CoCart Headless--CoCart Headless ecommerce</td=

<td>Unauthenticated Broken Access Control in CoCart - Headless ecommerce &l= t;=3D 4.8.4 versions.</td>
<td>2026-07-27</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59536" target=3D= "_blank" rel=3D"noopener">CVE-2026-59536</a></td>
</tr>

<td class=3D"vendor-product">code4life--Database for CF7</td>
<td>The Database for CF7 plugin for WordPress is vulnerable to Stored Cross= -Site Scripting via Array Form Field Values in all versions up to, and incl= uding, 1.2.6 due to insufficient input sanitization and output escaping. Th=
is makes it possible for unauthenticated attackers to inject arbitrary web = scripts in pages that will execute whenever a user accesses an injected pag=
e. This is exploitable by unauthenticated attackers because Contact Form 7 = accepts array-structured input for ordinary text fields (e.g., your-name[])=
via the public REST API endpoint /wp-json/contact-form-7/v1/contact-forms/= {id}/feedback, and the plugin stores submitted data using $wpdb INSERT with=
serialize() into a custom wp_cf7db table, bypassing WordPress save-time fi= ltering via wp_insert_post/wp_kses.</td>
<td>2026-07-29</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13425" target=3D= "_blank" rel=3D"noopener">CVE-2026-13425</a></td>
</tr>

<td class=3D"vendor-product">codeigniter4--CodeIgniter4</td>
<td>CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3=
, Query Builder deleteBatch() substitutes bound values from where() conditi= ons into generated SQL while ignoring their escape flags, allowing user-con= trolled condition values to be interpreted as SQL. This affects only the de= leteBatch() code path. Regular delete() operations escape where() binds cor= rectly. This issue is fixed in version 4.7.4.</td>
<td>2026-07-31</td>
<td>9.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63221" target=3D= "_blank" rel=3D"noopener">CVE-2026-63221</a></td>
</tr>

<td class=3D"vendor-product">codeigniter4--CodeIgniter4</td>
<td>CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_i= mage and mime_in upload validation rules do not independently enforce a saf=
e client filename extension, allowing a remote attacker to upload executabl=
e content when an application preserves the client filename and stores uplo= ads in a web-accessible script-enabled directory. Applications are impacted=
when they validate uploads using is_image or mime_in without an independen=
t safe extension check (such as ext_in on patched versions), save uploaded = files using the client-supplied filename, and place uploads in a web-access= ible directory where PHP files can execute. This issue is fixed in version = 4.7.4.</td>
<td>2026-07-31</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63223" target=3D= "_blank" rel=3D"noopener">CVE-2026-63223</a></td>
</tr>

<td class=3D"vendor-product">codeigniter4--CodeIgniter4</td>
<td>CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling = UploadedFile::move() without a second argument uses the client-provided fil= ename without sanitization, allowing a remote attacker to use path traversa=
l sequences to write uploaded content outside the intended directory when t=
he application exposes an upload path. This issue is fixed in version 4.7.4= .</td>
<td>2026-07-31</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63222" target=3D= "_blank" rel=3D"noopener">CVE-2026-63222</a></td>
</tr>

<td class=3D"vendor-product">codename065--Premium Packages Sell Digital Pro= ducts Securely</td>
<td>The Premium Packages - Sell Digital Products Securely plugin for WordPr= ess is vulnerable to SQL Injection via the 'code' parameter of the POST /wp= -json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and includ= ing, 6.2.0. This is due to insufficient escaping on the user-supplied param= eter, which is interpolated directly into a raw SQL query string in the Cou= ponCodes::find() method without use of $wpdb-&gt;prepare() or esc_sql(). Th=
is makes it possible for unauthenticated attackers to append additional SQL=
queries into already existing queries that can be used to extract sensitiv=
e information from the database.</td>
<td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12800" target=3D= "_blank" rel=3D"noopener">CVE-2026-12800</a></td>
</tr>

<td class=3D"vendor-product">Comfy-Org--ComfyUI</td>
<td>ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the=
LoadTrainingDataset node that allows unauthenticated remote attackers to e= xecute arbitrary Python code by uploading a crafted pickle file and trigger= ing its deserialization. Attackers can upload a malicious shard_*.pkl file = via the unauthenticated POST /upload/image endpoint and then queue a workfl=
ow graph via POST /prompt referencing the uploaded file, causing torch.load=
to deserialize the attacker-controlled pickle payload using __reduce__ and=
execute arbitrary commands as the ComfyUI process user.</td> <td>2026-07-31</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-68771" target=3D= "_blank" rel=3D"noopener">CVE-2026-68771</a></td>
</tr>

<td class=3D"vendor-product">Comfy-Org--ComfyUI</td>
<td>ComfyUI is a modular diffusion model GUI, api and backend with a graph/= nodes interface. Prior to 0.28.0, the /view endpoint served uploaded SVG fi= les inline because image/svg+xml and related XML content types were absent = from the dangerous-content-type handling, allowing stored cross-site script= ing in the ComfyUI origin. This issue is fixed in version 0.28.0.</td> <td>2026-07-31</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56670" target=3D= "_blank" rel=3D"noopener">CVE-2026-56670</a></td>
</tr>

<td class=3D"vendor-product">Comfy-Org--ComfyUI</td>
<td>ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to=
0.28.0, GET /userdata/{file} served user-controlled HTML and SVG files wit=
h extension-derived content types, allowing stored cross-site scripting in = the ComfyUI origin and access to browser-stored API tokens, settings, workf= lows, and authenticated-equivalent API calls. The handler used web.FileResp= onse(path), so an uploaded .html/.svg was served as text/html/image/svg+xml=
. POST /userdata stores arbitrary request bodies (confined to the user's us= erdata directory). When a victim navigated to the file URL, the embedded sc= ript executed same-origin. The /view endpoint already forced dangerous MIME=
types to download; that protection had never been applied to /userdata. Th=
is issue is fixed in version 0.28.0.</td>
<td>2026-07-31</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56672" target=3D= "_blank" rel=3D"noopener">CVE-2026-56672</a></td>
</tr>

<td class=3D"vendor-product">Comfy-Org--ComfyUI</td>
<td>ComfyUI is a modular diffusion model GUI, api and backend with a graph/= nodes interface. Prior to 0.28.0, get_model_preview in app/model_manager.py=
joins an unrestricted filename route capture to a selected model directory=
without a containment check, allowing an unauthenticated remote attacker t=
o use traversal, encoded traversal, absolute paths, or an unbounded path_in= dex to read image-decodable files and enumerate host paths. get_model_previ=
ew (app/model_manager.py) built the path with os.path.join(folder, filename=
) where filename is an unrestricted {filename:.*} route capture. Literal ..=
/, percent-encoded %2e%2e%2f, and absolute paths all escaped the model dire= ctory; path_index was also unbounded. The target file is piped through Pill=
ow and re-encoded as WEBP, so disclosure is limited to image-decodable file=
s plus a file-existence/enumeration oracle (and internal-path leakage via p= ath_index errors). This issue is fixed in version 0.28.0.</td> <td>2026-07-31</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56671" target=3D= "_blank" rel=3D"noopener">CVE-2026-56671</a></td>
</tr>

<td class=3D"vendor-product">Comfy-Org--ComfyUI</td>
<td>ComfyUI is a modular diffusion model GUI, API, and backend with a graph= -and-node interface. Prior to 0.28.0, folder_paths.get_annotated_filepath a=
nd exists_annotated_filepath join workflow-controlled annotated filenames t=
o a base directory without a containment check, allowing an unauthenticated=
crafted POST /prompt workflow using LoadImage or sibling nodes to probe ar= bitrary host paths and exfiltrate image-format files through /view. LoadIma=
ge defines a VALIDATE_INPUTS method, which causes the execution engine to s= kip COMBO (input-directory) validation. Affected nodes include LoadImage, L= oadImageMask, LoadImageOutput, LoadAudio, LoadLatent, LoadVideo, and Load3D=
. This issue is fixed in version 0.28.0.</td>
<td>2026-07-31</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56673" target=3D= "_blank" rel=3D"noopener">CVE-2026-56673</a></td>
</tr>

<td class=3D"vendor-product">copier-org--copier</td>
<td>Copier is a library and CLI app for rendering project templates. From 9= .5.0 through 9.16.0, percent-encoded parent-directory segments or encoded p= ath separators in a template URL can match a configured trusted repository = prefix before an HTTP server or Git transport decodes the path, allowing un= safe template features from a repository outside the trusted prefix to run = after user interaction. This issue is fixed in version 9.17.0.</td> <td>2026-07-31</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62999" target=3D= "_blank" rel=3D"noopener">CVE-2026-62999</a></td>
</tr>

<td class=3D"vendor-product">coturn--coturn</td>
<td>Coturn is a free open source implementation of TURN and STUN Server. Pr= ior to 4.15.0, a server using --mobility authenticates a resumed REFRESH re= quest with the resuming user's credentials but does not verify that identit=
y against the original allocation owner, allowing an authenticated attacker=
who obtains a victim MOBILITY-TICKET to receive and inject relayed traffic=
and consume the victim's quota. In the handle_turn_refresh resume branch, = the victim allocation (orig_ss) is located solely by the attacker-controlle=
d mobile id, and credentials are only adopted (via copy_auth_parameters) wh=
en the resuming session is unauthenticated. Because the attacker's session = already has hmackey_set set to 1 from its own prior authentication (which i=
s never reset for long-term-credential sessions), the credential copy is sk= ipped and check_stun_auth validates the REFRESH against the attacker's own = identity rather than the allocation owner's. This issue is fixed in version=
4.15.0.</td>
<td>2026-07-31</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65981" target=3D= "_blank" rel=3D"noopener">CVE-2026-65981</a></td>
</tr>

<td class=3D"vendor-product">Cozmoslabs--Paid Member Subscriptions</td>

<td>Subscriber Insecure Direct Object References (IDOR) in Paid Member Subs= criptions &lt;=3D 3.0.7 versions.</td>
<td>2026-07-27</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59539" target=3D= "_blank" rel=3D"noopener">CVE-2026-59539</a></td>
</tr>

<td class=3D"vendor-product">cozyvision1--SMS Alert SMS &amp; OTP for WooCo= mmerce, Order Notifications &amp; Abandoned Cart Recovery</td>
<td>The SMS Alert - SMS &amp; OTP for WooCommerce, Order Notifications &amp=
; Abandoned Cart Recovery plugin for WordPress is vulnerable to Authenticat= ion Bypass leading to Account Takeover in all versions up to, and including=
, 3.9.7 via the `billing_phone` parameter. This is due to the `processRegis= tration()` function using a phone-unbound `$_SESSION['sa_mobile_verified']`=
boolean flag as the sole gate before issuing an authentication cookie - th=
e flag is set to `true` after any successful OTP validation without being b= ound to the specific phone number that was verified. This makes it possible=
for unauthenticated attackers to complete OTP verification for a phone num= ber they control, then resubmit the registration request with a victim's `b= illing_phone` value to have `wp_set_auth_cookie()` called for the resolved = victim account, enabling full authentication as any existing WordPress user=
whose registered phone number is known or guessable, including administrat= ors.</td>
<td>2026-07-28</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15014" target=3D= "_blank" rel=3D"noopener">CVE-2026-15014</a></td>
</tr>

<td class=3D"vendor-product">Cribl--Cribl Stream</td>
<td>Improper control of generation of code in the JSON Pointer-to-accessor = compiler in Cribl Stream before 4.18.2 allows a remote authenticated attack=
er with edit privileges to execute arbitrary JavaScript on the server via a=
crafted database connection identifier or pack configuration value.</td> <td>2026-07-27</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56747" target=3D= "_blank" rel=3D"noopener">CVE-2026-56747</a></td>
</tr>

<td class=3D"vendor-product">Cribl--Cribl Stream</td>
<td>Improper validation of symbolic links in the Pack Git import feature in=
Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pac=
k import and pipeline preview permissions to execute arbitrary code as the = Cribl server process via a crafted Git repository containing a symbolic lin=
k in the pack's functions directory.</td>
<td>2026-07-27</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56748" target=3D= "_blank" rel=3D"noopener">CVE-2026-56748</a></td>
</tr>

<td class=3D"vendor-product">cubewp1211--CubeWP Framework</td>
<td>The CubeWP Framework plugin for WordPress is vulnerable to Directory Tr= aversal in all versions up to, and including, 1.1.30 via the 'cubewp_get_sv= g_content' function. This makes it possible for unauthenticated attackers t=
o read the contents of arbitrary files on the server, which can contain sen= sitive information. This is exploitable by unauthenticated attackers becaus=
e the required nonce is publicly emitted into the markup of any page render= ing the CubeWP posts shortcode or widget with AJAX loading enabled, making =
it harvestable by any guest visitor before submitting the AJAX request.</td=

<td>2026-08-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13339" target=3D= "_blank" rel=3D"noopener">CVE-2026-13339</a></td>
</tr>

<td class=3D"vendor-product">Dassault Systmes--Station Launcher App in 3DEX= PERIENCE platform</td>
<td>A Deserialization of Untrusted Data vulnerability affecting Station Lau= ncher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through=
Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code e= xecution.</td>
<td>2026-07-28</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11756" target=3D= "_blank" rel=3D"noopener">CVE-2026-11756</a></td>
</tr>

<td class=3D"vendor-product">DaveGamble--cJSON</td>
<td>cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to=
stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSO= NUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). A patch co= ntaining add and copy operations grafts duplicated subtrees to amplify docu= ment depth beyond the parser's nesting limit: cJSON_Delete() recurses with =
no depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is set=
to 10000, ten times the parser's 1000-level nesting limit and high enough =
to overflow a default thread stack. An attacker who can supply the patch do= cument can crash the process, resulting in denial of service.</td> <td>2026-07-29</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67215" target=3D= "_blank" rel=3D"noopener">CVE-2026-67215</a></td>
</tr>

<td class=3D"vendor-product">delvedor--find-my-way</td>
<td>find-my-way is a framework-independent HTTP router that internally uses=
a Radix Tree and supports route parameters and wildcards. Versions prior t=
o 9.7.0 are vulnerable to remotely triggerable DoS in find-my-way when it i=
s used with Node's HTTP/2 server. The lookup() function passes req.method i= nto find(), and find() indexes this.trees[method]. Since this.trees is a no= rmal object, HTTP/2 method values like constructor, toString, or __proto__ = can resolve inherited object properties instead of returning undefined. The=
code then treats that value like a router node and crashes when it reaches=
currentNode.prefix.length. This issue has been fixed in version 9.0.7.</td=

<td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-47219" target=3D= "_blank" rel=3D"noopener">CVE-2026-47219</a></td>
</tr>

<td class=3D"vendor-product">deveasel--Demi One Click Demo Import, Backup &= amp; Site Migration</td>
<td>The Demi - One Click Demo Import, WP Backup &amp; Site Migration plugin=
for WordPress is vulnerable to Arbitrary Directory Deletion in all version=
s up to, and including, 0.0.7. The vulnerability exists because the plugin = stores its HMAC signing key and per-step restore token as dotfiles inside a=
publicly accessible subdirectory of the WordPress uploads folder - without=
any `.htaccess` or index file protection - and the `demi_restore_step` AJA=
X handler, registered for unauthenticated callers, explicitly accepts posse= ssion of the on-disk signing key as a standalone alternative to WordPress c= apability and nonce checks; an unauthenticated attacker who retrieves the e= xposed key can forge a valid signed state envelope to invoke `CleanDir::exe= cute()` with a caller-supplied absolute path that is subject to no allow-li=
st or path-canonicalization check. This makes it possible for unauthenticat=
ed attackers to recursively delete arbitrary directories on the server.</td=

<td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14490" target=3D= "_blank" rel=3D"noopener">CVE-2026-14490</a></td>
</tr>

<td class=3D"vendor-product">dfir-iris--iris-web</td>
<td>The IRIS web application in version 2.4.26 and possibly others is vulne= rable to stored cross-site scripting (XSS) in the assets function.</td> <td>2026-07-30</td>
<td>7.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16969" target=3D= "_blank" rel=3D"noopener">CVE-2026-16969</a></td>
</tr>

<td class=3D"vendor-product">dfir-iris--iris-web</td>
<td>The IRIS web application in version 2.4.26 and possibly others is vulne= rable to stored cross-site scripting (XSS) in the custom attributes functio= n.</td>
<td>2026-07-30</td>
<td>7.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18360" target=3D= "_blank" rel=3D"noopener">CVE-2026-18360</a></td>
</tr>

<td class=3D"vendor-product">dfir-iris--iris-web</td>
<td>The IRIS web application in version 2.4.26 and possibly others is vulne= rable to stored cross-site scripting (XSS) in the datastore upload function= .</td>
<td>2026-07-30</td>
<td>7.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18361" target=3D= "_blank" rel=3D"noopener">CVE-2026-18361</a></td>
</tr>

<td class=3D"vendor-product">dromara--MaxKey</td>
<td>MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficien=
t redirect URI validation vulnerability in DefaultRedirectResolver.hostMatc= hes() that allows remote attackers to hijack OAuth 2.0 authorization codes =
by supplying a crafted redirect_uri whose hostname suffix matches a registe= red URI without proper dot-boundary anchoring. Attackers who control a doma=
in ending with the registered redirect URI hostname can social-engineer vic= tims into clicking a crafted authorization URL, causing the authorization c= ode to be issued to the attacker-controlled URI and exchanged for an access=
token granting access to the victim's identity.</td>
<td>2026-07-30</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67345" target=3D= "_blank" rel=3D"noopener">CVE-2026-67345</a></td>
</tr>

<td class=3D"vendor-product">duracelltomi--GTM4WP A Google Tag Manager (GTM=
) plugin for WordPress</td>
<td>The GTM4WP - A Google Tag Manager (GTM) plugin for WordPress plugin for=
WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Bil= ling Fields in all versions up to, and including, 1.22.3 due to insufficien=
t input sanitization and output escaping. This makes it possible for unauth= enticated attackers to inject arbitrary web scripts in pages that will exec= ute whenever a user accesses an injected page. This requires the GTM4WP Woo= Commerce order data integration option (GTM4WP_OPTION_INTEGRATE_WCORDERDATA=
) to be enabled, and is exploited by placing a guest checkout order with a = JavaScript payload in a WooCommerce billing field such as the billing first=
name.</td>
<td>2026-07-29</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16597" target=3D= "_blank" rel=3D"noopener">CVE-2026-16597</a></td>
</tr>

<td class=3D"vendor-product">e107inc--e107</td>
<td>e107 prior to version 2.3.8 contains a code execution vulnerability in = the e_array deserialization handler that allows an attacker with out-of-ban=
d database write access to execute arbitrary PHP code by storing a crafted = payload in the user_prefs column. The e_array::unserialize() function in e1= 07_handlers/core_functions.php performs only a prefix check for the string = 'array' before passing the stored value to eval(), causing automatic PHP ex= ecution whenever the affected user's preferences are materialized through e= _user_pref::load().</td>
<td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57859" target=3D= "_blank" rel=3D"noopener">CVE-2026-57859</a></td>
</tr>

<td class=3D"vendor-product">Eaton--PADM</td>
<td>Improper input validation in the authentication component of=C2=A0Eaton=
's Tripp Lite series=C2=A0PADM firmware could allow an unauthenticated remo=
te attacker to bypass authentication and gain a privileged user access to t=
he device.</td>
<td>2026-07-30</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-22620" target=3D= "_blank" rel=3D"noopener">CVE-2026-22620</a></td>
</tr>

<td class=3D"vendor-product">Eaton--PADM</td>
<td>Improper input validation in one of the session management interface of=
Eaton's Tripp Lite Series=C2=A0PADM firmware could allow an authenticated = administrator to execute arbitrary commands within a restricted environment= .</td>
<td>2026-07-30</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-22621" target=3D= "_blank" rel=3D"noopener">CVE-2026-22621</a></td>
</tr>

<td class=3D"vendor-product">Eaton--PADM</td>
<td>Improper input validation in one of the session management interface of=
Eaton's Tripp Lite series PADM firmware could allow an authenticated user =
to elevate privileges resulting in unrestricted access to the device.</td> <td>2026-07-30</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-22622" target=3D= "_blank" rel=3D"noopener">CVE-2026-22622</a></td>
</tr>

<td class=3D"vendor-product">eazyplugins--Eazy Plugin Manager Powerful Plug=
in Management Solution for WordPress</td>
<td>The Eazy Plugin Manager - Powerful Plugin Management Solution for WordP= ress plugin for WordPress is vulnerable to Privilege Escalation in all vers= ions up to, and including, 4.4.1. This is due to insufficient authorization=
on the `wp_ajax_pos_get_option` AJAX handler, which verifies only a nonce = that is localized to every logged-in admin-area user via `admin_enqueue_scr= ipts` - without any capability check - before returning the value of any ar= bitrary WordPress option via `get_option()`, combined with the `admin_login= _endpoint_handler` REST endpoint (`GET /wp-json/epm/v1/admin/login`) being = registered as publicly accessible and authenticating callers solely by a wh= irlpool hash of values stored in those same options. This makes it possible=
for authenticated attackers, with Subscriber-level access and above, to re=
ad the `site_url`, `connection_key`, and `remote_user_id` values stored in = the `eazywp_connecting_info` and `eazywp_connection` options, compute the r= equired `auth_key`, call the `admin/login` REST endpoint to obtain Administ= rator authentication cookies, and fully take over the site. Exploitation re= quires the plugin's remote connection feature to have been configured, as t=
he `eazywp_connecting_info` and `eazywp_connection` options must be populat=
ed with valid credentials.</td>
<td>2026-07-28</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14328" target=3D= "_blank" rel=3D"noopener">CVE-2026-14328</a></td>
</tr>

<td class=3D"vendor-product">epsiloncool--WP Fast Total Search The Power of=
Indexed Search</td>
<td>The WP Fast Total Search - The Power of Indexed Search plugin for WordP= ress is vulnerable to generic SQL Injection via the 'form_data[s]' paramete=
r in all versions up to, and including, 1.80.280 due to insufficient escapi=
ng on the user supplied parameter and lack of sufficient preparation on the=
existing SQL query. This makes it possible for unauthenticated attackers t=
o append additional SQL queries into already existing queries that can be u= sed to extract sensitive information from the database.</td>

<td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12741" target=3D= "_blank" rel=3D"noopener">CVE-2026-12741</a></td>
</tr>

<td class=3D"vendor-product">fast-uri--fast-uri</td>
<td>fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forwa=
rd slash to recognize a URI authority, so a reference that uses a backslash=
based introducer in place of it (backslash backslash, forward slash backsl= ash, or backslash forward slash) is parsed with no authority and folds into=
the path. Node's native WHATWG URL parser instead treats a backslash as in= terchangeable with a forward slash for special schemes, so the two parsers = extract different hosts from the same input. Applications that use fast-uri=
to enforce host based policy such as allowlists, SSRF filtering, or redire=
ct validation before passing the same URL into Node's URL or fetch consumer=
s can be steered to an unintended host. Upgrade to fast-uri 4.1.2, 3.1.5, o=
r 2.4.4.</td>
<td>2026-07-31</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18446" target=3D= "_blank" rel=3D"noopener">CVE-2026-18446</a></td>
</tr>

<td class=3D"vendor-product">fleekdash--FleekDash V2</td>
<td>The FleekDash V2 plugin for WordPress is vulnerable to authorization by= pass in all versions up to, and including, 2.6.2.2. This is due to the plug=
in not properly verifying that a user is authorized to perform an action. T= his makes it possible for authenticated attackers, with subscriber-level ac= cess and above, to overwrite the email address and password of any WordPres=
s user, including administrators, enabling full account takeover and comple=
te site compromise. The public /wp-json/fleekdash/v1/register endpoint auto= -provisions a Subscriber-role account and returns a valid REST nonce regard= less of the site's users_can_register setting, enabling unauthenticated att= ackers to self-provision the required credentials and nonce in a single pri=
or request.</td>
<td>2026-07-30</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14356" target=3D= "_blank" rel=3D"noopener">CVE-2026-14356</a></td>
</tr>

<td class=3D"vendor-product">flytohub--flyto-core</td>
<td>Flyto2 Core is an execution kernel for automation and AI-agent workflow=
s. Prior to 2.26.6, image.download and related file-writing modules use cal= ler-controlled output_dir instead of validate_path_with_env_config and its = FLYTO_SANDBOX_DIR confinement, allowing attacker-controlled response bytes =
to be written to arbitrary filesystem paths the process can access. This is= sue is fixed in version 2.26.6.</td>
<td>2026-07-29</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67429" target=3D= "_blank" rel=3D"noopener">CVE-2026-67429</a></td>
</tr>

<td class=3D"vendor-product">flytohub--flyto-core</td>
<td>Flyto2 Core is an execution kernel for automation and AI-agent workflow=
s. Prior to 2.26.7, the standalone flyto-verification service in src/core/v= erification_service.py exposes unauthenticated POST /run on 0.0.0.0:8344 an=
d uses client-supplied callback_url for an outbound POST with X-Internal-Ke=
y: $FLYTO_RUNNER_SECRET while bypassing target_allowed, allowing unauthenti= cated SSRF and runner secret exfiltration. This issue is fixed in version 2= .26.7.</td>
<td>2026-07-29</td>
<td>9.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67426" target=3D= "_blank" rel=3D"noopener">CVE-2026-67426</a></td>
</tr>

<td class=3D"vendor-product">flytohub--flyto-core</td>
<td>Flyto2 Core is an execution kernel for automation and AI-agent workflow=
s. Prior to 2.26.7, the HTTP modules http.get, http.request, and http.batch=
in src/core/modules/atomic/http/get.py, src/core/modules/atomic/http/reque= st.py, and src/core/modules/atomic/http/batch.py validate only the initial = URL, then follow redirects with allow_redirects=3DTrue and without per-hop = Location revalidation, allowing a public URL to redirect into internal addr= ess space and return the internal response body. This issue is fixed in ver= sion 2.26.7.</td>
<td>2026-07-29</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67424" target=3D= "_blank" rel=3D"noopener">CVE-2026-67424</a></td>
</tr>

<td class=3D"vendor-product">flytohub--flyto-core</td>
<td>Flyto2 Core is an execution kernel for automation and AI-agent workflow=
s. Prior to 2.26.6, llm.chat reads provider keys such as OPENAI_API_KEY and=
ANTHROPIC_API_KEY from the environment and sends them in the Authorization=
: Bearer header to caller-controlled base_url, allowing an attacker to rece= ive the operator's key on a public host that passes the SSRF guard. This is= sue is fixed in version 2.26.6.</td>
<td>2026-07-29</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67425" target=3D= "_blank" rel=3D"noopener">CVE-2026-67425</a></td>
</tr>

<td class=3D"vendor-product">flytohub--flyto-core</td>
<td>Flyto2 Core is an execution kernel for automation and AI-agent workflow=
s. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR=
} for any host environment variable without an allowlist or capability poli=
cy check, allowing a workflow parameter to bypass the default capability po= licy denylist for env.get and env.load_dotenv and exfiltrate secrets throug=
h allowed modules. This issue is fixed in version 2.26.6.</td>

<td>2026-07-29</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67427" target=3D= "_blank" rel=3D"noopener">CVE-2026-67427</a></td>
</tr>

<td class=3D"vendor-product">flytohub--flyto-core</td>
<td>Flyto2 Core is an execution kernel for automation and AI-agent workflow=
s. Prior to 2.26.7, HTTP-emitting modules including src/core/modules/third_= party/developer/http/requests.py, core.api.http_get, core.api.http_post, gr= aphql.query, graphql.mutation, monitor.http_check, communication.slack_send=
, notification.discord.send_message, notification.slack.send_message, notif= ication.teams.send_message, ai.vision_analyze, verify.visual_diff, browser.= proxy_rotate, and the agent and llm inline base_url branch fetch caller-con= trolled URLs without validate_url_with_env_config, allowing SSRF to interna=
l or metadata endpoints. This issue is fixed in version 2.26.7.</td> <td>2026-07-29</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67428" target=3D= "_blank" rel=3D"noopener">CVE-2026-67428</a></td>
</tr>

<td class=3D"vendor-product">FreeRDP--FreeRDP</td>
<td>FreeRDP before 3.29.0 (affected versions &lt;=3D 3.28.0) contains multi= ple TLS certificate identity validation weaknesses in tls_verify_certificat= e(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP = performs custom Common Name and DNS SAN string matching instead of using Op= enSSL's length-aware identity validation APIs, it (1) truncates DNS SAN val= ues at embedded NUL bytes (accepting e.g. 'victim.example .attacker.example=
' as 'victim.example'), (2) accepts a matching Common Name even when non-ma= tching DNS SAN entries are present, and (3) accepts IP-literal targets via = DNS/CN matching without comparing iPAddress SANs. Under a trusted or misiss= ued certificate chain, an attacker positioned to present such a certificate=
can bypass server identity verification, weakening TLS server authenticati= on.</td>
<td>2026-08-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66402" target=3D= "_blank" rel=3D"noopener">CVE-2026-66402</a></td>
</tr>

<td class=3D"vendor-product">FreeRDP--FreeRDP</td>
<td>FreeRDP before 3.29.0 (affected versions &lt;=3D 3.28.0) does not valid= ate CRLF and control characters in the server-controlled RDP redirection Ta= rgetNetAddress field. This value is copied into the client's ServerHostname=
and, when the client connects through an HTTP proxy, is written directly i= nto the proxy CONNECT request line and Host header by http_proxy_connect() = without filtering. A malicious or compromised RDP server can send a crafted=
redirection PDU containing embedded control characters to inject arbitrary=
headers/requests into the HTTP proxy CONNECT request.</td>
<td>2026-08-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67289" target=3D= "_blank" rel=3D"noopener">CVE-2026-67289</a></td>
</tr>

<td class=3D"vendor-product">FreeRDP--FreeRDP</td>
<td>FreeRDP before 3.30.0 (&lt;=3D 3.29.0) contains a heap-based buffer ove= rflow in the Windows clipboard client's CliprdrStream_Read function (client= /Windows/wf_cliprdr.c). When an OLE paste consumer (e.g. explorer.exe) call=
s IStream::Read with a fixed-size buffer of cb bytes, CliprdrStream_Read re= quests file contents from the RDP server and then copies the response into = the caller's buffer using the server-supplied length (req_fsize) instead of=
cb. A malicious or compromised RDP server can return an oversized CB_FILEC= ONTENTS_RESPONSE, causing an out-of-bounds write of attacker-controlled dat=
a into the paste consumer's heap buffer when a user pastes server-offered c= lipboard file contents.</td>
<td>2026-08-02</td>
<td>9.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-68579" target=3D= "_blank" rel=3D"noopener">CVE-2026-68579</a></td>
</tr>

<td class=3D"vendor-product">FreeRDP--FreeRDP</td>
<td>FreeRDP before 3.29.0 contains a null pointer dereference vulnerability=
in smartcard cache request decoders that accept NULL NDR pointers for Look= upName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. Wh=
en smartcard emulation is enabled, attackers can send crafted smartcard cac=
he requests with NULL lookup-name pointers to trigger strlen() on a null po= inter, causing client process termination.</td>
<td>2026-08-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67288" target=3D= "_blank" rel=3D"noopener">CVE-2026-67288</a></td>
</tr>

<td class=3D"vendor-product">FreeRDP--FreeRDP</td>
<td>FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability =
in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types wit=
h insufficient ExtraData. Attackers can send malformed media format data fr=
om a server to trigger a crash by reading fixed offsets without validating = source buffer length.</td>
<td>2026-08-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67290" target=3D= "_blank" rel=3D"noopener">CVE-2026-67290</a></td>
</tr>

<td class=3D"vendor-product">FreeRDP--FreeRDP</td>
<td>FreeRDP before 3.29.0 (affected versions &lt;=3D 3.28.0) contains a hea=
p out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragme= nt_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD up= date, the code reads a one-byte server-controlled declared fragment size bu=
t does not verify it fits within the remaining received buffer before alloc= ating and copying that many bytes. A malicious RDP server can send a short = fragment with an oversized declared size, causing the client to read beyond=
the allocated buffer, resulting in an out-of-bounds read and client crash.= </td>
<td>2026-08-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67291" target=3D= "_blank" rel=3D"noopener">CVE-2026-67291</a></td>
</tr>

<td class=3D"vendor-product">FreeRDP--FreeRDP</td>
<td>FreeRDP before 3.29.0 contains a denial of service vulnerability in the=
RDPEI server channel handler that fails to validate maximum PDU body lengt=
h before stream allocation. A malicious RDP client can send a header-only R= DPEI message with a large declared body length to force excessive memory al= location on the server.</td>
<td>2026-08-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67296" target=3D= "_blank" rel=3D"noopener">CVE-2026-67296</a></td>
</tr>

<td class=3D"vendor-product">FreeRDP--FreeRDP</td>
<td>FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when pro= cessing Transfer-Encoding: chunked HTTP responses in http_response_recv_bod= y(). Attackers controlling a malicious RD Gateway endpoint can send oversiz=
ed chunked response bodies to exhaust client memory resources without trigg= ering the configured size limit.</td>
<td>2026-08-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67297" target=3D= "_blank" rel=3D"noopener">CVE-2026-67297</a></td>
</tr>

<td class=3D"vendor-product">FreeRDP--FreeRDP</td>
<td>FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in t=
he server-side RAIL channel handler (rail_server_handle_messages() in chann= els/rail/server/rail_main.c). When processing a RAIL PDU header, the code s= ubtracts RAIL_PDU_HEADER_LENGTH from the peer-controlled orderLength field = without first verifying orderLength is at least the header length. For orde= rLength values 0..3 this causes an unsigned integer underflow to a very lar=
ge size, which bypasses the Stream_EnsureRemainingCapacity() capacity check=
(due to pointer arithmetic wraparound) and is then passed to WTSVirtualCha= nnelRead(), resulting in an out-of-bounds heap write. A malicious or compro= mised RDP client can exploit this to corrupt the heap and crash the server.=
Fixed in FreeRDP 3.29.0.</td>
<td>2026-08-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67298" target=3D= "_blank" rel=3D"noopener">CVE-2026-67298</a></td>
</tr>

<td class=3D"vendor-product">FreeRDP--FreeRDP</td>
<td>FreeRDP before 3.29.0 contains a client-side heap use-after-free in the=
async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabl=
ed (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow = CopyMemory() overwrites a freshly allocated lParam-&gt;iconInfo with the pa= rser-owned windowIcon-&gt;iconInfo pointer. After the parser callback retur= ns, update_recv_window_info_order() frees window_icon.iconInfo, but the que= ued async message still retains and later dispatches that stale pointer. A = malicious or compromised RDP server sending a crafted RAIL Window Alternate=
Secondary Order with WINDOW_ORDER_ICON can trigger use-after-free, leading=
to memory corruption and client crash.</td>
<td>2026-08-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67299" target=3D= "_blank" rel=3D"noopener">CVE-2026-67299</a></td>
</tr>

<td class=3D"vendor-product">FreeRDP--FreeRDP</td>
<td>FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerab= ilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and N= OTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or com= promised RDP server sends crafted update orders, the message proxy shallow-= copies structures containing nested parser-owned pointers (e.g., titleInfo.= string, windowRects, visibilityRects, icon buffers). The parser frees those=
nested buffers after the callback returns, so the queued async message lat=
er dispatches stale pointers, potentially causing memory corruption or a cl= ient crash.</td>
<td>2026-08-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67300" target=3D= "_blank" rel=3D"noopener">CVE-2026-67300</a></td>
</tr>

<td class=3D"vendor-product">FreeRDP--FreeRDP</td>
<td>FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in th=
e async update message proxy for the PolygonSC and PolygonCB primary drawin=
g orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), updat= e_message_PolygonSC() and update_message_PolygonCB() allocate a fresh point=
s array but copy point data from the address of the order structure instead=
of from polygonSC-&gt;points / polygonCB-&gt;points, resulting in a client= -side out-of-bounds read. A malicious or compromised RDP server sending cra= fted PolygonSC/PolygonCB update orders can trigger memory disclosure or a c= lient crash.</td>
<td>2026-08-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67301" target=3D= "_blank" rel=3D"noopener">CVE-2026-67301</a></td>
</tr>

<td class=3D"vendor-product">FreeRDP--FreeRDP</td>
<td>FreeRDP before 3.29.0 contains a null pointer dereference vulnerability=
in smartcard device control request cleanup when reader-state decoding fai= ls. Attackers can send malformed smartcard IRP requests with non-zero cRead= ers and truncated reader-state data to crash the process via null pointer a= ccess in free_reader_states functions.</td>
<td>2026-08-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67304" target=3D= "_blank" rel=3D"noopener">CVE-2026-67304</a></td>
</tr>

<td class=3D"vendor-product">FreeRDP--FreeRDP</td>
<td>FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the = audio input redirection channel (audin) across ALSA, sndio, WinMM, and Open=
SL ES backends that fail to validate the FramesPerPacket parameter from RDP=
servers. Attackers can supply a malicious FramesPerPacket value causing al= location size wraparound, resulting in heap-based buffer overflow on ALSA o=
r denial of service on all platforms.</td>
<td>2026-08-02</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-68580" target=3D= "_blank" rel=3D"noopener">CVE-2026-68580</a></td>
</tr>

<td class=3D"vendor-product">FTC Software IT Services--FTC E-Commerce Manag= ement Panel</td>
<td>Missing authentication for critical function vulnerability in FTC Softw= are IT Services FTC E-Commerce Management Panel allows Authentication Bypas=
s. This issue affects FTC E-Commerce Management Panel: before 1.0.2.</td> <td>2026-07-30</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12722" target=3D= "_blank" rel=3D"noopener">CVE-2026-12722</a></td>
</tr>

<td class=3D"vendor-product">GeneralSandman--TinyWeb</td>
<td>TinyWeb through 0.0.8 contains a memory leak vulnerability that allows = unauthenticated attackers to exhaust available memory by sending ordinary w= ell-formed HTTP requests. Each request causes HttpParser::execute() to allo= cate Url objects, HttpHeaders objects, and HttpHeader instances via raw new=
expressions that are never freed due to missing destructors and unreachabl=
e delete calls, causing worker resident memory to grow monotonically by app= roximately 20 to 28 kB per request until the worker process is killed.</td> <td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67183" target=3D= "_blank" rel=3D"noopener">CVE-2026-67183</a></td>
</tr>

<td class=3D"vendor-product">GeneralSandman--TinyWeb</td>
<td>TinyWeb through 0.0.8 contains a null pointer dereference vulnerability=
that allows unauthenticated remote attackers to crash worker processes by = sending a malformed HTTP request line with an invalid version string. The H= ttpParser::execute() function fails to allocate the Url object when version=
parsing fails, leaving the url pointer NULL, and buildResponse() subsequen= tly dereferences this NULL pointer without checking the valid_requ flag, pr= oducing a SIGSEGV that terminates the worker process and, when repeated acr= oss all workers, takes the server permanently offline until manually restar= ted.</td>
<td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67184" target=3D= "_blank" rel=3D"noopener">CVE-2026-67184</a></td>
</tr>

<td class=3D"vendor-product">GeneralSandman--TinyWeb</td>
<td>TinyWeb through 0.0.8 contains a path traversal vulnerability that allo=
ws unauthenticated attackers to read arbitrary files by submitting ../ sequ= ences in the URL path, which are concatenated directly to the configured we=
b root in HttpBuilder::buildResponse() without normalization, dot-segment r= emoval, or boundary checks. Attackers can craft a single request with ../ s= equences that pass through the URL parser unchanged and reach the filesyste=
m call via HttpFile::setFile(), exposing sensitive files such as credential=
stores and private keys when the server process runs as root.</td> <td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67185" target=3D= "_blank" rel=3D"noopener">CVE-2026-67185</a></td>
</tr>

<td class=3D"vendor-product">github--github-mcp-server</td>
<td>GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the = CompletionsHandler function in pkg/github/server.go accesses params.Ref wit= hout first checking whether it is nil, so a completion/complete request wit=
h a missing or empty ref field triggers a nil pointer dereference and a Go = runtime panic; because the crash occurs before any authentication or token = validation, any unauthenticated client able to send JSON-RPC messages can c= rash the server, resulting in a complete denial of service. This issue is f= ixed in version 1.1.0.</td>
<td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-47427" target=3D= "_blank" rel=3D"noopener">CVE-2026-47427</a></td>
</tr>

<td class=3D"vendor-product">GitLab--GitLab</td>
<td>GitLab has remediated an issue in GitLab CE/EE affecting all versions f= rom 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that und=
er certain conditions could have allowed an authenticated user to modify CI= /CD configuration belonging to another user due to improper validation of u= ser-supplied attributes when processing pipeline schedule inputs.</td> <td>2026-07-29</td>
<td>8.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12436" target=3D= "_blank" rel=3D"noopener">CVE-2026-12436</a></td>
</tr>

<td class=3D"vendor-product">GitLab--GitLab</td>
<td>GitLab has remediated an issue in GitLab CE/EE affecting all versions f= rom 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that u= nder certain conditions could have allowed an authenticated user with Devel= oper role to access unauthorized information due to insufficient access con= trols on internal request handling.</td>
<td>2026-07-29</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-6267" target=3D"= _blank" rel=3D"noopener">CVE-2026-6267</a></td>
</tr>

<td class=3D"vendor-product">GitLab--GitLab</td>
<td>GitLab has remediated an issue in GitLab CE/EE affecting all versions f= rom 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that und=
er certain conditions could have allowed an unauthenticated user to cause a=
denial of service due to insufficient resource throttling when processing = merge request discussions.</td>
<td>2026-07-29</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15975" target=3D= "_blank" rel=3D"noopener">CVE-2026-15975</a></td>
</tr>

<td class=3D"vendor-product">gitpython-developers--GitPython</td>
<td>GitPython 3.1.50 fails to recognize joined short-option forms such as -= u&lt;value&gt; (the short form of --upload-pack=3D&lt;value&gt;) when enfor= cing its default unsafe-option gate. When an application passes attacker-in= fluenced clone options into Repo.clone_from(..., multi_options=3D..., allow= _unsafe_options=3DFalse), an attacker can supply -u&lt;helper&gt; to bypass=
the gate that blocks --upload-pack/-u, causing Git to execute the specifie=
d helper command during clone. Fixed in 3.1.51.</td>
<td>2026-08-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67324" target=3D= "_blank" rel=3D"noopener">CVE-2026-67324</a></td>
</tr>

<td class=3D"vendor-product">gitpython-developers--GitPython</td>
<td>GitPython before 3.1.51 fails to guard against dangerous Git options pa= ssed as keyword arguments in Repo.archive() and git.ls_remote(), allowing c= ommand injection via options such as --exec/--upload-pack (leading to arbit= rary command execution). Additionally, Repo.iter_commits() and Repo.blame()=
do not check for leading-dash revision arguments, so a revision like --out= put=3D&lt;path&gt; can cause Git to open and truncate an arbitrary file. Ex= ploitation requires an application that passes attacker-controlled argument=
s to these methods.</td>
<td>2026-08-01</td>
<td>8.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67323" target=3D= "_blank" rel=3D"noopener">CVE-2026-67323</a></td>
</tr>

<td class=3D"vendor-product">gitpython-developers--GitPython</td>
<td>GitPython before 3.1.51 contains an incomplete command injection blockl= ist that fails to account for git's long-option prefix abbreviation feature=
. Attackers can bypass the unsafe options guard by using abbreviated option=
names like upload_p instead of upload_pack, which git resolves to dangerou=
s options and executes arbitrary commands.</td>
<td>2026-08-01</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67325" target=3D= "_blank" rel=3D"noopener">CVE-2026-67325</a></td>
</tr>

<td class=3D"vendor-product">gitpython-developers--GitPython</td>
<td>GitPython before 3.1.52 is vulnerable to environment-variable exfiltrat= ion in Repo.clone_from(). The caller-supplied remote URL is passed through = Git.polish_url(), which on non-Cygwin platforms calls os.path.expandvars() =
on the URL before invoking git clone. An attacker who controls the clone UR=
L can embed $NAME or ${NAME} tokens that are expanded to the values of the = hosting process's environment variables (e.g., AWS_SECRET_ACCESS_KEY or GIT= HUB_TOKEN). The resulting URL, now containing the secret, is transmitted ov=
er the network to an attacker-controlled host during the clone attempt, dis= closing the secret.</td>
<td>2026-08-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67322" target=3D= "_blank" rel=3D"noopener">CVE-2026-67322</a></td>
</tr>

<td class=3D"vendor-product">gitpython-developers--GitPython</td>
<td>GitPython before 3.1.50 fails to validate newline characters in the sec= tion parameter of config_writer(), allowing attackers to inject arbitrary s= ection headers into .git/config. Attackers can inject newlines to create a = forged [core] section with hooksPath pointing to attacker-controlled direct= ories, achieving remote code execution when git hooks are triggered.</td> <td>2026-08-01</td>
<td>7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67326" target=3D= "_blank" rel=3D"noopener">CVE-2026-67326</a></td>
</tr>

<td class=3D"vendor-product">Gladinet--CentreStack</td>
<td>CentreStack before 17.5 contains a hardcoded cryptographic key vulnerab= ility that allows unauthenticated attackers to forge arbitrary encrypted to= kens by exploiting a static SysNumber value used as entropy for AccessTicke= t.Encrypt() and AccessTicket.Decrypt() across all installations. Attackers = can use the hardcoded key to craft valid x-glad-auth headers and call privi= leged API endpoints such as acquiretenantbackuptoken to obtain a domain adm= inistrator IdentityTicket, enabling a complete unauthenticated remote code = execution chain.</td>
<td>2026-07-30</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54363" target=3D= "_blank" rel=3D"noopener">CVE-2026-54363</a></td>
</tr>

<td class=3D"vendor-product">Gladinet--CentreStack</td>
<td>CentreStack before 17.2 contains an authentication bypass vulnerability=
that allows unauthenticated attackers to read, write, or delete arbitrary = account settings by exploiting exposed API endpoints that lack authorizatio=
n checks. Attackers can generate valid encrypted EntAcctId values using the=
static shared encryption key to forge identifiers for any user GUID, inclu= ding the system-wide cluster settings account, enabling enumeration of host=
ed tenant domains and administrator identities.</td>
<td>2026-07-30</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54367" target=3D= "_blank" rel=3D"noopener">CVE-2026-54367</a></td>
</tr>

<td class=3D"vendor-product">Gladinet--CentreStack</td>
<td>CentreStack before 17.4 contains a SQL injection vulnerability in GladD= BFiles.SearchEx() and SearchExUnder() that allows authenticated attackers t=
o execute arbitrary SQL statements by supplying a crafted x-glad-filter req= uest header through the jsondir API endpoint. Attackers can exploit unsanit= ized interpolation of the Field parameter directly into SQL query strings t=
o write arbitrary files to the server filesystem via PostgreSQL lo_from_byt= ea() and lo_export() functions, enabling remote code execution.</td> <td>2026-07-30</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54368" target=3D= "_blank" rel=3D"noopener">CVE-2026-54368</a></td>
</tr>

<td class=3D"vendor-product">Gladinet--CentreStack</td>
<td>CentreStack before 17.3 contains an unauthenticated deserialization vul= nerability in GSNamespace.dll that allows unauthenticated attackers to crea=
te arbitrary local OS user accounts by supplying a crafted base64-encoded X=
ML string to exposed API endpoints. Attackers can send a malicious StorageC= onfigure parameter to the jsonimportuserbyupn, jsonimportuserbyupnex, or ja= piimportuserbyupn endpoints to trigger InternalImportAdUserByUPN(), causing=
GladinetCloudMonitor.exe to invoke the NetUserAdd Windows API with attacke= r-controlled credentials and create arbitrary directories on the server fil= esystem.</td>
<td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54365" target=3D= "_blank" rel=3D"noopener">CVE-2026-54365</a></td>
</tr>

<td class=3D"vendor-product">Gladinet--CentreStack</td>
<td>CentreStack before 17.4 contains an XML external entity (XXE) injection=
vulnerability that allows unauthenticated attackers to exfiltrate arbitrar=
y files by supplying a malicious URL to the SharePoint storage configuratio=
n handler. Attackers can send a crafted request to the unauthenticated Stor= ageConfig endpoint causing the server to fetch and parse attacker-controlle=
d XML containing external DTD references, resulting in out-of-band file exf= iltration of sensitive files such as Web.config, which may contain database=
credentials and cryptographic key material.</td>
<td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54366" target=3D= "_blank" rel=3D"noopener">CVE-2026-54366</a></td>
</tr>

<td class=3D"vendor-product">gm_alex--User Access Manager</td>
<td>The User Access Manager plugin for WordPress is vulnerable to Directory=
Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile=
' parameter parameter. This makes it possible for unauthenticated attackers=
to read the contents of arbitrary files on the server, which can contain s= ensitive information. This is possible because when attachment_url_to_posti= d() returns 0 for a traversal path, the plugin falls back to the global pos=
t set by a valid ?attachment_id parameter supplied by the attacker, causing=
the access check to pass against a legitimate public attachment while the = file streamed is the attacker-chosen path.</td>
<td>2026-08-01</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18352" target=3D= "_blank" rel=3D"noopener">CVE-2026-18352</a></td>
</tr>

<td class=3D"vendor-product">GNOME--GIMP</td>
<td>A flaw was found in the file-fits plugin in GIMP. When processing a FIT=
S image file, the plugin calculates memory allocation sizes using signed 32= -bit integers for width and height. If a crafted file sets both values to l= arge values, their product exceeds 2^31 and overflows, resulting in an unde= rsized heap-based buffer allocation. This integer overflow issue results in=
a heap-based buffer overflow when cfitsio subsequently writes a full row o=
f pixels in the buffer, causing memory corruption, potentially leading to a= rbitrary code execution or a denial of service.</td>
<td>2026-07-27</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66758" target=3D= "_blank" rel=3D"noopener">CVE-2026-66758</a></td>
</tr>

<td class=3D"vendor-product">GNOME--GIMP</td>
<td>A flaw was found in the file-icns plugin in GIMP. When applying a decom= pressed mask during ICNS image processing, the plugin reads from the mask d= ata buffer without verifying if the cursor exceeds the allocated resource s= ize. If a crafted file contains a truncated mask resource, the icns_decompr= ess function continues reading past the bounds of the buffer. This out-of-b= ounds read vulnerability results in information disclosure of heap contents=
, where memory contents are leaked as alpha channel pixel values, or a cras=
h leading to a denial of service if unmapped memory is accessed.</td> <td>2026-07-27</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66759" target=3D= "_blank" rel=3D"noopener">CVE-2026-66759</a></td>
</tr>

<td class=3D"vendor-product">GNOME--gnome-remote-desktop</td>
<td>A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterpri=
se Linux. When the daemon is running in system mode with RDP enabled, the i= ncoming connection handler bypasses the connection throttler, allowing an u= nauthenticated remote attacker to open many parallel pre-authentication con= nections to the RDP listener. This can accumulate accepted sockets and pend= ing routing-token operations until timeout, exhausting resources and preven= ting legitimate users from establishing RDP sessions. This issue does not a= ffect the upstream version.</td>
<td>2026-07-31</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18358" target=3D= "_blank" rel=3D"noopener">CVE-2026-18358</a></td>
</tr>

<td class=3D"vendor-product">go-vikunja--vikunja</td>
<td>Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal ty=
pe in API token management. Because user IDs and link-share IDs are indepen= dent numeric sequences and both resolve through a generic web.Auth.GetID() = interface, a link-share JWT whose numeric ID equals a target user's ID is t= reated as that user by the /api/v1/tokens endpoints. An authenticated attac= ker can obtain a target's numeric user ID via authenticated user search, th=
en create link shares on an attacker-writable project until the link-share = sequence reaches that value, and use the resulting link-share JWT to list, = create, and delete the target user's API tokens (including issuing a new to= ken with attacker-chosen scopes under the target's permissions). Fixed in v= ersion 2.4.0.</td>
<td>2026-08-02</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-68581" target=3D= "_blank" rel=3D"noopener">CVE-2026-68581</a></td>
</tr>

<td class=3D"vendor-product">goshs-labs--goshs</td>
<td>goshs is a feature-rich single-binary file server for red teamers and d= evelopers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password ha= ndler used Username !=3D "" &amp;&amp; Password !=3D "", so running goshs w= ith -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers un= set and allowed unauthenticated file access. This issue is fixed in version=
2.1.4.</td>
<td>2026-07-28</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62325" target=3D= "_blank" rel=3D"noopener">CVE-2026-62325</a></td>
</tr>

<td class=3D"vendor-product">goshs-labs--goshs</td>
<td>goshs is a feature-rich single-binary file server for red teamers and d= evelopers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV = MOVE as a write-only method and did not enforce --no-delete, allowing WebDA=
V clients to delete or overwrite files via MOVE with Overwrite: T. This iss=
ue is fixed in version 2.1.4.</td>
<td>2026-07-28</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64863" target=3D= "_blank" rel=3D"noopener">CVE-2026-64863</a></td>
</tr>

<td class=3D"vendor-product">goshs-labs--goshs</td>
<td>goshs is a feature-rich single-binary file server for red teamers and d= evelopers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler fo=
r ?bulk&amp;file=3D ZIP downloads did not call findEffectiveACL or applyCus= tomAuth, allowing unauthenticated reads of files protected only by .goshs f= older ACLs and block lists. This issue is fixed in version 2.1.1. This vuln= erability exists due to an incomplete fix for CVE-2026-40189.</td> <td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54719" target=3D= "_blank" rel=3D"noopener">CVE-2026-54719</a></td>
</tr>

<td class=3D"vendor-product">gotd--td</td>
<td>gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, pro= to.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker = controlled dataLen from an unauthenticated MTProto unencrypted packet and a= llocated make([]byte, dataLen) before checking the remaining buffer, allowi=
ng remote unauthenticated denial of service through excessive memory alloca= tion and CPU or garbage collection pressure. This issue is fixed in version=
0.145.1.</td>
<td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54638" target=3D= "_blank" rel=3D"noopener">CVE-2026-54638</a></td>
</tr>

<td class=3D"vendor-product">grisuno--LazyOwn</td>
<td>LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operatio=
ns framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenti= cated Socket.IO input event handler that dispatches data.get('value') to La= zyOwnShell.one_cmd, reaching LazyOwnShell.do_cmd and subprocess.call(comman=
d, shell=3DTrue), allowing unauthenticated remote code execution in the C2 = process. This issue is fixed in 0.2.154.</td>
<td>2026-07-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-68502" target=3D= "_blank" rel=3D"noopener">CVE-2026-68502</a></td>
</tr>

<td class=3D"vendor-product">grisuno--LazyOwn</td>
<td>LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operatio=
ns framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOw=
n and LazyOwn in payload.json and core/payload_schema.py and passes them un= changed to lazyc2.py HTTP Basic authentication, allowing any network-reacha= ble attacker who knows the defaults to authenticate to the C2 dashboard wit=
h operator-level access. This issue is fixed in 0.2.154.</td>

<td>2026-07-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-68503" target=3D= "_blank" rel=3D"noopener">CVE-2026-68503</a></td>
</tr>

<td class=3D"vendor-product">HashiCorp--Tooling</td>
<td>In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isola=
te session state in stateless mode, which may allow one client's Consul aut= hentication token to be used for subsequent requests from other clients. Th=
is vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.</td> <td>2026-07-29</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16326" target=3D= "_blank" rel=3D"noopener">CVE-2026-16326</a></td>
</tr>

<td class=3D"vendor-product">HashiCorp--Tooling</td>
<td>The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-= tenant credential reuse issue in the streamable-HTTP stateless transport mo=
de that may allow one user's Terraform token to be used to execute tool cal=
ls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fi= xed in terraform-mcp-server 1.1.0.</td>
<td>2026-07-28</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16498" target=3D= "_blank" rel=3D"noopener">CVE-2026-16498</a></td>
</tr>

<td class=3D"vendor-product">HashiCorp--Tooling</td>
<td>The terraform-mcp-server before version 1.1.0 is vulnerable to a server= -side request forgery issue in the streamable-HTTP transport that may allow=
an unauthenticated remote client to redirect the server's Terraform API re= quests, and the server-side authorization token, to an attacker-controlled = endpoint. This vulnerability, CVE-2026-14869, is fixed in terraform-mcp-ser= ver 1.1.0.</td>
<td>2026-07-28</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14869" target=3D= "_blank" rel=3D"noopener">CVE-2026-14869</a></td>
</tr>

<td class=3D"vendor-product">HashiCorp--Tooling</td>
<td>In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how t=
he Consul backend address was supplied, allowing a connected client to over= ride the server's configured Consul address via a request header. This may = allow a malicious client to redirect the server's Consul API traffic to an = attacker-controlled endpoint, potentially exfiltrating the Consul token con= figured on the server. This vulnerability, CVE-2026-16328, is fixed in cons= ul-mcp-server 0.1.4.</td>
<td>2026-07-29</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16328" target=3D= "_blank" rel=3D"noopener">CVE-2026-16328</a></td>
</tr>

<td class=3D"vendor-product">HashiCorp--Tooling</td>
<td>The terraform-mcp-server before version 1.1.0 is vulnerable to an autho= rization bypass in the streamable-HTTP stateful transport mode that may all=
ow a user who obtains another user's MCP session ID to have their tool call=
s executed using that user's Terraform credentials. This vulnerability, CVE= -2026-16496, is fixed in terraform-mcp-server 1.1.0.</td>
<td>2026-07-28</td>
<td>8.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16496" target=3D= "_blank" rel=3D"noopener">CVE-2026-16496</a></td>
</tr>

<td class=3D"vendor-product">Hikvision--DS-3WAP521-SI</td>
<td>Some Hikvision Networking Products are vulnerable to authenticated comm= and execution due to insufficient input validation. Attackers with valid cr= edentials can exploit this flaw by sending crafted packets containing malic= ious commands to affected devices, leading to arbitrary command execution.<=

<td>2026-07-31</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16843" target=3D= "_blank" rel=3D"noopener">CVE-2026-16843</a></td>
</tr>

<td class=3D"vendor-product">holest--Spreadsheet Price Changer for WooComme= rce and WP E-commerce Light</td>
<td>The Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light=
plugin for WordPress is vulnerable to Missing Authorization in all version=
s up to, and including, 2.4.37 vi the user_filter function. This makes it p= ossible for unauthenticated attackers to create admin accounts.</td> <td>2026-07-29</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-10656" target=3D= "_blank" rel=3D"noopener">CVE-2025-10656</a></td>
</tr>

<td class=3D"vendor-product">Hugging Face--sentence-transformers</td> <td>sentence-transformers contains a security control bypass vulnerability = that allows attackers to achieve arbitrary code execution by exploiting a l= ogic flaw in the import_module_class helper within sentence_transformers/ut= il/misc.py, where the guard condition includes an 'or os.path.exists(model_= name_or_path)' clause that satisfies the trust gate whenever the supplied p= ath exists on the local filesystem, regardless of the trust_remote_code=3DF= alse argument. Attackers who can control or influence the contents of a mod=
el directory on disk can place malicious Python files such as modeling_*.py=
referenced via modules.json, causing the code to execute at import time wh=
en an application loads the model with SentenceTransformer(path, trust_remo= te_code=3DFalse), bypassing the documented security contract and achieving = code execution within the loading process.</td>
<td>2026-07-31</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-68770" target=3D= "_blank" rel=3D"noopener">CVE-2026-68770</a></td>
</tr>

<td class=3D"vendor-product">hypequery--hypequery</td>
<td>Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.0.2=
, escapeValue() in packages/clickhouse/src/core/utils.ts did not escape bac= kslashes before single quotes during parameter substitution, allowing attac= ker controlled query parameters with a trailing backslash to escape the clo= sing quote and inject arbitrary SQL. This issue is fixed in version 2.0.2.<=

<td>2026-07-28</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54658" target=3D= "_blank" rel=3D"noopener">CVE-2026-54658</a></td>
</tr>

<td class=3D"vendor-product">IBM--App Connect Enterprise</td>
<td>IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 thro= ugh 12.0.12.27 could allow a remote attacker to traverse directories on the=
system. An attacker could send a specially crafted URL request containing = "dot dot" sequences (/../) to write arbitrary files on the system.</td> <td>2026-07-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15435" target=3D= "_blank" rel=3D"noopener">CVE-2026-15435</a></td>
</tr>

<td class=3D"vendor-product">IBM--App Connect Enterprise</td>
<td>IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 thro= ugh 12.0.12.27 could allow a remote attacker to execute arbitrary commands = due to improper neutralization of CRLF characters.</td>
<td>2026-07-30</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14522" target=3D= "_blank" rel=3D"noopener">CVE-2026-14522</a></td>
</tr>

<td class=3D"vendor-product">IBM--App Connect Enterprise</td>
<td>IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 thro= ugh 12.0.12.27 stores potentially sensitive information in log files that c= ould be read by a local user.</td>
<td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12947" target=3D= "_blank" rel=3D"noopener">CVE-2026-12947</a></td>
</tr>

<td class=3D"vendor-product">IBM--App Connect Enterprise</td>
<td>IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 thro= ugh 12.0.12.27 could allow a remote attacker to read arbitrary files due to=
a path traversal vulnerability.</td>
<td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14519" target=3D= "_blank" rel=3D"noopener">CVE-2026-14519</a></td>
</tr>

<td class=3D"vendor-product">IBM--Aspera Desktop App</td>
<td>IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can = allow files to be written outside of the user's selected download destinati= on.</td>
<td>2026-07-28</td>
<td>9.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14973" target=3D= "_blank" rel=3D"noopener">CVE-2026-14973</a></td>
</tr>

<td class=3D"vendor-product">IBM--Aspera Desktop App</td>
<td>IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code ex= ecution by loading DLL files at start-up.</td>
<td>2026-07-30</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11980" target=3D= "_blank" rel=3D"noopener">CVE-2026-11980</a></td>
</tr>

<td class=3D"vendor-product">IBM--Aspera Faspex 5</td>
<td>IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authent= icated attacker to execute arbitrary code due to unquoted shell interpolati= on.</td>
<td>2026-07-28</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14958" target=3D= "_blank" rel=3D"noopener">CVE-2026-14958</a></td>
</tr>

<td class=3D"vendor-product">IBM--Aspera Faspex 5</td>
<td>IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authent= icated attacker to execute arbitrary code due to shell command injection.</=

<td>2026-07-28</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14959" target=3D= "_blank" rel=3D"noopener">CVE-2026-14959</a></td>
</tr>

<td class=3D"vendor-product">IBM--Aspera Faspex 5</td>
<td>IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerabilit=
y related to session management.</td>
<td>2026-07-28</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14996" target=3D= "_blank" rel=3D"noopener">CVE-2026-14996</a></td>
</tr>

<td class=3D"vendor-product">IBM--Cloud Pak System</td>
<td>IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sen= sitive information due to the insertion of credentials into log files.</td> <td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13463" target=3D= "_blank" rel=3D"noopener">CVE-2026-13463</a></td>
</tr>

<td class=3D"vendor-product">IBM--DataPower Gateway 10.6CD</td>
<td>IBM DataPower Gateway could allow a remote attacker to cause a denial o=
f service due to improper resource limitations.</td>
<td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12733" target=3D= "_blank" rel=3D"noopener">CVE-2026-12733</a></td>
</tr>

<td class=3D"vendor-product">IBM--Db2</td>
<td>IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable =
to buffer overflow in setgid helper db2flacc.</td>
<td>2026-07-30</td>
<td>8.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10535" target=3D= "_blank" rel=3D"noopener">CVE-2026-10535</a></td>
</tr>

<td class=3D"vendor-product">IBM--Engineering Requirements Management DOORS=
and DOORS Web Access</td>
<td>IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.= 2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 do not limit the length =
of a connection which could allow for a Slowloris HTTP denial of service at= tack to take place. This can cause the web server to become unresponsive.</=

<td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2024-25039" target=3D= "_blank" rel=3D"noopener">CVE-2024-25039</a></td>
</tr>

<td class=3D"vendor-product">IBM--Enterprise Build of Quarkus</td>
<td>IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 t= hrough 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a den= ial of service due to unbounded accumulation of multipart MIME part-header = bytes.</td>
<td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16308" target=3D= "_blank" rel=3D"noopener">CVE-2026-16308</a></td>
</tr>

<td class=3D"vendor-product">IBM--HMC V10.3.1050.0</td>
<td>IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 throu=
gh 11.1.1112.0 Management systems in IBM Power environments (HMC and Novali= nk) could allow an unauthenticated user to execute arbitrary commands with = elevated privileges on the system due to improper validation of user suppli=
ed input.</td>
<td>2026-07-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12943" target=3D= "_blank" rel=3D"noopener">CVE-2026-12943</a></td>
</tr>

<td class=3D"vendor-product">IBM--Langflow OSS</td>
<td>IBM Langflow OSS 1.0.0 through 1.10.1=C2=A0 are vulnerable to unauthent= icated remote code execution via environment variable injection in the MCP = (Model Context Protocol) stdio launcher. The vulnerability exists in src/lf= x/src/lfx/base/mcp/util.py where the DANGEROUS_ENV_VARS blocklist fails to = include SHELLOPTS , BASHOPTS , and PS4 environment variables.</td> <td>2026-07-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12940" target=3D= "_blank" rel=3D"noopener">CVE-2026-12940</a></td>
</tr>

<td class=3D"vendor-product">IBM--Langflow OSS</td>
<td>IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to = inject arbitrary code on the system, due to the improper control of user in= put code.</td>
<td>2026-07-30</td>
<td>9.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12946" target=3D= "_blank" rel=3D"noopener">CVE-2026-12946</a></td>
</tr>

<td class=3D"vendor-product">IBM--Langflow OSS</td>
<td>IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input valida= tion vulnerability in the PythonREPL sandbox implementation.</td> <td>2026-07-30</td>
<td>9.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13435" target=3D= "_blank" rel=3D"noopener">CVE-2026-13435</a></td>
</tr>

<td class=3D"vendor-product">IBM--Langflow OSS</td>
<td>IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to = traverse directories on the system. An attacker could send a specially craf= ted URL request containing "dot dot " sequences ( /.. /) to view arbitrary = files on the system.</td>
<td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12942" target=3D= "_blank" rel=3D"noopener">CVE-2026-12942</a></td>
</tr>

<td class=3D"vendor-product">IBM--Langflow OSS</td>
<td>IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to acc= ess and manipulate other users' build jobs through improper access control =
on log retrieval and unauthenticated build endpoints.</td>
<td>2026-07-30</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12945" target=3D= "_blank" rel=3D"noopener">CVE-2026-12945</a></td>
</tr>

<td class=3D"vendor-product">IBM--Langflow OSS</td>
<td>IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse an= other user's FAISS namespace to access owner-only vector content and influe= nce later query results. This causes cross-user information disclosure and = limited integrity impact through persistent poisoning of returned results.<=

<td>2026-07-28</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13442" target=3D= "_blank" rel=3D"noopener">CVE-2026-13442</a></td>
</tr>

<td class=3D"vendor-product">IBM--Observability with Instana (Agent)</td> <td>IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IB=
M Instana Node.js tracer component @instana/core version 6.2.1 is vulnerabl=
e to prototype pollution through its configuration normalization API.</td> <td>2026-07-28</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14893" target=3D= "_blank" rel=3D"noopener">CVE-2026-14893</a></td>
</tr>

<td class=3D"vendor-product">IBM--Planning Analytics Local</td>
<td>IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an o= pen redirect that allows an attacker to redirect users to arbitrary externa=
l websites via a crafted URL. If used in SSO authentication flows, this cou=
ld result in exposure of session tokens and allow attackers to hijack user = sessions.</td>
<td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10545" target=3D= "_blank" rel=3D"noopener">CVE-2026-10545</a></td>
</tr>

<td class=3D"vendor-product">IBM--PowerVM Hypervisor</td>
<td>IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through F= W1060.71, and FW950.00 through FW950.H1 A carefully crafted OS hypervisor c= all can cause the PowerVM hypervisor to crash or compromise OS memory integ= rity.</td>
<td>2026-07-30</td>
<td>8.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11885" target=3D= "_blank" rel=3D"noopener">CVE-2026-11885</a></td>
</tr>

<td class=3D"vendor-product">IBM--Sterling B2B Integrator</td>
<td>IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through = 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.= 0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2= .0_1 is vulnerable to SQL injection. A remote attacker could send specially=
crafted SQL statements, which could allow the attacker to view, add, modif=
y, or delete information in the back-end database.</td>
<td>2026-07-28</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7769" target=3D"= _blank" rel=3D"noopener">CVE-2026-7769</a></td>
</tr>

<td class=3D"vendor-product">IBM--Tivoli System Automation Application Mana= ger</td>
<td>IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere = Application Server is affected by a cross-site scripting vulnerability in t=
he administrative console login page.</td>
<td>2026-07-30</td>
<td>9.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11707" target=3D= "_blank" rel=3D"noopener">CVE-2026-11707</a></td>
</tr>

<td class=3D"vendor-product">IBM--webMethods Integration (on prem)</td>

<td>IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauth= enticated remote attacker to execute arbitrary code on the system due to th=
e deserialization of untrusted data.</td>
<td>2026-07-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12118" target=3D= "_blank" rel=3D"noopener">CVE-2026-12118</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server</td>
<td>IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken a= ccess control/privilege escalation in the administrative console.</td>

<td>2026-07-28</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14446" target=3D= "_blank" rel=3D"noopener">CVE-2026-14446</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server</td>
<td>IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable=
to pre-authentication unsafe deserialization which could allow a remote at= tacker to bypass authentication or execute arbitrary code.</td> <td>2026-07-28</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14512" target=3D= "_blank" rel=3D"noopener">CVE-2026-14512</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server</td>
<td>IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Applica= tion Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable t=
o server-side request forgery (SSRF) when the SIP container feature (sipSer= vlet-1.1) is enabled.</td>
<td>2026-07-29</td>
<td>9.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14529" target=3D= "_blank" rel=3D"noopener">CVE-2026-14529</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server</td>
<td>IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote c= ode execution vulnerability in the SOAP/JMX connector.</td>
<td>2026-07-30</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11536" target=3D= "_blank" rel=3D"noopener">CVE-2026-11536</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server</td>
<td>IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a=
remote attacker to execute arbitrary code caused by unsafe deserialization=
of untrusted data.</td>
<td>2026-07-28</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14974" target=3D= "_blank" rel=3D"noopener">CVE-2026-14974</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server</td>
<td>IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Applica= tion Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP Respo= nse Smuggling due to improper handling of non-standard HTTP version tokens.= </td>
<td>2026-07-28</td>
<td>8.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15064" target=3D= "_blank" rel=3D"noopener">CVE-2026-15064</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server</td>
<td>IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Applica= tion Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP reque=
st smuggling due to improper handling of TRACE requests.</td> <td>2026-07-28</td>
<td>8.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15325" target=3D= "_blank" rel=3D"noopener">CVE-2026-15325</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server</td>
<td>IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Applica= tion Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty cou=
ld allow a remote attacker to bypass security constraints.</td> <td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10842" target=3D= "_blank" rel=3D"noopener">CVE-2026-10842</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server</td>
<td>IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a=
remote attacker to obtain sensitive information.</td>
<td>2026-07-28</td>
<td>7.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14528" target=3D= "_blank" rel=3D"noopener">CVE-2026-14528</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server</td>
<td>IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Applica= tion Server - Liberty 17.0.0.3 through 26.0.0.7 are affected by a denial of=
service vulnerability in the HTTP channel due to unbounded allocation of r= esources without limits.</td>
<td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14981" target=3D= "_blank" rel=3D"noopener">CVE-2026-14981</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server</td>
<td>IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Applica= tion Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP reque=
st smuggling.</td>
<td>2026-07-28</td>
<td>7.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15328" target=3D= "_blank" rel=3D"noopener">CVE-2026-15328</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server</td>
<td>IBM WebSphere Application Server 9.0, and 8.5 could allow a remote atta= cker to bypass authentication by sending a crafted unauthenticated request.= </td>
<td>2026-07-28</td>
<td>7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16184" target=3D= "_blank" rel=3D"noopener">CVE-2026-16184</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server</td>
<td>IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Applica= tion Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial =
of service via a crafted HTTP request.</td>
<td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9322" target=3D"= _blank" rel=3D"noopener">CVE-2026-9322</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server - Liberty</t=

<td>IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is=
vulnerable to cross-site request forgery which could allow an attacker to = perform SSRF attacks with elevated privileges when the collectiveController= -1.0 feature is enabled.</td>
<td>2026-07-30</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14980" target=3D= "_blank" rel=3D"noopener">CVE-2026-14980</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server - Liberty</t=

<td>IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is=
vulnerable to a denial of service, caused by sending a specially crafted r= equest. A remote attacker could exploit this vulnerability to cause the ser= ver to consume memory resources.</td>
<td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11897" target=3D= "_blank" rel=3D"noopener">CVE-2026-11897</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server - Liberty</t=

<td>IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is=
affected by remote code execution with the collectiveController-1.0 featur=
e enabled.</td>
<td>2026-07-28</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14976" target=3D= "_blank" rel=3D"noopener">CVE-2026-14976</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server - Liberty</t=

<td>IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is=
vulnerable to a denial of service due to uncontrolled heap allocation.</td=

<td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15057" target=3D= "_blank" rel=3D"noopener">CVE-2026-15057</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server - Liberty</t=

<td>IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND=
Collective Controller is affected by a path-segment injection vulnerabilit=
y in the collective routing mechanism.</td>
<td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15280" target=3D= "_blank" rel=3D"noopener">CVE-2026-15280</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server - Liberty</t=

<td>IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is=
affected by a denial of service vulnerability when the restConnector-2.0 f= eature is enabled.</td>
<td>2026-07-28</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16192" target=3D= "_blank" rel=3D"noopener">CVE-2026-16192</a></td>
</tr>

<td class=3D"vendor-product">Innotim Software, Telecommunications and Consu= lting Trade Ltd. Co.--Logsign SIEM</td>
<td>Improper Control of Generation of Code ('Code Injection') vulnerability=
in Innotim Software, Telecommunications and Consulting Trade Ltd. Co. Logs= ign SIEM allows Code Injection. This issue affects Logsign SIEM: before 6.4= .108.</td>
<td>2026-07-31</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17561" target=3D= "_blank" rel=3D"noopener">CVE-2026-17561</a></td>
</tr>

<td class=3D"vendor-product">JetBrains--TeamCity</td>
<td>In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote=
code execution was possible via the agent polling protocol</td> <td>2026-07-27</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63077" target=3D= "_blank" rel=3D"noopener">CVE-2026-63077</a></td>
</tr>

<td class=3D"vendor-product">jfrog--artifactory</td>
<td>JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable=
to a privilege escalation attack due to a validation check of the token si= gnature/issuer and not the token's scope.</td>
<td>2026-07-27</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-42016" target=3D= "_blank" rel=3D"noopener">CVE-2026-42016</a></td>
</tr>

<td class=3D"vendor-product">jfrog--artifactory</td>
<td>An event-handling weakness in JFrog Artifactory could expose privileged=
authorization material to a lower-privileged user under specific condition= s.</td>
<td>2026-07-27</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-42017" target=3D= "_blank" rel=3D"noopener">CVE-2026-42017</a></td>
</tr>

<td class=3D"vendor-product">jfrog--artifactory</td>
<td>Incorrect authorization validation in refresh token signature allows no= n-admin users to obtain a signed JFrog administrator token.</td> <td>2026-07-27</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65616" target=3D= "_blank" rel=3D"noopener">CVE-2026-65616</a></td>
</tr>

<td class=3D"vendor-product">jfrog--artifactory</td>
<td>A deserialization weakness in JFrog Artifactory package handling could = allow a low-privileged user to impact confidentiality, integrity, and avail= ability under specific repository conditions.</td>
<td>2026-07-27</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65617" target=3D= "_blank" rel=3D"noopener">CVE-2026-65617</a></td>
</tr>

<td class=3D"vendor-product">jfrog--artifactory</td>
<td>A path validation weakness in archive extraction/write handling allows = entries with traversal sequences to be written outside the intended build a= rtifacts location.</td>
<td>2026-07-27</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65921" target=3D= "_blank" rel=3D"noopener">CVE-2026-65921</a></td>
</tr>

<td class=3D"vendor-product">jfrog--artifactory</td>
<td>JFrog Artifactory contains an authentication handling weakness in inter= nal request processing that, under specific conditions, may allow an attack=
er to escalate privileges beyond the intended access level.</td> <td>2026-07-27</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66014" target=3D= "_blank" rel=3D"noopener">CVE-2026-66014</a></td>
</tr>

<td class=3D"vendor-product">jfrog--artifactory</td>
<td>An authorization weakness in JFrog Artifactory internal metadata handli=
ng could allow a user with limited repository access to write to restricted=
internal metadata areas under specific conditions. Successful abuse is lim= ited to integrity and availability impact at a low level; confidentiality i=
s not affected.</td>
<td>2026-07-27</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65922" target=3D= "_blank" rel=3D"noopener">CVE-2026-65922</a></td>
</tr>

<td class=3D"vendor-product">jfrog--artifactory</td>
<td>An authenticated privilege-escalation vulnerability in JFrog Platform m=
ay be exploited under admin-provisioned account conditions. Successful expl= oitation may grant temporary platform administrator access.</td> <td>2026-07-27</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66015" target=3D= "_blank" rel=3D"noopener">CVE-2026-66015</a></td>
</tr>

<td class=3D"vendor-product">jgwhite33--WP Google Review Slider</td> <td>Administrator SQL Injection in WP Google Review Slider &lt;=3D 18.4 ver= sions.</td>
<td>2026-07-27</td>
<td>7.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66427" target=3D= "_blank" rel=3D"noopener">CVE-2026-66427</a></td>
</tr>

<td class=3D"vendor-product">John Darrel--Hide My WP Ghost</td>
<td>Subscriber Broken Authentication in Hide My WP Ghost &lt;=3D 7.0.06 ver= sions.</td>
<td>2026-07-27</td>
<td>7.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59546" target=3D= "_blank" rel=3D"noopener">CVE-2026-59546</a></td>
</tr>

<td class=3D"vendor-product">juev--nebula-mesh</td>
<td>Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VP=
N. In versions 0.3.5 and below, the web UI (/ui/*) does not apply the per-o= perator CA scoping employed by the JSON API. This was partially addressed b=
y GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web read= /mutation surface. Any authenticated non-admin operator (for example, one c= reated via self-registration or OIDC) can access resources belonging to oth=
er operators. The host create/edit/mobile-bundle/network-create paths and a=
ll CA-management routes were already correctly scoped. A malicious operator=
could block or delete any other operator's host, or read any operator's ho= sts and networks. This issue has been fixed in version 0.3.6.</td> <td>2026-07-28</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-49258" target=3D= "_blank" rel=3D"noopener">CVE-2026-49258</a></td>
</tr>

<td class=3D"vendor-product">julep-ai--julep</td>
<td>Julep contains an insecure direct object reference vulnerability in the=
get_execution_details endpoint that allows authenticated tenants to read a= nother tenant's execution data. Attackers can supply arbitrary execution_id=
values to retrieve sensitive execution records including task inputs, outp= uts, metadata, and temporal task tokens from other tenants.</td>

<td>2026-07-30</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67348" target=3D= "_blank" rel=3D"noopener">CVE-2026-67348</a></td>
</tr>

<td class=3D"vendor-product">Kanboard--Kanboard</td>
<td>Kanboard 1.2.52 and prior contains a server-side request forgery vulner= ability that allows authenticated users to bypass SSRF protections by suppl= ying hexadecimal IP address notation in user-controlled URLs. Attackers can=
submit hexadecimal-encoded internal IP addresses through the web link crea= tion feature, causing cURL to resolve and connect to internal network resou= rces such as cloud instance metadata services, localhost services, and RFC1= 918 addresses while the isPrivateURL() filter in app/Core/Http/Client.php i= ncorrectly treats the input as safe due to FILTER_VALIDATE_IP rejecting non= -dotted-decimal notation.</td>
<td>2026-07-30</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57862" target=3D= "_blank" rel=3D"noopener">CVE-2026-57862</a></td>
</tr>

<td class=3D"vendor-product">Kofi Mokome--Message Filter for Contact Form 7= </td>
<td>Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contac=
t Form 7 &lt;=3D 1.6.3.9 versions.</td>
<td>2026-07-27</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65438" target=3D= "_blank" rel=3D"noopener">CVE-2026-65438</a></td>
</tr>

<td class=3D"vendor-product">koxudaxi--datamodel-code-generator</td> <td>datamodel-code-generator generates Pydantic v2 models, dataclasses, Typ= edDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protob= uf, and raw JSON, YAML, or CSV. From 0.17.0 until 0.60.2, datamodel-code-ge= nerator preserves attacker-controlled default_factory values in src/datamod= el_code_generator/parser/jsonschema.py through JsonSchemaObject.init and ge= t_field_extras and emits them into Field(default_factory=3D...) or field(de= fault_factory=3D...), allowing Python expression execution when the generat=
ed model is imported. This issue is fixed in version 0.60.2.</td> <td>2026-07-28</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54653" target=3D= "_blank" rel=3D"noopener">CVE-2026-54653</a></td>
</tr>

<td class=3D"vendor-product">koxudaxi--datamodel-code-generator</td> <td>datamodel-code-generator generates Pydantic v2 models, dataclasses, Typ= edDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protob= uf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-gen= erator silently dereferences attacker-controlled JSON Schema $ref HTTP or H= TTPS URLs in src/datamodel_code_generator/parser/jsonschema.py through _get= _ref_body, and the --allow-remote-refs gate can warn instead of blocking, a= llowing server-side request forgery through src/datamodel_code_generator/ht= tp.py. This issue is fixed in version 0.61.0.</td>
<td>2026-07-28</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54690" target=3D= "_blank" rel=3D"noopener">CVE-2026-54690</a></td>
</tr>

<td class=3D"vendor-product">koxudaxi--datamodel-code-generator</td> <td>datamodel-code-generator generates Python data models from schema defin= itions. From 0.9.1 until 0.61.0, src/datamodel_code_generator/http.py http.= get_body accepts --url targets and redirect chain targets without host/IP v= alidation, allowing server-side request forgery against loopback, private, = link-local, metadata, and other network-accessible resources. This issue is=
fixed in version 0.61.0.</td>
<td>2026-07-28</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54691" target=3D= "_blank" rel=3D"noopener">CVE-2026-54691</a></td>
</tr>

<td class=3D"vendor-product">koxudaxi--datamodel-code-generator</td> <td>datamodel-code-generator generates Python data models from schema defin= itions. Prior to 0.60.1, GraphQL Union description values in src/datamodel_= code_generator/model/template/UnionTypeStatement.jinja2 and src/datamodel_c= ode_generator/model/template/UnionTypeStatement.py312.jinja2 are rendered i= nto Python comments without neutralizing carriage returns in Python # comme= nts, allowing attacker-controlled GraphQL schema content to inject Python c= ode into generated models that runs when imported. This issue is fixed in v= ersion 0.60.1.</td>
<td>2026-07-28</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54621" target=3D= "_blank" rel=3D"noopener">CVE-2026-54621</a></td>
</tr>

<td class=3D"vendor-product">koxudaxi--datamodel-code-generator</td> <td>datamodel-code-generator generates Python data models from schema defin= itions. From 0.14.1 until 0.60.2, the --extra-template-data comment field i=
s rendered into Python comments in src/datamodel_code_generator/model/templ= ate/TypeAliasAnnotation.jinja2, src/datamodel_code_generator/model/template= /TypedDict.jinja2, src/datamodel_code_generator/model/template/dataclass.ji= nja2, src/datamodel_code_generator/model/template/msgspec.Struct.jinja2, sr= c/datamodel_code_generator/model/template/pydantic/BaseModel.jinja2, and sr= c/datamodel_code_generator/model/template/pydantic_v2/BaseModel.jinja2 with= out neutralizing carriage returns in Python # comments, allowing an attacke= r-controlled comment value to inject Python code into generated models that=
runs when imported. This issue is fixed in version 0.60.2.</td> <td>2026-07-28</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54654" target=3D= "_blank" rel=3D"noopener">CVE-2026-54654</a></td>
</tr>

<td class=3D"vendor-product">koxudaxi--datamodel-code-generator</td> <td>datamodel-code-generator generates Python data models from schema defin= itions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamo= del_code_generator/parser/jsonschema.py in _get_python_type_override are in= serted into generated field annotations without sufficient validation, allo= wing attacker-controlled JSON Schema content to execute Python code when th=
e generated module is imported. This issue is fixed in version 0.60.2.</td> <td>2026-07-28</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54655" target=3D= "_blank" rel=3D"noopener">CVE-2026-54655</a></td>
</tr>

<td class=3D"vendor-product">koxudaxi--datamodel-code-generator</td> <td>datamodel-code-generator generates Pydantic v2 models, dataclasses, Typ= edDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protob= uf, and raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-ge= nerator interpolates validators from --extra-template-data in src/datamodel= _code_generator/model/pydantic_v2/base_model.py through _process_validators=
into @field_validator decorators without safe validation, allowing Python = code execution when the generated Pydantic v2 model is imported. This issue=
is fixed in version 0.60.2.</td>
<td>2026-07-28</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54656" target=3D= "_blank" rel=3D"noopener">CVE-2026-54656</a></td>
</tr>

<td class=3D"vendor-product">koxudaxi--datamodel-code-generator</td> <td>datamodel-code-generator generates Pydantic v2 models, dataclasses, Typ= edDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protob= uf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator r= esolves JSON Schema $ref targets in src/datamodel_code_generator/parser/jso= nschema.py through is_url and _get_ref_body without containing file:// or .=
./ traversal references to the input directory and without honoring --no-al= low-remote-refs, allowing arbitrary local file reads. This issue is fixed i=
n version 0.62.0.</td>
<td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55389" target=3D= "_blank" rel=3D"noopener">CVE-2026-55389</a></td>
</tr>

<td class=3D"vendor-product">koxudaxi--datamodel-code-generator</td> <td>datamodel-code-generator generates Python data models from schema defin= itions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodel_code_= generator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:i= nclude, xs:import, xs:redefine, and xs:override schemaLocation values outsi=
de the input base path, allowing arbitrary local files to be read and refle= cted into generated models. This issue is fixed in version 0.62.0.</td> <td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55390" target=3D= "_blank" rel=3D"noopener">CVE-2026-55390</a></td>
</tr>

<td class=3D"vendor-product">koxudaxi--datamodel-code-generator</td> <td>datamodel-code-generator generates Pydantic v2 models, dataclasses, Typ= edDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protob= uf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator v= alidates a URL host once in src/datamodel_code_generator/http.py through ge= t_body, _validate_url_for_fetch, and _get_ips_from_host, but then lets http=
x resolve the host again for the connection, allowing DNS rebinding to bypa=
ss allow_private_network=3DFalse and reach internal services. This issue is=
fixed in version 0.63.0.</td>
<td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55391" target=3D= "_blank" rel=3D"noopener">CVE-2026-55391</a></td>
</tr>

<td class=3D"vendor-product">koxudaxi--datamodel-code-generator</td> <td>datamodel-code-generator generates Pydantic v2 models, dataclasses, Typ= edDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protob= uf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-ge= nerator allows attacker-controlled x-python-import or customTypePath schema=
extensions to reach src/datamodel_code_generator/parser/jsonschema.py and = generated import handling through Import.from_full_path and Imports.create_= line in src/datamodel_code_generator/imports.py, allowing a newline to brea=
k out of an import statement and execute Python code when the generated mod=
el is imported. This issue is fixed in version 0.64.0.</td>
<td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55415" target=3D= "_blank" rel=3D"noopener">CVE-2026-55415</a></td>
</tr>

<td class=3D"vendor-product">kube-logging--logging-operator</td>
<td>Logging operator automates the deployment and configuration of Kubernet=
es logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer Fl= uentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings suc=
h as Flow record_transformer.records values directly into fluent.conf witho=
ut escaping, allowing a user who can create Flow resources to inject a Flue= ntd &lt;match **&gt; block using @type exec and execute arbitrary commands = inside the Fluentd aggregator. This issue is fixed in version 6.6.0.</td> <td>2026-07-29</td>
<td>9.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54680" target=3D= "_blank" rel=3D"noopener">CVE-2026-54680</a></td>
</tr>

<td class=3D"vendor-product">kyegomez--swarms</td>
<td>Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side r= equest forgery vulnerability in the _is_safe_url function that fails to val= idate hostnames through DNS resolution, allowing attackers to bypass the bl= ocklist. Attackers can supply user-controlled image or audio URLs that reso= lve to private, loopback, or metadata addresses to reach internal services = and exfiltrate credentials.</td>
<td>2026-07-30</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67346" target=3D= "_blank" rel=3D"noopener">CVE-2026-67346</a></td>
</tr>

<td class=3D"vendor-product">ladela--Online Scheduling and Appointment Book= ing System Bookly</td>
<td>The Online Scheduling and Appointment Booking System - Bookly plugin fo=
r WordPress is vulnerable to time-based SQL Injection via the 'staff_ids' p= arameter in all versions up to, and including, 27.5 due to insufficient esc= aping on the user supplied parameter and lack of sufficient preparation on = the existing SQL query. This makes it possible for unauthenticated attacker=
s to append additional SQL queries into already existing queries that can b=
e used to extract sensitive information from the database. Exploitation req= uires a two-request chain: an attacker first calls the unauthenticated book= ly_get_form_id action to seed a booking session carrying malicious staff_id=
s values, then triggers bookly_render_time to cause the tainted array to re= ach the vulnerable query; CSRF/nonce validation is absent on both endpoints=
, meaning this chain can be initiated cross-site.</td>
<td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14516" target=3D= "_blank" rel=3D"noopener">CVE-2026-14516</a></td>
</tr>

<td class=3D"vendor-product">laughingman7743--PyAthena</td>
<td>PyAthena prior to 3.35.4 contains a sql injection vulnerability that al= lows unauthenticated attackers to inject arbitrary SQL by exploiting improp=
er quote-escaping in DefaultParameterFormatter.format(), which routes DELET=
E and CTAS statements to the _escape_hive function that backslash-escapes s= ingle quotes rather than doubling them. Because Athena and Trino do not tre=
at backslashes as escape characters inside string literals, attacker-suppli=
ed input such as a single quote followed by SQL syntax causes the parser to=
terminate the string literal prematurely, enabling data exfiltration via U= NION SELECT, execution of destructive statements, and attacker-controlled C= TAS destination and content.</td>
<td>2026-08-02</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65321" target=3D= "_blank" rel=3D"noopener">CVE-2026-65321</a></td>
</tr>

<td class=3D"vendor-product">Leantime--Leantime</td>
<td>Leantime 3.6.2 contains a server-side request forgery and local file in= clusion vulnerability that allows authenticated attackers to read internal = resources by passing unsanitized user-supplied filenames to file_get_conten= ts() in the Blueprints::import() method without path validation. Attackers = can submit crafted filenames containing URL wrappers or path traversal sequ= ences through the JSON-RPC API endpoint to access cloud metadata services o=
r read arbitrary files from the server filesystem.</td>
<td>2026-07-30</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66415" target=3D= "_blank" rel=3D"noopener">CVE-2026-66415</a></td>
</tr>

<td class=3D"vendor-product">Leantime--Leantime</td>
<td>Leantime 3.6.2 contains a cross-site request forgery vulnerability that=
allows unauthenticated attackers to perform state-changing actions on beha=
lf of authenticated users by excluding the Laravel VerifyCsrfToken middlewa=
re from the global middleware stack in app/Http/Kernel.php. Attackers can c= raft malicious pages delivered via phishing emails or malicious websites to=
trigger unauthorized POST, PUT, and DELETE requests that create or delete = projects, modify settings, and change permissions as any authenticated user= .</td>
<td>2026-07-30</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66416" target=3D= "_blank" rel=3D"noopener">CVE-2026-66416</a></td>
</tr>

<td class=3D"vendor-product">Lenze--c430</td>
<td>Multiple Lenze products are affected by an improper signature verificat= ion vulnerability in the SSH enablement mechanism. A low-privileged local a= ttacker can bypass verification of the SSH enable file signature and enable=
SSH access on the device. Successful exploitation may result in unauthoriz=
ed administrative access and complete system compromise.</td> <td>2026-07-27</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14837" target=3D= "_blank" rel=3D"noopener">CVE-2026-14837</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: nvm= et-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In n= vmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_r= eq_uninit() is called unconditionally. However, if the command arrived via = the nvmet_tcp_handle_req_failure() path, nvmet_req_init() had returned fals=
e and percpu_ref_tryget_live() was never executed. The unconditional percpu= _ref_put() inside nvmet_req_uninit() then causes a refcount underflow, lead= ing to a WARNING in percpu_ref_switch_to_atomic_rcu, a use-after-free diagn= ostic, and eventually a permanent workqueue deadlock. Check cmd-&gt;flags &= amp; NVMET_TCP_F_INIT_FAILED before calling nvmet_req_uninit(), matching th=
e existing pattern in nvmet_tcp_execute_request().</td>
<td>2026-07-27</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64534" target=3D= "_blank" rel=3D"noopener">CVE-2026-64534</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: nvm= et-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulner= ability testing: When data digest is enabled on an NVMe/TCP connection and =
a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based da=
ta transfer, the digest error handler in nvmet_tcp_try_recv_ddgst() calls n= vmet_req_uninit() - which performs percpu_ref_put() on the submission queue=
- but does NOT mark the command as completed. It does not set cqe-&gt;stat= us, does not modify rbytes_done, and does not clear any flag. When the subs= equent fatal error triggers queue teardown, nvmet_tcp_uninit_data_in_cmds()=
iterates all commands, checks nvmet_tcp_need_data_in() for each one, and f= inds that the already-uninited command still appears to need data (because = rbytes_done &lt; transfer_len and cqe-&gt;status =3D=3D 0). It therefore ca= lls nvmet_req_uninit() a second time on the same command - a double percpu_= ref_put against a single percpu_ref_get.</td>

<td>2026-07-27</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64535" target=3D= "_blank" rel=3D"noopener">CVE-2026-64535</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: net= /smc: fix UAF in smc_cdc_rx_handler() by pinning the socket smc_cdc_rx_hand= ler() looks up the connection by token under the link group's conns_lock, d= rops the lock, and then dereferences conn and the smc_sock derived from it,=
ending in sock_hold(&amp;smc-&gt;sk) inside smc_cdc_msg_recv(). No referen=
ce is held across the lock release. The only reference pinning the socket w= hile the connection is discoverable in the link group is taken in smc_lgr_r= egister_conn() (sock_hold) and dropped in __smc_lgr_unregister_conn() (sock= _put), both under conns_lock. Once the handler drops conns_lock, a concurre=
nt close() -&gt; smc_release() -&gt; smc_conn_free() -&gt; smc_lgr_unregist= er_conn() can drop that reference and free the smc_sock, so the handler's l= ater sock_hold() runs on freed memory: WARNING: lib/refcount.c:25 at refcou= nt_warn_saturate Workqueue: rxe_wq do_work refcount_warn_saturate (lib/refc= ount.c:25) smc_cdc_msg_recv (net/smc/smc_cdc.c:430) smc_cdc_rx_handler (net= /smc/smc_cdc.c:502) smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445) tasklet_act= ion_common (kernel/softirq.c:938) handle_softirqs (kernel/softirq.c:622) Ke= rnel panic - not syncing: panic_on_warn set Only SMC-R is affected. The SMC=
-D receive tasklet is stopped by tasklet_kill(&amp;conn-&gt;rx_tsklet) in s= mc_conn_free() before the connection is unregistered, so it cannot run conc= urrently with the free. Take the socket reference while still holding conns= _lock, so the registration reference can no longer be the last one, and dro=
p it once the handler is done.</td>
<td>2026-07-27</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64541" target=3D= "_blank" rel=3D"noopener">CVE-2026-64541</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: sct=
p: validate STALE_COOKIE cause length before reading staleness When an ERRO=
R chunk with a STALE_COOKIE cause is received in the COOKIE_ECHOED state, s= ctp_sf_do_5_2_6_stale() reads the 4-byte Measure of Staleness that follows = the cause header: err =3D (struct sctp_errhdr *)(chunk-&gt;skb-&gt;data); s= tale =3D ntohl(*(__be32 *)((u8 *)err + sizeof(*err))); err is the first cau=
se in the chunk, not the STALE_COOKIE cause that caused the dispatch, and n= othing guarantees the staleness field is present. sctp_walk_errors() only r= equires a cause to be as long as the 4-byte header, so for a STALE_COOKIE c= ause of length 4 the read runs past the cause, and for a minimal ERROR chun=
k past skb-&gt;tail. The value is echoed to the peer in the Cookie Preserva= tive of the reply INIT, leaking uninitialized memory. sctp_sf_cookie_echoed= _err() already walks to the STALE_COOKIE cause, so check its length there a=
nd pass it to sctp_sf_do_5_2_6_stale(), which reads that cause instead of t=
he first one. A STALE_COOKIE cause too short to hold the staleness field is=
discarded. The read is reachable by any peer that can drive an association=
into COOKIE_ECHOED, including an unprivileged process using a raw SCTP soc= ket in a user and network namespace.</td>
<td>2026-07-27</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64551" target=3D= "_blank" rel=3D"noopener">CVE-2026-64551</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: sta= ging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop The loop in is_ap= _in_tkip() iterates over IEs without verifying that enough bytes remain bef= ore dereferencing the IE header or its payload: - pIE-&gt;element_id and pI= E-&gt;length are read without checking that i + sizeof(*pIE) &lt;=3D ie_len= gth, so a truncated IE at the end of the buffer causes an OOB read. - For W= LAN_EID_VENDOR_SPECIFIC the code compares pIE-&gt;data + 12, which requires=
pIE-&gt;length &gt;=3D 16. For WLAN_EID_RSN it compares pIE-&gt;data + 8, = requiring pIE-&gt;length &gt;=3D 12. Neither requirement is checked. Add th=
e missing IE header and payload bounds checks and guard each data access wi=
th an explicit pIE-&gt;length minimum, matching the pattern established in = update_beacon_info().</td>
<td>2026-07-27</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64536" target=3D= "_blank" rel=3D"noopener">CVE-2026-64536</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: usb= net: gl620a: fix out-of-bounds read in genelink_rx_fixup() genelink_rx_fixu= p() splits an aggregated RX frame into its individual packets, using a per-= packet length taken from device-supplied data. That length is only bounded =
by GL_MAX_PACKET_LEN (1514); it is never compared against how many bytes we=
re actually received. A malicious GeneLink (GL620A) device can therefore se=
nd a short URB whose header claims packet_count &gt; 1 and a first packet o=
f up to 1514 bytes. skb_put_data(gl_skb, packet-&gt;packet_data, size); the=
n copies past the end of the receive buffer and hands the adjacent slab con= tents up the network stack, an out-of-bounds read that leaks kernel heap. N=
o privilege is required: the path runs in the usbnet RX softirq as soon as = the interface is up. BUG: KASAN: slab-out-of-bounds in genelink_rx_fixup (d= rivers/net/usb/gl620a.c:112) Read of size 1514 at addr ffff888011309708 by = task ksoftirqd/0/14 Call Trace: ... __asan_memcpy (mm/kasan/shadow.c:105) g= enelink_rx_fixup (include/linux/skbuff.h:2814 drivers/net/usb/gl620a.c:112)=
usbnet_bh (drivers/net/usb/usbnet.c:572 drivers/net/usb/usbnet.c:1589) pro= cess_one_work (kernel/workqueue.c:3322) bh_worker (kernel/workqueue.c:3405)=
tasklet_action (kernel/softirq.c:965) handle_softirqs (kernel/softirq.c:62=
2) run_ksoftirqd (kernel/softirq.c:1076) ... skb_pull() already verifies th=
at the requested length fits the buffer and returns NULL otherwise. Move it=
ahead of the copy and check its result, so a packet that overruns the rece= ived data is rejected before it is read. Well-formed frames, whose packets = are fully present, are unaffected.</td>
<td>2026-07-27</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64540" target=3D= "_blank" rel=3D"noopener">CVE-2026-64540</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: net=
: usb: net1080: validate packet_len before pad-byte access in rx_fixup For =
an even packet_len, net1080_rx_fixup() reads the pad byte at skb-&gt;data[p= acket_len] before the skb-&gt;len !=3D packet_len check further down, and p= acket_len is only bounded against NC_MAX_PACKET. A malicious NetChip 1080 d= evice can send a short frame advertising a large even packet_len (e.g. 0x40= 00), so the pad-byte read lands past the end of the skb: BUG: KASAN: slab-o= ut-of-bounds in net1080_rx_fixup Read of size 1 at addr ffff8880106c83c6 by=
task ksoftirqd/0/14 ... net1080_rx_fixup (drivers/net/usb/net1080.c:384) u= sbnet_bh (drivers/net/usb/usbnet.c:1589) process_one_work (kernel/workqueue= .c:3322) bh_worker (kernel/workqueue.c:3708) tasklet_action (kernel/softirq= .c:965) handle_softirqs (kernel/softirq.c:622) ... Reject the frame when pa= cket_len &gt;=3D skb-&gt;len before reading.</td>
<td>2026-07-27</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64547" target=3D= "_blank" rel=3D"noopener">CVE-2026-64547</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: bpf=
, sockmap: reject overflowing copy + len in bpf_msg_push_data() When the sc= atterlist ring is full or nearly full, bpf_msg_push_data() enters a copy fa= llback path and computes copy + len for the page allocation size. Since len=
comes from BPF with arg3_type =3D ARG_ANYTHING and both are u32, a crafted=
len can wrap the sum to a small value, causing an undersized allocation fo= llowed by an out-of-bounds memcpy. BUG: unable to handle page fault for add= ress: ffffed104089a402 Oops: Oops: 0000 [#1] SMP KASAN NOPTI Call Trace: __= asan_memcpy (mm/kasan/shadow.c:105) bpf_msg_push_data (net/core/filter.c:28=
52 net/core/filter.c:2788) bpf_prog_9ed8b5711920a7d7+0x2e/0x36 sk_psock_msg= _verdict (net/core/skmsg.c:934) tcp_bpf_sendmsg (net/ipv4/tcp_bpf.c:421 net= /ipv4/tcp_bpf.c:584) __sys_sendto (net/socket.c:2206) do_syscall_64 (arch/x= 86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/en= try_64.S:130) Add an overflow check before the allocation.</td> <td>2026-07-27</td>
<td>8.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64548" target=3D= "_blank" rel=3D"noopener">CVE-2026-64548</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: vir= tio-net: fix len check in receive_big() receive_big() bounds the device-ann= ounced length by (big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still = too loose: add_recvbuf_big() sets sg[1] to start at offset sizeof(struct pa= dded_vnet_hdr) into the first page, so the chain actually carries hdr_len +=
(PAGE_SIZE - sizeof(padded_vnet_hdr)) + big_packets_num_skbfrags * PAGE_SI=
ZE bytes -- 20 bytes less than the check allows for the common hdr_len =3D=
=3D 12 case. A malicious virtio backend can announce a len in that gap. pag= e_to_skb() then walks one frag past the page chain, storing a NULL page-&gt= ;private into skb_shinfo()-&gt;frags[MAX_SKB_FRAGS], which is both an out-o= f-bounds write past the static frag array and a NULL frag handed up the rx = path. Bound len by the size add_recvbuf_big() actually advertised.</td> <td>2026-07-27</td>
<td>8.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64552" target=3D= "_blank" rel=3D"noopener">CVE-2026-64552</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: net= filter: bridge: fix stale prevhdr pointer in br_ip6_fragment() br_ip6_fragm= ent() gets prevhdr, a pointer into the skb head, from ip6_find_1stfragopt()=
, then calls skb_checksum_help(). For a cloned skb skb_checksum_help() real= locates the head via pskb_expand_head(), leaving prevhdr dangling. It is la= ter dereferenced in ip6_frag_next(), causing a use-after-free write. Save p= revhdr's offset before skb_checksum_help() and recompute it after, like com= mit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6 fragment"). BUG: KA= SAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857) Write=
of size 1 at addr ffff888013ff5016 by task exploit/141 Call Trace: ... kas= an_report (mm/kasan/report.c:595) ip6_frag_next (net/ipv6/ip6_output.c:857)=
br_ip6_fragment (net/ipv6/netfilter.c:212) nf_ct_bridge_post (net/bridge/n= etfilter/nf_conntrack_bridge.c:407) nf_hook_slow (net/netfilter/core.c:619)=
br_forward_finish (net/bridge/br_forward.c:66) __br_forward (net/bridge/br= _forward.c:115) maybe_deliver (net/bridge/br_forward.c:191) br_flood (net/b= ridge/br_forward.c:245) br_handle_frame_finish (net/bridge/br_input.c:229) = br_handle_frame (net/bridge/br_input.c:442) ... packet_sendmsg (net/packet/= af_packet.c:3114) ... do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_= SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not=
syncing: Fatal exception in interrupt</td>
<td>2026-07-27</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64554" target=3D= "_blank" rel=3D"noopener">CVE-2026-64554</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: KVM=
: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() kvm_hyp_handle_m= ops() resets the single-step state machine as part of rewinding state for a=
MOPS exception by modifying vcpu_cpsr() and writing the result directly in=
to hardware. In the case of nested virtualization, vcpu_cpsr() is a synthet=
ic value such that the rest of KVM can deal with vEL2 cleanly. That means t=
he value requires translation before being written into hardware, which is = unfortunately missing from the MOPS handler. Fix it by directly modifying S= PSR_EL2 and avoiding the synthetic state altogether, which will be resynchr= onized on the next 'full' exit back to KVM.</td>
<td>2026-07-27</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64555" target=3D= "_blank" rel=3D"noopener">CVE-2026-64555</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: Blu= etooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() l2cap_s= ock_new_connection_cb() returned l2cap_pi(sk)-&gt;chan after release_sock(p= arent). Once the parent lock is dropped the newly enqueued child socket sk =
is reachable via the accept queue, so another task can accept and free it b= efore the callback dereferences sk, resulting in a use-after-free. Rework t=
he -&gt;new_connection() op so the core, rather than the callback, owns the=
child channel's lifetime. The op now receives a pre-allocated new_chan and=
returns an errno instead of allocating and returning a channel. l2cap_new_= connection() allocates the child channel and links it into the conn list vi=
a __l2cap_chan_add() before invoking the callback, so the conn-list referen=
ce keeps the channel alive once release_sock(parent) exposes the socket to = other tasks. Channel configuration that was duplicated in l2cap_sock_init()=
and the various new_connection callbacks is consolidated into l2cap_chan_s= et_defaults(), which now inherits from the parent channel when one is suppl= ied.</td>
<td>2026-07-29</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64557" target=3D= "_blank" rel=3D"noopener">CVE-2026-64557</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: net=
: openvswitch: reject oversized nested action attrs Open vSwitch stores gen= erated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64add= f3ff ("net: openvswitch: remove misbehaving actions length check") allowed = the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but=
also removed the last guard preventing a generated nested action attribute=
from exceeding U16_MAX. An oversized generated container can thus be close=
d with a truncated nla_len. A later dump or teardown then walks a structura= lly different stream than the one that was validated. In particular, an ove= rsized nested CLONE/CT action may cause subsequent bytes in the generated s= tream to be interpreted as independent actions. Keep the larger total-actio= n-stream behavior, but make nested action close reject generated containers=
that do not fit in nla_len, and return the error through all callers. For = recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource= -owning action-list tails in reverse construction order before discarding f= ailed wrappers, so resources copied into the rejected tails are released be= fore the wrappers are removed. Most failed outer wrappers are discarded by = truncating actions_len after child resources have been released. CHECK_PKT_= LEN also trims its parent after branch resources are gone. SET/TUNNEL close=
failures unwind their known tun_dst ownership directly, and SET_TO_MASKED = has no external ownership and truncates on close failure.</td> <td>2026-07-27</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64531" target=3D= "_blank" rel=3D"noopener">CVE-2026-64531</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: fs/= ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} In = do_action()'s UpdateRecordDataRoot (fslog.c:3489) and UpdateRecordDataAlloc= ation (fslog.c:3697) cases, the memmove destination is `Add2Ptr(e, le16_to_= cpu(e-&gt;view.data_off))`, where e-&gt;view.data_off comes from an on-disk=
NTFS_DE inside an INDEX_ROOT or INDEX_BUFFER. Neither case validates view.= data_off + dlen against e-&gt;size; the existing check_if_index_root / chec= k_if_alloc_index helpers walk the entry chain and validate the entry's offs= et, but not its internal view fields. The neighbouring read sites (e.g., fs= /ntfs3/index.c when iterating view entries) check view.data_off + view.data= _size &lt;=3D e-&gt;size. Apply the same bound at the two memmove sites. Re= produced under UML+KASAN on mainline 8d90b09e6741 via pr_warn-only probe in= strumentation: with view.data_off forced to 0xFFFC, the memmove writes 32 b= ytes past the end of the NTFS_DE. This is similar in shape to Pavitra Jha's=
2026-05-02 patch "fs/ntfs3: prevent oob in case UpdateRecordDataRoot" (&lt= ;20260502105008.21827-1-jhapavitra98@gmail.com&gt;) which proposes calling = ntfs3_bad_de_range(); that helper does not exist in mainline. This patch us=
es inline checks.</td>
<td>2026-07-27</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64532" target=3D= "_blank" rel=3D"noopener">CVE-2026-64532</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: fs/= ntfs3: validate lcns_follow in log_replay conversion log_replay() converts = DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records when replaying versio=
n 0 restart tables. During this conversion, the memmove() length is derived=
directly from the on-disk lcns_follow field: memmove(&amp;dp-&gt;vcn, &amp= ;dp0-&gt;vcn_low, 2 * sizeof(u64) + le32_to_cpu(dp-&gt;lcns_follow) * sizeo= f(u64)); check_rstbl() validates restart table structure, but does not cons= train per-entry lcns_follow values relative to the entry size. A malformed = filesystem image can provide an oversized lcns_follow value, causing the co= nversion memmove() to access memory beyond the bounds of the allocated rest= art table buffer. The same field is later used to bound iteration over page= _lcns[], so validating lcns_follow during conversion also prevents downstre=
am out-of-bounds access from the same malformed metadata. Compute the maxim=
um valid lcns_follow from the already-validated restart table entry size an=
d reject entries that exceed this bound. Reuse the existing t16/t32 scratch=
variables already declared in log_replay() to avoid introducing new declar= ations. [almaz.alexandrovich@paragon-software.com: fixed the conflicts]</td=

<td>2026-07-27</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64533" target=3D= "_blank" rel=3D"noopener">CVE-2026-64533</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: Blu= etooth: eir: Fix stack OOB write when prepending the Flags AD eir_create_ad= v_data() builds the advertising data into a fixed-size buffer ("size", 31 f=
or the legacy path). It may prepend a 3-byte "Flags" AD structure (LE_AD_NO= _BREDR on an LE-only controller) and then copies the per-instance data with= out checking that it still fits: memcpy(ptr, adv-&gt;adv_data, adv-&gt;adv_= data_len); tlv_data_max_len() only reserves those 3 bytes when the user-sup= plied flags carry a managed-flags bit, so an instance added with flags =3D=
=3D 0 is accepted with adv_data_len up to the full buffer. At advertise tim=
e the flags are still prepended, and the memcpy() writes 3 + adv_data_len b= ytes into the size-byte buffer: BUG: KASAN: stack-out-of-bounds in eir_crea= te_adv_data (net/bluetooth/eir.c:301) Write of size 31 at addr ffff88800a54= 7bdc by task kworker/u9:0/65 Workqueue: hci0 hci_cmd_sync_work __asan_memcp=
y (mm/kasan/shadow.c:106) eir_create_adv_data (net/bluetooth/eir.c:301) hci= _update_adv_data_sync (net/bluetooth/hci_sync.c:1310) hci_schedule_adv_inst= ance_sync (net/bluetooth/hci_sync.c:1817) hci_cmd_sync_work (net/bluetooth/= hci_sync.c:332) This frame has 1 object: [32, 64) 'cp' The "Flags" structur=
e is added by the kernel, not requested by userspace, so only prepend it wh=
en it fits together with the instance advertising data; when there is no ro=
om for both, drop the flags rather than the user-provided data. Reachable b=
y a local user with CAP_NET_ADMIN owning an LE-only controller on the legac=
y advertising path.</td>
<td>2026-07-27</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64539" target=3D= "_blank" rel=3D"noopener">CVE-2026-64539</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: tip=
c: fix use-after-free of the discoverer in tipc_disc_rcv() bearer_disable()=
frees b-&gt;disc with tipc_disc_delete()'s plain kfree(), but tipc_disc_rc= v() still dereferences b-&gt;disc in RX softirq under rcu_read_lock() (tipc= _udp_recv -&gt; tipc_rcv -&gt; tipc_disc_rcv). L2 bearers are safe thanks t=
o the synchronize_net() in tipc_disable_l2_media(), but the UDP bearer defe=
rs that call to the cleanup_bearer() workqueue, so the discoverer is freed = with no grace period: BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net= /tipc/discover.c:149) Read of size 8 at addr ffff88802348b728 by task poc_t= ipc/184 &lt;IRQ&gt; tipc_disc_rcv (net/tipc/discover.c:149) tipc_rcv (net/t= ipc/node.c:2126) tipc_udp_recv (net/tipc/udp_media.c:391) udp_rcv (net/ipv4= /udp.c:2643) ip_local_deliver_finish (net/ipv4/ip_input.c:241) &lt;/IRQ&gt;=
Freed by task 181: kfree (mm/slub.c:6565) bearer_disable (net/tipc/bearer.= c:418) tipc_nl_bearer_disable (net/tipc/bearer.c:1001) The bearer is freed = with kfree_rcu(); free the discoverer the same way. Add an rcu_head to stru=
ct tipc_discoverer and free it and its skb from an RCU callback. Because th=
e RCU callback (tipc_disc_free_rcu) lives in module text, a call_rcu() that=
is still pending when the tipc module is unloaded would invoke a freed fun= ction. Add an rcu_barrier() to tipc_exit() after the bearer subsystem has b= een torn down, so all pending discoverer callbacks have run before the modu=
le text goes away. Reachable from an unprivileged user namespace: the TIPCv=
2 genl family is netnsok and its bearer commands have no GENL_ADMIN_PERM. N= eeds CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP.</td>
<td>2026-07-27</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64543" target=3D= "_blank" rel=3D"noopener">CVE-2026-64543</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: net=
, bpf: check master for NULL in xdp_master_redirect() xdp_master_redirect()=
dereferences the result of netdev_master_upper_dev_get_rcu() without a NUL=
L check, but that helper returns NULL when the receiving device has no uppe= r-master adjacency. The reach guard only checks netif_is_bond_slave(). On b= ond slave release bond_upper_dev_unlink() drops the upper-master adjacency = before clearing IFF_SLAVE, so an XDP_TX reaching xdp_master_redirect() in t= hat window still passes netif_is_bond_slave() while master is already NULL,=
and faults on master-&gt;flags at offset 0xb0: BUG: kernel NULL pointer de= reference, address: 00000000000000b0 RIP: 0010:xdp_master_redirect (net/cor= e/filter.c:4432) Call Trace: xdp_master_redirect (net/core/filter.c:4432) b= pf_prog_run_generic_xdp (include/net/xdp.h:700) do_xdp_generic (net/core/de= v.c:5608) __netif_receive_skb_one_core (net/core/dev.c:6204) process_backlo=
g (net/core/dev.c:6319) __napi_poll (net/core/dev.c:7729) net_rx_action (ne= t/core/dev.c:7792) handle_softirqs (kernel/softirq.c:622) __dev_queue_xmit = (include/linux/bottom_half.h:33) packet_sendmsg (net/packet/af_packet.c:308=
2) __sys_sendto (net/socket.c:2252) Kernel panic - not syncing: Fatal excep= tion in interrupt The missing check dates back to the original code; commit=
1921f91298d1 ("net, bpf: fix null-ptr-deref in xdp_master_redirect() for d= own master") later added the master-&gt;flags read where the fault now land=
s but kept the unconditional deref. Check master for NULL before use; a NUL=
L master is treated the same as one that is not up.</td>
<td>2026-07-27</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64545" target=3D= "_blank" rel=3D"noopener">CVE-2026-64545</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: drm= /edid: fix OOB read in drm_parse_tiled_block() drm_parse_tiled_block() cast=
s the DisplayID block to a struct displayid_tiled_block and reads the full = fixed layout up to tile-&gt;topology_id[7] without checking block-&gt;num_b= ytes. The DisplayID iterator only validates the declared payload length, so=
a crafted EDID can advertise a tiled-display block (tag DATA_BLOCK_TILED_D= ISPLAY, or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_b= ytes at the end of a DisplayID extension. The read then runs past the end o=
f the exact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read. R= eject blocks shorter than the spec's 22-byte tiled payload before reading t=
he fixed struct, as drm_parse_vesa_mso_data() already does. BUG: KASAN: sla= b-out-of-bounds in drm_edid_connector_update Read of size 2 at addr ffff888= 010077700 by task exploit/147 dump_stack_lvl (lib/dump_stack.c:94 ...) prin= t_report (mm/kasan/report.c:378 ...) kasan_report (mm/kasan/report.c:595) d= rm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581) bochs_connector_= helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574) drm_helper_probe_single= _connector_modes (drivers/gpu/drm/drm_probe_helper.c:426) status_store (dri= vers/gpu/drm/drm_sysfs.c:219) ... vfs_write (fs/read_write.c:595 fs/read_wr= ite.c:688) ksys_write (fs/read_write.c:740)</td>
<td>2026-07-27</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64546" target=3D= "_blank" rel=3D"noopener">CVE-2026-64546</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: net=
: qualcomm: rmnet: validate MAP frame length before ingress parsing When in= gress deaggregation is disabled, rmnet_map_ingress_handler() passes the skb=
straight to __rmnet_map_ingress_handler(), skipping the length validation = that rmnet_map_deaggregate() performs on the aggregated path. The parser th=
en dereferences the MAP header and csum header/trailer based on the on-wire=
pkt_len without checking skb-&gt;len, so a short frame is read out of boun= ds: BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet Re=
ad of size 1 at addr ffff88801118ed00 by task exploit/147 Call Trace: ... r= mnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmne= t_map_data.c:413) __rmnet_map_ingress_handler (drivers/net/ethernet/qualcom= m/rmnet/rmnet_handlers.c:96) rmnet_rx_handler (drivers/net/ethernet/qualcom= m/rmnet/rmnet_handlers.c:129) __netif_receive_skb_core.constprop.0 (net/cor= e/dev.c:6089) netif_receive_skb (net/core/dev.c:6460) tun_get_user (drivers= /net/tun.c:1955) tun_chr_write_iter (drivers/net/tun.c:2001) vfs_write (fs/= read_write.c:688) ksys_write (fs/read_write.c:740) do_syscall_64 (arch/x86/= entry/syscall_64.c:94) ... Factor that validation out of rmnet_map_deaggreg= ate() into rmnet_map_validate_packet_len() and run it on the no-aggregation=
path too. The MAP header is bounds-checked first, since this path can rece= ive a frame shorter than the header.</td>
<td>2026-07-27</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64550" target=3D= "_blank" rel=3D"noopener">CVE-2026-64550</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: per= f/core: Detach event groups during remove_on_exec perf_event_remove_on_exec=
() removes events by calling perf_event_exit_event(). For top-level events,=
this removes the event from the context with DETACH_EXIT only. This can le= ave inconsistent group state when a removed event is a group leader and the=
group contains siblings without remove_on_exec. If the group was active, t=
he surviving siblings can remain active and attached to the removed leader'=
s sibling list, but are no longer represented by a valid group leader on th=
e PMU context active lists. A later close of the removed leader uses DETACH= _GROUP and can promote the still-active siblings from this stale group stat=
e. The next schedule-in can then add an already-linked active_list entry ag= ain, corrupting the PMU context active list. With DEBUG_LIST enabled, this =
is caught as a list_add double-add in merge_sched_in(). Fix this by detachi=
ng group relationships when remove_on_exec removes an event. This preserves=
the existing task-exit and revoke behavior, while ensuring surviving sibli= ngs are ungrouped before the removed event leaves the context.</td> <td>2026-07-29</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64556" target=3D= "_blank" rel=3D"noopener">CVE-2026-64556</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: s39= 0/pkey: Check length in pkey_pckmo handler implementation Explicitly check = the length of the target buffer in the pkey_pckmo implementation of the key= _to_protkey() handler function. The handler function fails, if the generate=
d output data exceeds the length of the provided target buffer.</td> <td>2026-07-29</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64558" target=3D= "_blank" rel=3D"noopener">CVE-2026-64558</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: s39= 0/pkey: Check length in PKEY_VERIFYPROTK ioctl Explicitly check the buffer = length request structure provided by user-space and fail, if it exceeds the=
buffer size.</td>
<td>2026-07-29</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64559" target=3D= "_blank" rel=3D"noopener">CVE-2026-64559</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: pos= ix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungw=
oo decoded and reported a non-leader exec() related race which can result i=
n an UAF: sys_timer_delete() exec() posix_cpu_timer_del() // Observes old l= eader p =3D pid_task(pid, pid_type); de_thread() switch_leader(); release_t= ask(old_leader) __exit_signal(old_leader) sighand =3D lock(old_leader, sigh= and); posix_cpu_timers*_exit(); sighand =3D lock_task_sighand(p) unhash_tas= k(old_leader); sh =3D lock(p, sighand) old_leader-&gt;sighand =3D NULL; unl= ock(sighand); (p-&gt;sighand =3D=3D NULL) unlock(sh) return NULL; // Return=
s without action if(!sighand) return 0; free_posix_timer(); This is "harmle= ss" unless the deleted timer was armed and enqueued in p-&gt;signal because=
on exec() a TGID targeted timer is inherited. As sys_timer_delete() freed = the underlying posix timer object run_posix_cpu_timers() or any timerqueue = related add/delete operations on other timers will access the freed object'=
s timerqueue node, which results in an UAF. There is a similar problem vs. = posix_cpu_timer_set(). For regular posix timers it just transiently returns=
-ESRCH to user space, but for the use case in do_cpu_nanosleep() it's the = same UAF just that the k_itimer is allocated on the stack. Also posix_cpu_t= imer_rearm() fails to rearm the timer, which means it stops to expire. Whil=
e debating solutions Frederic pointed out another problem: posix_cpu_timer_= del(tmr) __exit_signal(p) posix_cpu_timers*_exit(p); unhash_task(p); p-&gt;= sighand =3D NULL; sh =3D lock_task_sighand(p) sighand =3D p-&gt;sighand; if=
(!sighand) return NULL; lock(sighand); if (!sh) WARN_ON_ONCE(timer_queued(= tmr)); On weakly ordered architectures it is not guaranteed that posix_cpu_= timer_del() will observe the stores in posix_cpu_timers*_exit() when p-&gt;= sighand is observed as NULL, which means the WARN() can be a false positive=
. Solve these issues by: 1) Changing the store in __exit_signal() to smp_st= ore_release(). 2) Adding a smp_acquire__after_ctrl_dep() into the !sighand = path of lock_task_sighand(). 3) Creating a helper function for looking up t=
he task and locking sighand which does not return when sighand =3D=3D NULL.=
Instead it retries the task lookup and only if that fails it gives up. 4) = Using that helper in the three affected functions. #1/#2 ensures that the r= eader side which observes sighand =3D=3D NULL also observes all preceeding = stores, i.e. the stores in posix_cpu_timers*_exit() and the ones in unhash_= task(). #3 ensures that the above described non-leader exec() situation is = handled gracefully. When the task lookup returns the old leader, but sighan=
d =3D=3D NULL then it retries. In the non-leader exec() case the subsequent=
task lookup will observe the new leader due to #1/#2. In normal exit() sce= narios the subsequent lookup fails. When the task lookup fails, the functio=
n also checks whether the timer is still enqueued and issues a warning if t= hat's the case. Unfortunately there is nothing which can be done about it, = but as the task is already not longer visible the timer should not be acces= sed anymore. This check also requires memory ordering, which is not provide=
d when the first lookup fails. To achieve that the check is preceeded by a = smp_rmb() which pairs with the smp_wmb() in write_seqlock() in __exit_signa= l(). That ensures that the stores in posix_cpu_timers*_exit() are visible. = The history of the non-leader exec() issue goes back to the early days of p= osix CPU timers, which stored a pointer to the group leader task in the tim= er. That obviously fails when a non-leader exec() switches the leader. comm=
it e0a70217107e ("posix-cpu-timers: workaround to suppress the problems wit=
h mt exec") added a temporary workaround for that in 2010 which surv ---tru= ncated---</td>
<td>2026-07-29</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64560" target=3D= "_blank" rel=3D"noopener">CVE-2026-64560</a></td>
</tr>

<td class=3D"vendor-product">litestar-org--litestar</td>
<td>Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. = Prior to version 2.20.0, Litestar instances which use a template engine in = conjunction with CSRF protection are vulnerable to HTML Injection which can=
be escalated to Cross Site Scripting due to the contents of the CSRF cooki=
e being excluded from automatic escaping by the template engine when config= ured inline with documentation recommendations. This issue has been patched=
in version 2.20.0.</td>
<td>2026-07-28</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48060" target=3D= "_blank" rel=3D"noopener">CVE-2026-48060</a></td>
</tr>

<td class=3D"vendor-product">magepeopleteam--Booking and Rental Manager</td=

<td>Unauthenticated Other Vulnerability Type in Booking and Rental Manager = &lt;=3D 2.7.2 versions.</td>
<td>2026-07-27</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59532" target=3D= "_blank" rel=3D"noopener">CVE-2026-59532</a></td>
</tr>

<td class=3D"vendor-product">masci--banks</td>
<td>Banks generates meaningful LLM prompts using a simple template language=
. In versions prior to 2.4.3, banks parses Tool JSON objects from the rende= red body of {% completion %} blocks and later resolves their import_path fi= eld through importlib.import_module(...) + getattr(...) to obtain the calla= ble that handles a tool call. There is no allowlist or sanitization on impo= rt_path, so any importable Python attribute (e.g. os.system, subprocess.get= output) can be selected. When the LLM emits a tool_calls entry whose functi= on.name matches the attacker-supplied tool name, the resolved callable is i= nvoked with kwargs decoded from tool_call.function.arguments, yielding arbi= trary code execution in the banks-hosting process. This is distinct from GH= SA-gphh-9q3h-jgpp / CVE-2026-44209. That advisory was fixed in 2.4.2 by swi= tching src/banks/env.py from Environment to SandboxedEnvironment. The fix d= oes not touch src/banks/extensions/completion.py, and the unsafe import + g= etattr chain still executes on 2.4.2. The malicious Tool JSON is plain text=
in the rendered template body - it requires no Jinja attribute access, so = the sandbox is irrelevant. This issue has been fixed in version 2.4.3.</td> <td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-61536" target=3D= "_blank" rel=3D"noopener">CVE-2026-61536</a></td>
</tr>

<td class=3D"vendor-product">masci--banks</td>
<td>Banks generates meaningful LLM prompts using a simple template language=
. In versions prior to 2.4.4, all four media filters (image, audio, video, = document) in banks accept untrusted user input as file paths via Path(value=
) and pass them directly to open(file_path, "rb") without any path sanitiza= tion, canonicalization, or directory restriction. An attacker who controls = template variables passed to a banks Prompt can use path traversal (../) to=
read arbitrary files accessible to the Python process-including .env files=
, SSH keys, cloud credentials, source code, /etc/passwd, and /etc/shadow-wi=
th the content returned base64-encoded in the rendered prompt output, makin=
g exfiltration trivial. This is particularly dangerous for applications tha=
t use banks to process user-provided template variables before sending prom= pts to an LLM. This issue has been fixed in version 2.4.4.</td> <td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62663" target=3D= "_blank" rel=3D"noopener">CVE-2026-62663</a></td>
</tr>

<td class=3D"vendor-product">Meta Box--Meta Box AIO</td>
<td>The Meta Box AIO plugin for WordPress is vulnerable to Missing Authoriz= ation via the template_redirect dispatcher in the MB Frontend Submission ex= tension in versions up to, and including, 3.8.0. This is due to the handle_= request() function routing the mbfs_delete action without any capability or=
ownership check, and the nonce verification in check_ajax() being gated be= hind is_ajax() which is false for template_redirect requests, making it byp= assable. This makes it possible for unauthenticated attackers to delete arb= itrary posts and pages by supplying an attacker-controlled post ID via the = rwmb_frontend_field_object_id GET parameter on any page that hosts a fronte=
nd submission form regardless of whether allow_delete is enabled.</td> <td>2026-07-29</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14488" target=3D= "_blank" rel=3D"noopener">CVE-2026-14488</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Azure Cosmos DB</td>
<td>Improper access control in Azure Cosmos DB allows an unauthorized attac= ker to execute code over a network.</td>
<td>2026-07-30</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66803" target=3D= "_blank" rel=3D"noopener">CVE-2026-66803</a></td>
</tr>

<td class=3D"vendor-product">mihail-chepovskiy--Web Directory Free</td>

<td>The Web Directory Free plugin for WordPress is vulnerable to generic SQ=
L Injection via the 'levels' parameter in all versions up to, and including=
, 1.7.13 due to insufficient escaping on the user supplied parameter and la=
ck of sufficient preparation on the existing SQL query. This makes it possi= ble for unauthenticated attackers to append additional SQL queries into alr= eady existing queries that can be used to extract sensitive information fro=
m the database.</td>
<td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14785" target=3D= "_blank" rel=3D"noopener">CVE-2026-14785</a></td>
</tr>

<td class=3D"vendor-product">MikroTik--RouterOS</td>
<td>MikroTik RouterOS contains a weakness in its API authentication handlin=
g that lacks effective safeguards against excessive login attempts. The sys= tem does not enforce meaningful rate-limiting, account lockout, or source-b= ased restrictions, allowing repeated authentication failures to proceed wit= hout defensive response. In some versions, a fixed per-connection delay is = present, but it can be bypassed through concurrent sessions, resulting in c= ontinued high-volume attempts. This deficiency increases the risk that an a= ttacker could eventually obtain valid credentials and gain unauthorized acc= ess to administrative services.</td>
<td>2026-07-28</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16347" target=3D= "_blank" rel=3D"noopener">CVE-2026-16347</a></td>
</tr>

<td class=3D"vendor-product">miniOrange--miniorange otp verification</td> <td>Unauthenticated Cross Site Scripting (XSS) in miniorange otp verificati=
on &lt;=3D 5.5.1 versions.</td>
<td>2026-07-27</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-61957" target=3D= "_blank" rel=3D"noopener">CVE-2026-61957</a></td>
</tr>

<td class=3D"vendor-product">modelcontextprotocol--ruby-sdk</td>
<td>MCP Ruby SDK is the official Ruby SDK for Model Context Protocol server=
s and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTran= sport in the mcp gem reads and parses an entire JSON-RPC POST body without =
a size limit, allowing an unauthenticated remote attacker to exhaust proces=
s memory. This issue is fixed in version 0.23.0.</td>
<td>2026-07-29</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67432" target=3D= "_blank" rel=3D"noopener">CVE-2026-67432</a></td>
</tr>

<td class=3D"vendor-product">motov.net--Ebook Store</td>
<td>Unauthenticated Sensitive Data Exposure in Ebook Store &lt;=3D 6.19 ver= sions.</td>
<td>2026-07-27</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59529" target=3D= "_blank" rel=3D"noopener">CVE-2026-59529</a></td>
</tr>

<td class=3D"vendor-product">MZ Automation GmbH--libiec61850</td>
<td>The ISO Presentation layer contains a flaw in the handling of specific = parameters during normal mode negotiation. A missing length check in the pr= ocessing of the encoded presentation data allows an attacker controlled fie=
ld with a zero length value to trigger a bounded heap over read. This condi= tion occurs before MMS session establishment, a crafted TCP/102 connection = attempt can trigger the issue. The resulting over read causes the process t=
o terminate, leading to a denial of service condition.</td>

<td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66360" target=3D= "_blank" rel=3D"noopener">CVE-2026-66360</a></td>
</tr>

<td class=3D"vendor-product">NASA--Core Flight System (cFS) Health &amp; Sa= fety (HS) Application</td>
<td>An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cF=
S) Health and Safety (HS) application leaves a separate NULL pointer derefe= rence reachable in versions through 7.0.1. An attacker who can trigger the = affected command under specific conditions could cause the HS application t=
o crash, resulting in a denial-of-service condition and processor reset.</t=

<td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18064" target=3D= "_blank" rel=3D"noopener">CVE-2026-18064</a></td>
</tr>

<td class=3D"vendor-product">NASA-AMMOS--AIT-DSN</td>
<td>AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface befor=
e 2.2.2 contains a missing authentication vulnerability in the Space Link E= xtension (SLE) interface manager that allows unauthenticated network attack= ers to access seven unprotected API routes by sending direct HTTP requests = with no credentials. Attackers can reach the exposed SLE endpoints to start=
or stop Deep Space Network communication sessions, retrieve telemetry fram=
e data, and inject arbitrary frames into active spacecraft links.</td> <td>2026-07-29</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-60113" target=3D= "_blank" rel=3D"noopener">CVE-2026-60113</a></td>
</tr>

<td class=3D"vendor-product">NASA-AMMOS--AIT-GUI</td>
<td>AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing auth= entication vulnerability that allows any unauthenticated network attacker t=
o obtain a valid session and issue arbitrary spacecraft commands by calling=
Sessions.create() without any credential check. Attackers can exploit the = unauthenticated session issuance in Sessions.create() and subsequently invo=
ke handle_cmd() to forward arbitrary commands directly to the AIT command b=
us without any authentication gate between session creation and command dis= patch.</td>
<td>2026-07-29</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-60112" target=3D= "_blank" rel=3D"noopener">CVE-2026-60112</a></td>
</tr>

<td class=3D"vendor-product">nessshon--tonapi</td>
<td>pytonapi is a Python SDK for TONAPI that provides REST API, streaming, = and webhook access to the TON blockchain. From 2.0.0 to 2.2.0, TonapiWebhoo= kDispatcher fails to validate the Authorization header when a webhook handl=
er is registered with the documented path argument, because setup() stores = bearer tokens only under the default suffix paths and never adds the custom=
path to the token map, so self._tokens.get(path) returns None and the auth= entication guard is skipped. An unauthenticated remote attacker can POST fo= rged payloads to the custom webhook endpoint and trigger victim-defined han= dlers. This issue is fixed in version 2.2.1.</td>
<td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54635" target=3D= "_blank" rel=3D"noopener">CVE-2026-54635</a></td>
</tr>

<td class=3D"vendor-product">netty--netty</td>
<td>Netty is an asynchronous, event-driven network application framework. P= rior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateV= alidator flags an out-of-date OCSP response but does not stop processing it=
, so an expired GOOD response is still reported as VALID, letting an on-pat=
h attacker replay a stale GOOD response to bypass revocation of a since-rev= oked certificate. Exploitation can lead to certificate revocation bypass vi=
a replay of an expired OCSP response. Any application using OcspServerCerti= ficateValidator is affected; a revoked certificate can be accepted. This is= sue has been fixed in versions 4.1.136.Final and 4.2.16.Final.</td> <td>2026-07-28</td>
<td>7.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56821" target=3D= "_blank" rel=3D"noopener">CVE-2026-56821</a></td>
</tr>

<td class=3D"vendor-product">netty--netty</td>
<td>Netty is an asynchronous, event-driven network application framework. P= rior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateV= alidator forwards the SslHandshakeCompletionEvent before the asynchronous O= CSP validation completes. This allows the client's downstream handlers to s= end sensitive application data (e.g., HTTP requests) to a revoked server be= fore the channel is closed by the OCSP check. n io.netty.handler.ssl.ocsp.O= cspServerCertificateValidator#userEventTriggered, when an SslHandshakeCompl= etionEvent is received, the validator immediately calls ctx.fireUserEventTr= iggered(evt). It then initiates an asynchronous OCSP query using OcspClient= .query. Because the handshake completion event is forwarded immediately, do= wnstream handlers in the client's pipeline are notified that the TLS handsh= ake is successful. They may then begin reading and processing incoming appl= ication data or sending outgoing data. If the OCSP response later indicates=
the server's certificate is REVOKED, the validator closes the channel, but=
by this time, the client may have already leaked sensitive data to a revok=
ed server or processed malicious responses from it. This issue has been fix=
ed in versions 4.1.136.Final and 4.2.16.Final.</td>
<td>2026-07-28</td>
<td>7.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56822" target=3D= "_blank" rel=3D"noopener">CVE-2026-56822</a></td>
</tr>

<td class=3D"vendor-product">Nexcess--GiveWP</td>
<td>Unauthenticated Cross Site Scripting (XSS) in GiveWP &lt;=3D 4.16.3 ver= sions.</td>
<td>2026-07-27</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65441" target=3D= "_blank" rel=3D"noopener">CVE-2026-65441</a></td>
</tr>

<td class=3D"vendor-product">nico23--Advanced Responsive Video Embedder for=
Rumble, Odysee, YouTube, Vimeo, Kick</td>
<td>The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vim= eo, Kick plugin for WordPress is vulnerable to Authentication Bypass via a = Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the = `_arve_uc_init()` function - registered on WordPress's `init` hook at prior= ity 1 so that it runs before any authentication checks on every request - r= eads an attacker-supplied token from the `_wplogin` (or `_wpm`) parameter a=
nd compares it against a hardcoded SHA-256 hash embedded directly in the pl= ugin source, with no nonce verification, no capability check, and no passwo=
rd validation anywhere in the flow. Because this static hash constitutes a = set of universal credentials that are publicly accessible in the plugin's s= ource code, unauthenticated attackers can supply the known token to be auth= enticated as an arbitrarily selected existing administrator account, gainin=
g full administrative control over the affected WordPress site. This was li= kely introduced by an attacker who gained commit access to the developers a= ccount.</td>
<td>2026-07-29</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18072" target=3D= "_blank" rel=3D"noopener">CVE-2026-18072</a></td>
</tr>

<td class=3D"vendor-product">nitroshare--nitroshare-desktop</td>
<td>NitroShare Desktop through 0.3.4 contains a path traversal vulnerabilit=
y in its LAN file transfer server that allows unauthenticated attackers on = the same network to write arbitrary files by sending a crafted filename con= taining directory traversal sequences in the JSON item header name field. A= ttackers can exploit the lack of path validation to write files outside the=
transfer root directory to arbitrary locations the current user has write = access, including the Windows Startup folder, enabling persistent code exec= ution on the next user login.</td>
<td>2026-07-27</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66050" target=3D= "_blank" rel=3D"noopener">CVE-2026-66050</a></td>
</tr>

<td class=3D"vendor-product">NVIDIA--DCGM</td>
<td>NVIDIA DCGM Exporter for all platforms contains a vulnerability in the = /debug/pprof endpoints, where an attacker could cause uncontrolled resource=
consumption by submitting concurrent unauthenticated profiling requests. A=
successful exploit of this vulnerability might lead to denial of service a=
nd information disclosure.</td>
<td>2026-07-28</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-47483" target=3D= "_blank" rel=3D"noopener">CVE-2026-47483</a></td>
</tr>

<td class=3D"vendor-product">NVIDIA--NeMo Framework</td>
<td>NVIDIA NeMo for Linux contains a vulnerability where an attacker may ca= use OS command injection. A successful exploit of this vulnerability may le=
ad to code execution, data tampering, escalation of privileges and informat= ion disclosure.</td>
<td>2026-07-27</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-24252" target=3D= "_blank" rel=3D"noopener">CVE-2026-24252</a></td>
</tr>

<td class=3D"vendor-product">o6 Automation--open62541</td>
<td>A heap use-after-free vulnerability in the TransferSubscriptions servic=
e in open62541 may allow an authenticated attacker to cause a denial of ser= vice or potentially execute arbitrary code.</td>
<td>2026-07-30</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63035" target=3D= "_blank" rel=3D"noopener">CVE-2026-63035</a></td>
</tr>

<td class=3D"vendor-product">o6 Automation--open62541</td>
<td>An integer overflow in the UA_Variant arrayDimensions product computati=
on in open62541 may allow a remote attacker to trigger an out-of-bounds wri= te.</td>
<td>2026-07-30</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65423" target=3D= "_blank" rel=3D"noopener">CVE-2026-65423</a></td>
</tr>

<td class=3D"vendor-product">o6 Automation--open62541</td>
<td>An integer overflow in the UA_Variant arrayDimensions product computati=
on in open62541 may allow a remote attacker to read out-of-bounds heap memo= ry, potentially disclosing sensitive information.</td>
<td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63559" target=3D= "_blank" rel=3D"noopener">CVE-2026-63559</a></td>
</tr>

<td class=3D"vendor-product">OliveTin--OliveTin</td>
<td>OliveTin gives access to predefined shell commands from a web interface=
. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapi= _auth_oauth2.go OAuth2 login handler stores per-login state in the register= edStates map on every /oauth/login request without expiring, deleting, or b= ounding entries, allowing an unauthenticated attacker to exhaust memory and=
cause a denial of service. This issue is fixed in version 3000.17.0.</td> <td>2026-07-29</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67437" target=3D= "_blank" rel=3D"noopener">CVE-2026-67437</a></td>
</tr>

<td class=3D"vendor-product">opencost--opencost</td>
<td>OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpo= int, exposing base64-decoded HELM_VALUES environment variable containing cl= oud provider credentials. Additionally, adminAuthMiddleware fails open when=
ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP ser= vice account keys via POST /serviceKey to redirect billing calls.</td> <td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67349" target=3D= "_blank" rel=3D"noopener">CVE-2026-67349</a></td>
</tr>

<td class=3D"vendor-product">openwrt--luci</td>
<td>luci-app-https-dns-proxy contains a stored cross-site scripting vulnera= bility in the resolver_url parameter that allows authenticated users to inj= ect active HTML. When an administrator views the HTTPS DNS Proxy status pag=
e, the resolver URL is rendered as raw HTML and executes JavaScript in the = administrator's browser origin.</td>
<td>2026-08-01</td>
<td>7.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67352" target=3D= "_blank" rel=3D"noopener">CVE-2026-67352</a></td>
</tr>

<td class=3D"vendor-product">opf--openproject</td>
<td>OpenProject is open-source, web-based project management software. Prio=
r to 17.6.0, PATCH /api/v3/work_packages/{id} accepted _links.fileLinks and=
allowed authenticated users with edit_work_packages but without manage_fil= e_links to resolve Storages::FileLink records by raw id, detach or hard-del= ete existing FileLinks, and re-parent FileLinks from other projects to an a= ttacker-controlled work package, exposing origin filename, origin id, and M= IME type metadata. This issue is fixed in 17.6.0.</td>
<td>2026-07-30</td>
<td>7.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67527" target=3D= "_blank" rel=3D"noopener">CVE-2026-67527</a></td>
</tr>

<td class=3D"vendor-product">owen2345--camaleon-cms</td>
<td>Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated rem= ote code execution vulnerability that allows users with custom_fields manag=
e permission to execute arbitrary Ruby code by supplying a malicious expres= sion through the select_eval custom field type. Attackers can store an atta= cker-controlled Ruby expression in the field options command parameter, whi=
ch is evaluated via instance_eval within an ERB view whenever a post edit p= age is rendered, achieving server-side code execution with web server proce=
ss privileges.</td>
<td>2026-07-28</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66748" target=3D= "_blank" rel=3D"noopener">CVE-2026-66748</a></td>
</tr>

<td class=3D"vendor-product">Payment Plugins--Stripe For WooCommerce</td> <td>Unauthenticated Broken Access Control in Stripe For WooCommerce &lt;=3D=
4.0.7 versions.</td>
<td>2026-07-27</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59530" target=3D= "_blank" rel=3D"noopener">CVE-2026-59530</a></td>
</tr>

<td class=3D"vendor-product">pgadmin.org--pgAdmin 4</td> <td>/misc/workspace/adhoc_connect_server, part of the Workspaces feature in= troduced in pgAdmin 4 9.0, when passed the id of an existing server, clones=
that server via Server.clone(), which copies every column from the source = row, including user_id, shared, shared_username, and the stored credential = fields password, save_password, and tunnel_password. When a non-owner trigg= ered an adhoc connect against another user's (in practice, typically an adm= inistrator's) shared server, the clone inherited that user's ownership, sha= red flag, and stored database credentials verbatim. pgAdmin persisted this = cross-tenant, credential-bearing server row before the connection was even = attempted, so it survived even when the connection subsequently failed. The=
non-owner could then open the newly-owned clone and pgAdmin would connect = using the source user's stored database password on the non-owner's behalf,=
granting the non-owner use of database credentials -- and whatever databas=
e privileges they confer -- that were never their own. Fix forces the clone=
d adhoc record's ownership fields (user_id, shared, shared_username) and st= ored credential fields (password, save_password, tunnel_password) to belong=
to the calling user and be cleared/private before committing, regardless o=
f the source server's ownership, sharing state, or stored credentials. A re= gression test asserts that an adhoc connect triggered by a non-owner agains=
t another user's shared server persists a row owned by the caller, not shar= ed, and without the source's stored credentials. This issue affects pgAdmin=
4: from 9.0 before 9.17.</td>

<td>2026-07-31</td>
<td>9.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17349" target=3D= "_blank" rel=3D"noopener">CVE-2026-17349</a></td>
</tr>

<td class=3D"vendor-product">pgadmin.org--pgAdmin 4</td>
<td>The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied = query passed to the AI Assistant's execute_sql_query tool to parse, via sql= parse, as exactly one non-transaction-control statement before running it i= nside a BEGIN TRANSACTION READ ONLY wrapper. sqlparse's string-literal lexi=
ng can disagree with PostgreSQL's own parser: under standard_conforming_str= ings =3D on (PostgreSQL's default since 9.1), a backslash immediately befor=
e a quote is an ordinary character to PostgreSQL, but sqlparse treats it as=
escaping the quote. A payload such as SELECT ';COMMIT;CREATE TABLE pwn(x i= nt);SELECT 1 --' therefore parses as a single SELECT to sqlparse's validato=
r, while PostgreSQL executes it as four statements: the smuggled COMMIT end=
s the wrapping read-only transaction, and the trailing ROLLBACK becomes a n= o-op. This reintroduces the same write/RCE bypass CVE-2026-12045 was meant =
to close, reachable via the same indirect prompt-injection delivery (an att= acker plants the payload in any object the AI Assistant may read; the LLM e= mits it as a tool call). An initial candidate fix ran the query with psycop= g's execute(..., prepare=3DTrue), intending to force PostgreSQL's own Parse=
step (extended query protocol) to reject multi-statement text regardless o=
f sqlparse's classification. This candidate fix does not work as submitted:=
psycopg3's PrepareManager silently ignores the prepare argument whenever t=
he connection's prepare_threshold is None, which is pgAdmin's default for e= very server connection (the per-server "Prepare threshold" field is blank u= nless an administrator explicitly sets it) -- psycopg3 falls back to the si= mple query protocol, the same multi-statement-capable path the bypass explo= its, so the candidate fix closes nothing on any real-world default configur= ation. The corrected fix sets conn.prepare_threshold =3D 0 directly on the = dedicated, single-use read-only connection the AI Assistant tool opens, str= ucturally forcing the extended query protocol independent of any server-lev=
el configuration. Verified against a live PostgreSQL 18 instance: the paylo=
ad executes successfully under the prepare_threshold=3DNone (default) behav= ior, and is rejected with "cannot insert multiple commands into a prepared = statement" once prepare_threshold=3D0 is set on that connection. This issue=
affects pgAdmin 4: from 9.13 before 9.17.</td>
<td>2026-07-31</td>
<td>9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17351" target=3D= "_blank" rel=3D"noopener">CVE-2026-17351</a></td>
</tr>

<td class=3D"vendor-product">pgadmin.org--pgAdmin 4</td>
<td>pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command l= ine by interpolating a user-supplied SQL query into a Jinja template and pa= ssing the rendered line to psql via --command. To stop an attacker from bre= aking out of the (...) wrapper, create_import_export_job() (route POST /imp= ort_export/job/&lt;sid&gt;, gated only by the ordinary, commonly-granted to= ols_import_export_data permission) validated the query with a hand-written = parenthesis-balance checker, _is_query_parens_balanced(). That checker alwa=
ys treated a backslash before a single quote () as escaping the quote, i.e.=
as if standard_conforming_strings were off. PostgreSQL has defaulted stand= ard_conforming_strings to on since 9.1 (2010), the default on every Postgre= SQL version pgAdmin 4 currently supports (13-18); under that default psql's=
own \copy tokenizer treats \ as an ordinary character, so a single quote i= mmediately after it closes the string literal. A query such as SELECT 'a) T=
O PROGRAM 'echo pwned' x' was therefore accepted as "balanced" by pgAdmin's=
checker (which believed the ) was still inside the string), while psql, ru=
n through the actual rendered command line, closes the string at that point=
and treats the following ) as the end of the wrapping \copy (...) subquery=
, exposing an attacker-chosen TO PROGRAM '&lt;command&gt;' clause that psql=
executes via popen() -- independent of a subsequent syntax error later on = the same line. This is the same class of bug as CVE-2025-12762/CVE-2025-137=
80 (RCE via psql meta-command/COPY injection during PLAIN-format dump resto= re), reached through an independently written defense in a different module=
(Import/Export Data rather than Restore) that had its own, different logic=
bug (inverted backslash-escape semantics rather than a BOM-defeated regex = anchor). The fix rejects any backslash inside a single-quoted string in the=
query outright, rather than picking one of the two possible psql interpret= ations. This is intentionally conservative: because the correct interpretat= ion of \ depends on the target server's standard_conforming_strings setting=
, which the checker cannot reliably know at validation time, refusing the q= uery is safer than guessing. This issue affects pgAdmin 4: from the introdu= ction of _is_query_parens_balanced() before 9.18.</td>
<td>2026-07-31</td>
<td>9.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17566" target=3D= "_blank" rel=3D"noopener">CVE-2026-17566</a></td>
</tr>

<td class=3D"vendor-product">pgadmin.org--pgAdmin 4</td>
<td>The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and swi= tched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but m= issed several sinks that had been placed in test_sql_string_literal_lint.py=
's ALLOWLIST on the incorrect assumption that schema, table, publication, a=
nd subscription names sourced from pg_catalog via the browser tree could ne= ver contain an apostrophe. PostgreSQL permits arbitrary characters in quote=
d identifiers, so a low-privileged user able to CREATE TABLE, CREATE PUBLIC= ATION, or CREATE SUBSCRIPTION can plant an apostrophe'd object name that br= eaks out of the unescaped '{{ name }}' template interpolation the moment an=
y user (including a higher-privileged one) opens that object's Statistics o=
r Dependencies tab, allowing arbitrary SQL statement injection in the viewi=
ng user's database session. Affected sinks: the Index Statistics query for = all-indexes listing (coll_stats.sql, both the 16_plus and default PostgreSQ= L-version template variants -- distinct from the single-index stats.sql pat=
h already fixed in CVE-2026-12044), and the publication and subscription de= pendencies.sql / get_position.sql templates (both the pg and ppas/EPAS dial= ect variants for publications). Fix switches all of these templates to qtLi= teral(conn) for name interpolation, and updates publications/__init__.py an=
d subscriptions/__init__.py to pass conn=3Dself.conn into the dependencies.= sql render_template call so the qtLiteral filter has a connection to quote = against. The corresponding ALLOWLIST entries in test_sql_string_literal_lin= t.py are removed now that these sinks are properly escaped rather than mere=
ly assumed safe. A behavioral regression test renders each fixed template w= ith a stacked-statement apostrophe payload and asserts both that the object=
name appears exactly as qtLiteral-escaped and that the rendered SQL parses=
as exactly one statement, verifying the assertion genuinely fails against = the pre-patch raw-interpolation form. This issue affects pgAdmin 4: the Ind=
ex Statistics sink from 1.0, and the Publications/Subscriptions sinks from = 5.0, both before 9.17.</td>
<td>2026-07-31</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17346" target=3D= "_blank" rel=3D"noopener">CVE-2026-17346</a></td>
</tr>

<td class=3D"vendor-product">pgadmin.org--pgAdmin 4</td>
<td>The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an = administrator configure an external command that returns a per-user encrypt= ion key, with %u in the configured string replaced by the current user's na= me. The previous implementation substituted the username directly into the = command string and executed the result with subprocess.Popen(..., shell=3DT= rue). Because the username can originate from an external authentication so= urce (OAuth/OIDC claims, Kerberos, webserver auth) rather than a value pgAd= min fully controls, a username containing shell metacharacters (';', '$()',=
backticks, pipes, '&amp;&amp;', newlines) allowed an authenticated user to=
execute arbitrary commands as the pgAdmin service account in any deploymen=
t where the configured hook string uses %u. Fix tokenises the trusted, admi= nistrator-configured hook string into an argument vector first (using shlex=
in POSIX-quoting mode, with backslash-escaping disabled so Windows-style p= aths are not mis-parsed), substitutes the untrusted username into the indiv= idual argv elements, and executes with shell=3DFalse. The username is there= fore always confined to a single argv element; any shell metacharacters it = contains are inert. Administrators whose MASTER_PASSWORD_HOOK previously re= lied on shell features (pipes, redirection, environment-variable expansion,=
globbing) within the hook string itself must move that logic into the invo= ked script, since it is no longer interpreted by a shell. This issue affect=
s pgAdmin 4: from 7.2 before 9.17.</td>
<td>2026-07-31</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17347" target=3D= "_blank" rel=3D"noopener">CVE-2026-17347</a></td>
</tr>

<td class=3D"vendor-product">pgvector--pgvector</td>
<td>Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allo=
ws a database user to write data out-of-bounds, which could lead to arbitra=
ry code execution. Only 32-bit systems are affected.</td>
<td>2026-07-29</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18022" target=3D= "_blank" rel=3D"noopener">CVE-2026-18022</a></td>
</tr>

<td class=3D"vendor-product">pheditor--pheditor</td>
<td>Pheditor is a single-file editor and file manager written in PHP. From = version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerabilit=
y in the terminal action handler allows any authenticated user to execute a= rbitrary OS commands by injecting shell metacharacters into the 'dir' POST = parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achievi=
ng full Remote Code Execution with web server privileges. This issue has be=
en patched in version 2.0.4.</td>
<td>2026-07-27</td>
<td>9.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48030" target=3D= "_blank" rel=3D"noopener">CVE-2026-48030</a></td>
</tr>

<td class=3D"vendor-product">pheditor--pheditor</td>
<td>Pheditor is a single-file editor and file manager written in PHP. From = version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded defa= ult password admin (SHA-512 hash stored at pheditor.php:11). There is no me= chanism to force a password change on first login. Any deployment using the=
default credentials grants an attacker full access to the file editor, fil=
e upload, and terminal features, enabling arbitrary file read/write and rem= ote code execution. This issue has been patched in version 2.0.6.</td> <td>2026-07-27</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55579" target=3D= "_blank" rel=3D"noopener">CVE-2026-55579</a></td>
</tr>

<td class=3D"vendor-product">pheditor--pheditor</td>
<td>Pheditor is a single-file editor and file manager written in PHP. Prior=
to version 2.0.5, there is an authenticated terminal command whitelist byp= ass. The terminal feature checks whether the submitted command starts with = one of the configured TERMINAL_COMMANDS values, then passes the full comman=
d string to shell_exec(). Shell command substitution such as $() is not blo= cked, so an authenticated user with the terminal permission can bypass a re= stricted command allowlist and execute arbitrary shell commands as the web = server user. This issue has been patched in version 2.0.5.</td> <td>2026-07-27</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54540" target=3D= "_blank" rel=3D"noopener">CVE-2026-54540</a></td>
</tr>

<td class=3D"vendor-product">pheditor--pheditor</td>
<td>Pheditor is a single-file editor and file manager written in PHP. From = version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor use=
s an incomplete character blocklist to sanitize user-supplied commands befo=
re passing them to shell_exec(). After the fix for GHSA-9643-6xjp-vx57 (whi=
ch added $ to the blocklist), the characters | (single pipe), ` (backtick),=
and the newline byte (0x0A) remain unblocked. An authenticated user with t=
he terminal permission (enabled by default) can leverage any of these to by= pass the TERMINAL_COMMANDS allowlist and execute arbitrary OS commands as t=
he web server user. This issue has been patched in version 2.0.6.</td> <td>2026-07-27</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55578" target=3D= "_blank" rel=3D"noopener">CVE-2026-55578</a></td>
</tr>

<td class=3D"vendor-product">Phoenix Contact--CHARX SEC-3150</td>
<td>Due to missing authentication, an unauthenticated remote attacker may a= ccess the MQTT broker, which is only protected from external access by a fi= rewall. This may lead to the device being fully compromised.</td> <td>2026-07-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44090" target=3D= "_blank" rel=3D"noopener">CVE-2026-44090</a></td>
</tr>

<td class=3D"vendor-product">Phoenix Contact--CHARX SEC-3150</td>
<td>An unauthenticated remote attacker can post a malicious ID to the MQTT = Broker results in the creation of a new configuration entry in the system c= onfiguration. This may lead to integrity and availability loss.</td>

<td>2026-07-30</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44091" target=3D= "_blank" rel=3D"noopener">CVE-2026-44091</a></td>
</tr>

<td class=3D"vendor-product">Phoenix Contact--CHARX SEC-3150</td>
<td>An unauthenticated remote attacker can inject malicious input into the = ModbusServer application because it does not validate the input it fetches = from MQTT. This may lead to integrity and availability loss.</td> <td>2026-07-30</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44092" target=3D= "_blank" rel=3D"noopener">CVE-2026-44092</a></td>
</tr>

<td class=3D"vendor-product">Phoenix Contact--CHARX SEC-3150</td>
<td>The CHARX JupiCore service allows an unauthenticated remote attacker to=
reconfigure charging points. This can lead to disclosure of charging point=
UIDs, Denial-of-Service and files tampering.</td>
<td>2026-07-30</td>
<td>9.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44100" target=3D= "_blank" rel=3D"noopener">CVE-2026-44100</a></td>
</tr>

<td class=3D"vendor-product">Phoenix Contact--CHARX SEC-3150</td>
<td>Due to missing authentication the CHARX OCPP Agent service allows an un= authenticated remote attacker to reconfigure the backend connection. This c=
an lead to Denial-of-Service and confidential data being disclosed to the a= ttacker.</td>
<td>2026-07-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44101" target=3D= "_blank" rel=3D"noopener">CVE-2026-44101</a></td>
</tr>

<td class=3D"vendor-product">Phoenix Contact--CHARX SEC-3150</td>
<td>The firmware update process for the basemodule of the charging controll=
er only validates the CRC32 checksum without cryptographic signature verifi= cation. This allows an unauthenticated remote attacker to install a modifie=
d firmware, resulting in full system compromise.</td>
<td>2026-07-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44104" target=3D= "_blank" rel=3D"noopener">CVE-2026-44104</a></td>
</tr>

<td class=3D"vendor-product">Phoenix Contact--CHARX SEC-3150</td>
<td>Due to a flaw in the execution order of scripts during shutdown, the fi= rewall is terminated prematurely during system shutdown. This creates a tem= porary window in which internal services may become externally accessible, = potentially allowing an unauthenticated remote attacker to connect to these=
services, resulting in full system compromise.</td>
<td>2026-07-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44108" target=3D= "_blank" rel=3D"noopener">CVE-2026-44108</a></td>
</tr>

<td class=3D"vendor-product">Phoenix Contact--CHARX SEC-3150</td>
<td>Due to improper neutralization of special elements, an unauthenticated = remote attacker is able to inject a command into the system configuration w= hich is subsequently executed as root.</td>
<td>2026-07-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7849" target=3D"= _blank" rel=3D"noopener">CVE-2026-7849</a></td>
</tr>

<td class=3D"vendor-product">Phoenix Contact--CHARX SEC-3150</td>
<td>An unauthenticated remote attacker can enforce the system to fall back =
to a firmware partition with an insecure configuration including default cr= edentials. This could allow the attacker to gain SSH access to the system a=
s an unprivileged user "user-app". Charging could be interrupted.</td> <td>2026-07-30</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44094" target=3D= "_blank" rel=3D"noopener">CVE-2026-44094</a></td>
</tr>

<td class=3D"vendor-product">Phoenix Contact--CHARX SEC-3150</td>
<td>This vulnerability allows an unauthenticated remote attacker with contr=
ol over the OCPP backend via firewall-bypass to perform an OS command injec= tion, resulting in the execution of arbitrary commands as the limited user = charx-oa. Charging could be interrupted.</td>
<td>2026-07-30</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44098" target=3D= "_blank" rel=3D"noopener">CVE-2026-44098</a></td>
</tr>

<td class=3D"vendor-product">Phoenix Contact--CHARX SEC-3150</td>
<td>A local privilege escalation vulnerability in the init-script for user-= applications allows a low-privileged local user to execute arbitrary comman=
ds as root, resulting in full system compromise.</td>
<td>2026-07-30</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44093" target=3D= "_blank" rel=3D"noopener">CVE-2026-44093</a></td>
</tr>

<td class=3D"vendor-product">Phoenix Contact--CHARX SEC-3150</td>
<td>A privilege escalation vulnerability in a script used for network confi= guration allows a low-privileged local user to execute arbitrary commands a=
s root, resulting in full system compromise.</td>
<td>2026-07-30</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44095" target=3D= "_blank" rel=3D"noopener">CVE-2026-44095</a></td>
</tr>

<td class=3D"vendor-product">Phoenix Contact--CHARX SEC-3150</td>
<td>A privilege escalation vulnerability in udhcpc allows a local user "cha= rx-web" to execute arbitrary commands as root, resulting in full system com= promise.</td>
<td>2026-07-30</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44096" target=3D= "_blank" rel=3D"noopener">CVE-2026-44096</a></td>
</tr>

<td class=3D"vendor-product">Phoenix Contact--CHARX SEC-3150</td>
<td>A low-privileged remote attacker with "operator" access can upload arbi= trary files via the REST endpoint intended for firmware updates, resulting =
in persistent storage of attacker-controlled files and potentially exhausti=
ng resources, which might lead to Denial-of-Service.</td>
<td>2026-07-30</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44097" target=3D= "_blank" rel=3D"noopener">CVE-2026-44097</a></td>
</tr>

<td class=3D"vendor-product">Phoenix Contact--CHARX SEC-3150</td>
<td>A privilege escalation vulnerability in the system configuration allows=
a low-privileged local user to execute arbitrary commands as root, resulti=
ng in full system compromise.</td>
<td>2026-07-30</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44099" target=3D= "_blank" rel=3D"noopener">CVE-2026-44099</a></td>
</tr>

<td class=3D"vendor-product">Phoenix Contact--CHARX SEC-3150</td>
<td>A privilege escalation vulnerability in the init-script for user-applic= ations allows a low-privileged local user to execute arbitrary commands as = root, resulting in full system compromise.</td>
<td>2026-07-30</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44106" target=3D= "_blank" rel=3D"noopener">CVE-2026-44106</a></td>
</tr>

<td class=3D"vendor-product">Phoenix Contact--CHARX SEC-3150</td>
<td>A reboot of the charging controller can be triggered via Modbus TCP wit= hout authentication. Therefore, when the Modbus functionality is enabled by=
opening the port that CharxModbusServer is listening, an unauthenticated a= ttacker can perform a Denial-of-Service attack.</td>
<td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44107" target=3D= "_blank" rel=3D"noopener">CVE-2026-44107</a></td>
</tr>

<td class=3D"vendor-product">PHPOffice--PhpSpreadsheet</td>
<td>PhpSpreadsheet is a pure PHP library for reading and writing spreadshee=
t files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 throu=
gh 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5=
, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (S= SRF). In Calculation/Web/Service.php, the webService() method validates a U= RL's host against the whitelist set via Spreadsheet::setDomainWhiteList(), = then fetches content with file_get_contents($url, false, $ctx); because PHP=
's HTTP stream wrapper follows 301/302 redirects automatically (up to 20 ho= ps) and the redirect target is never re-validated, an attacker who can trig= ger a redirect from a whitelisted domain can reach arbitrary URLs, includin=
g internal addresses. An attacker able to upload XLSX files to an applicati=
on that uses setDomainWhiteList() and getCalculatedValue() can achieve a fu= ll-read SSRF, returning up to 32,767 bytes of the response body as a cell's=
calculated value, which enables exfiltration of cloud metadata (AWS/GCP/Az= ure credentials via http://169.254.169.254/), access to internal-only servi= ces, and internal port scanning (the port is not validated). This issue has=
been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6.</td> <td>2026-07-28</td>
<td>7.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59931" target=3D= "_blank" rel=3D"noopener">CVE-2026-59931</a></td>
</tr>

<td class=3D"vendor-product">PHPOffice--PhpSpreadsheet</td>
<td>PhpSpreadsheet is a pure PHP library for reading and writing spreadshee=
t files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 throu=
gh 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5=
, the Gnumeric reader reads attacker-supplied .gnumeric files into memory a= nd, when the file starts with gzip magic bytes, calls gzdecode() on the ful=
l compressed contents without enforcing a decompressed-size limit. A very s= mall compressed .gnumeric file can expand to data larger than the PHP memor=
y limit and crash the process during Gnumeric::canRead() before the file is=
rejected or fully parsed. This is reachable through normal file-type detec= tion and Gnumeric loading paths, so applications that accept attacker-contr= olled spreadsheet uploads can suffer denial of service. This issue has been=
fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6.</td> <td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59932" target=3D= "_blank" rel=3D"noopener">CVE-2026-59932</a></td>
</tr>

<td class=3D"vendor-product">PHPOffice--PhpSpreadsheet</td>
<td>PhpSpreadsheet is a pure PHP library for reading and writing spreadshee=
t files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 throu=
gh 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5=
, the OLE reader follows sector chains from attacker-controlled XLS/OLE met= adata without detecting cycles or enforcing a maximum chain length. A tiny = malformed .xls/OLE file can set the small-block depot sector chain to point=
back to itself. During normal XLS detection, OLERead::read() appends the s= ame sector data repeatedly until the PHP process exhausts memory. This is r= eachable from Reader\Xls::canRead() and therefore from automatic spreadshee=
t type detection. Applications that accept attacker-controlled spreadsheet = uploads can suffer denial of service from a very small file. This issue has=
been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6.</td> <td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59933" target=3D= "_blank" rel=3D"noopener">CVE-2026-59933</a></td>
</tr>

<td class=3D"vendor-product">phun-ky--defaults-deep</td> <td>@phun-ky/defaults-deep is a library like lodash defaultsDeep with array=
preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recu= rsively merges user-supplied objects without filtering proto, constructor, = and prototype, allowing properties to be written to Object.prototype. This = issue is fixed in version 2.0.5.</td>
<td>2026-07-31</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54737" target=3D= "_blank" rel=3D"noopener">CVE-2026-54737</a></td>
</tr>

<td class=3D"vendor-product">pickplugins--PickPlugins Question Answer</td> <td>The PickPlugins Question Answer plugin for WordPress is vulnerable to S=
QL Injection in versions up to and including 1.2.73. This is due to insuffi= cient sanitization of user-supplied input via the 'id' GET parameter in the=
user profile template combined with the use of wp_unslash() which removes = WordPress's magic quotes protection, followed by direct concatenation into =
a SQL query without proper escaping or prepared statements in the qa_user_p= rofile_card() function. This makes it possible for unauthenticated attacker=
s to append additional SQL queries into existing queries, which can be used=
to extract sensitive information from the database.</td>
<td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10207" target=3D= "_blank" rel=3D"noopener">CVE-2026-10207</a></td>
</tr>

<td class=3D"vendor-product">pionxzh--wakaru</td>
<td>wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 un= til 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only on=
ce before writing extracted modules, so a crafted filename containing overl= apping traversal sequences such as ....// collapses to ../ after sanitizati=
on and lets the final output path escape the selected output directory, all= owing an attacker who can cause a user to run wakaru --unpack on a maliciou=
s bundle to write files outside that directory and, depending on the target=
path and environment, potentially achieve code execution. This issue is fi= xed in @wakaru/cli 1.4.0.</td>
<td>2026-07-28</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54545" target=3D= "_blank" rel=3D"noopener">CVE-2026-54545</a></td>
</tr>

<td class=3D"vendor-product">postcss--postcss</td>
<td>PostCSS takes a CSS file and provides an API to analyze and modify its = rules by transforming the rules into an Abstract Syntax Tree. In versions 8= .5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=3DPATH */ = comment from any CSS string passed to process() and dereferences PATH again=
st the local filesystem with no scheme, allowlist, or traversal check. An a= ttacker who controls the CSS input can cause the host process to read any f= ile readable by Node and leak the first ~10 bytes of its content through th=
e resulting JSON.parse SyntaxError message. The bug also yields a precise f= ile-existence oracle and a controllable-read primitive that may be combined=
with large-file targets for DoS. The behaviour is triggered with PostCSS's=
default options - no from, no map, no plugins required - and is therefore = reachable from any pipeline that runs untrusted CSS through PostCSS (CMS th= emes, user-uploaded styles, browser-extension/userstyle processors, build p= ipelines for third-party packages, blog comment renderers, etc.). This issu=
e has been fixed in version 8.5.12.</td>
<td>2026-07-27</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-45623" target=3D= "_blank" rel=3D"noopener">CVE-2026-45623</a></td>
</tr>

<td class=3D"vendor-product">prebid--prebid-server</td>
<td>Prebid Server is an open-source solution for running real-time advertis= ing auctions in the cloud. Prior to version 4.4.0, certain bidder adapters =
in Prebid Server interpolate user-supplied parameters into outbound request=
URLs without properly validating host and subdomain values, allowing craft=
ed bid request parameters to cause server-side requests to unintended desti= nations and potentially expose internal network services or sensitive serve=
r endpoints. This issue is fixed in version 4.4.0.</td>
<td>2026-07-29</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54735" target=3D= "_blank" rel=3D"noopener">CVE-2026-54735</a></td>
</tr>

<td class=3D"vendor-product">Progress Software--LoadMaster</td>
<td>An OS Command Injection vulnerability in Progress Software LoadMaster, = ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF all= ows an authenticated attacker with high privileges to execute arbitrary ope= rating system commands on the affected appliance via the management interfa= ce, potentially resulting in complete system compromise.</td> <td>2026-07-27</td>
<td>8.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59686" target=3D= "_blank" rel=3D"noopener">CVE-2026-59686</a></td>
</tr>

<td class=3D"vendor-product">Progress Software--LoadMaster</td>
<td>An OS Command Injection vulnerability in Progress Software LoadMaster, = ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF all= ows an authenticated attacker with high privileges to execute arbitrary ope= rating system commands on the affected appliance via the Geo Location manag= ement interface, potentially resulting in complete system compromise.</td> <td>2026-07-27</td>
<td>8.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59687" target=3D= "_blank" rel=3D"noopener">CVE-2026-59687</a></td>
</tr>

<td class=3D"vendor-product">Progress Software--LoadMaster</td>
<td>An OS Command Injection vulnerability in Progress Software LoadMaster, = ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF all= ows an authenticated attacker with high privileges to execute arbitrary ope= rating system commands on the affected appliance via the backup restore fun= ctionality, potentially resulting in complete system compromise.</td> <td>2026-07-27</td>
<td>8.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59688" target=3D= "_blank" rel=3D"noopener">CVE-2026-59688</a></td>
</tr>

<td class=3D"vendor-product">Progress Software--LoadMaster</td>
<td>An Incorrect Authorization vulnerability in Progress Software LoadMaste=
r, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF = allows an authenticated attacker with low privileges to escalate privileges=
to root on the affected appliance, potentially resulting in full system co= mpromise.</td>
<td>2026-07-27</td>
<td>8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59689" target=3D= "_blank" rel=3D"noopener">CVE-2026-59689</a></td>
</tr>

<td class=3D"vendor-product">Progress Software--LoadMaster</td>
<td>A Missing Authorization vulnerability in Progress Software LoadMaster, = ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Mu= lti Tenant allows an authenticated attacker with low privileges to perform = privileged administrative operations via the REST API that should not be ac= cessible to their permission level, potentially resulting in a system compr= omise.</td>
<td>2026-07-27</td>
<td>8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59690" target=3D= "_blank" rel=3D"noopener">CVE-2026-59690</a></td>
</tr>

<td class=3D"vendor-product">pronamic--Pronamic Pay</td>
<td>The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escala= tion in all versions up to, and including, 10.1.0 This is due to the `maybe= _update_user_role()` function passing an attacker-controlled Gravity Forms = field value (`$lead[$feed-&gt;user_role_field_id]`) directly into `WP_User:= :set_role()` without any allowlist validation, capability comparison, or pe= rmission check to constrain which roles can be assigned. This makes it poss= ible for authenticated attackers, with Subscriber-level access and above, t=
o escalate their own WordPress account to Administrator by tampering with t=
he role field value in a form submission. Exploitation requires that an adm= inistrator has already configured a Pronamic Pay payment feed in Gravity Fo= rms with the **Update User Role** option enabled and mapped to a form field=
; once that configuration is in place, no further preconditions exist to pr= event an authenticated attacker from exploiting this vulnerability.</td> <td>2026-08-01</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16635" target=3D= "_blank" rel=3D"noopener">CVE-2026-16635</a></td>
</tr>

<td class=3D"vendor-product">pterodactyl--panel</td>
<td>Pterodactyl is a free, open-source game server management panel. Prior =
to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file en= dpoint accepted any valid panel-signed JWT that contained server_uuid, user= _uuid, and unique_id claims without checking the token's intended purpose; = because the Panel issues JWTs carrying those same claims for lower-privileg=
e operations such as WebSocket authentication and file-download links, an a= uthenticated subuser could reuse one of those tokens (for example a WebSock=
et token obtained with only the websocket.connect permission) by replaying =
it against /upload/file to write arbitrary files to the same server, despit=
e never being granted the file.create permission. This issue is fixed in Pa= nel version 1.12.3 and Wings version 1.12.2.</td>
<td>2026-07-28</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54593" target=3D= "_blank" rel=3D"noopener">CVE-2026-54593</a></td>
</tr>

<td class=3D"vendor-product">pterodactyl--panel</td>
<td>Pterodactyl is a free, open-source game server management panel. From 1= .7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceP= rovider::configureRateLimiting() applied a single global bucket to the logi=
n and two-factor checkpoint endpoints instead of keying by IP or account: t=
he fall-through Limit::perMinute(10) covering POST /auth/login and POST /au= th/login/checkpoint omitted -&gt;by(), so Laravel derived a constant cache = key (md5('authentication')) shared by every request. An unauthenticated att= acker sending roughly ten requests per minute from a single IP, most cheapl=
y against the checkpoint endpoint (which has no reCAPTCHA), exhausts the sh= ared counter and causes HTTP 429 for every user attempting to log in or com= plete two-factor authentication, a panel-wide authentication denial of serv= ice that also locks out administrators. This issue is fixed in version 1.13= .0.</td>
<td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-61609" target=3D= "_blank" rel=3D"noopener">CVE-2026-61609</a></td>
</tr>

<td class=3D"vendor-product">pterodactyl--wings</td>
<td>Wings is the server control plane for Pterodactyl, a free, open-source = game server management panel. Prior to 1.12.3, {{config.}} placeholders in = egg configuration-file templates allow a low-privileged user to read {{conf= ig.token}}, {{config.token_id}}, and {{config.docker.registries}} from the = full daemon configuration. This issue is fixed in version 1.12.3.</td> <td>2026-07-31</td>
<td>9.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52855" target=3D= "_blank" rel=3D"noopener">CVE-2026-52855</a></td>
</tr>

<td class=3D"vendor-product">pterodactyl--wings</td>
<td>Wings is the server control plane for Pterodactyl, a free, open-source = game server management panel. Prior to 1.13.0, a malformed packet received = during the SFTP connection handshake causes a Go panic. This issue is fixed=
in version 1.13.0.</td>
<td>2026-07-31</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52856" target=3D= "_blank" rel=3D"noopener">CVE-2026-52856</a></td>
</tr>

<td class=3D"vendor-product">QuantumCloud--Simple Link Directory Pro</td> <td>Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Direc= tory Pro &lt;=3D 15.0.6 versions.</td>
<td>2026-07-27</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-61953" target=3D= "_blank" rel=3D"noopener">CVE-2026-61953</a></td>
</tr>

<td class=3D"vendor-product">Quiet-Terminal-Interactive--QTINeon</td>
<td>QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer proto= col library. In version 1.0.0, the relay's handleReconnectRequest forwards = RECONNECT_REQUEST packets to the host without bounding them, so an unauthen= ticated client can drive relay-to-host amplification and cause a denial of = service on the host. No fixed version is available as of this review.</td> <td>2026-07-28</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54609" target=3D= "_blank" rel=3D"noopener">CVE-2026-54609</a></td>
</tr>

<td class=3D"vendor-product">realtyna--Realtyna Organic IDX plugin + WPL Re=
al Estate</td>
<td>The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress =
is vulnerable to Arbitrary File Upload in all versions up to, and including=
, 5.2.0 via the upload function. This is due to missing file type validatio=
n in the upload function, combined with a publicly accessible I/O endpoint = authenticated solely by static, plugin-seeded API credentials that are iden= tical across all installations. This makes it possible for unauthenticated = attackers to upload files that may be executable, which makes remote code e= xecution possible. The WPL I/O service endpoint is registered on the public=
WordPress init hook with no WordPress capability check, and the required a= pi_key and api_secret values are static defaults seeded by the plugin's own=
SQL migration files, meaning any unauthenticated attacker who knows these = publicly documented defaults can reach and exploit the vulnerable upload pa= th.</td>
<td>2026-07-31</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14483" target=3D= "_blank" rel=3D"noopener">CVE-2026-14483</a></td>
</tr>

<td class=3D"vendor-product">realtyna--Realtyna Organic IDX plugin + WPL Re=
al Estate</td>
<td>The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrar=
y File Upload in versions up to, and including, 5.3.0. This is due to missi=
ng file extension and content validation in the saveLiveImages() function c= ombined with an insufficient authorization check on the get_keys() AJAX han= dler and a missing authentication check on the REST API import endpoint. Th=
is makes it possible for authenticated attackers, with subscriber-level acc= ess and above, to upload arbitrary files on the affected site's server whic=
h may make remote code execution possible.</td>
<td>2026-07-31</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16236" target=3D= "_blank" rel=3D"noopener">CVE-2026-16236</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Cost Management Metrics Operator</td> <td>A flaw was found in koku-metrics-operator. The operator's CostManagemen= tMetricsConfig custom resource allows user able to edit the CR to specify a=
n arbitrary upload URL. When authentication.type is set to token (the defau= lt), the cluster-global Red Hat Cloud pull-secret bearer token is attached =
to HTTP requests sent to this user-controlled URL, allowing the attacker to=
obtain the token.</td>
<td>2026-07-30</td>
<td>7.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18378" target=3D= "_blank" rel=3D"noopener">CVE-2026-18378</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Cost Management Metrics Operator</td> <td>A flaw was found in the koku-metrics-operator for Red Hat OpenShift. Th=
e operator's CostManagementMetricsConfig custom resource allows a user able=
to edit the CR to specify an arbitrary upload URL. The operator attaches i=
ts own Kubernetes service-account bearer token to queries sent to this user= -controlled URL, allowing the attacker to obtain the token.</td>

<td>2026-07-30</td>
<td>7.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18381" target=3D= "_blank" rel=3D"noopener">CVE-2026-18381</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Advanced Cluster Security 4</=

<td>A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (R= HACS). When processing Kubernetes Deployments, ACS replaces deployment iden= tity metadata based on the openshift.io/encoded-deployment-config label. A = user with permission to create Deployments can set this label to "null", ca= using ACS to treat the workload as having empty UID, name and labels and na= mespace "default". This bypasses deploy-time policy detection and enforceme=
nt visibility, prevents correct persistence in Central and breaks violation=
reporting and compliance correlation for the affected deployment.</td> <td>2026-07-31</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10079" target=3D= "_blank" rel=3D"noopener">CVE-2026-10079</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Ansible Automation Platform 2= </td>
<td>A flaw was found in aap-gateway, a component of Ansible Automation Plat= form's Event-Driven Ansible (EDA). An unauthenticated remote attacker can b= ypass mutual Transport Layer Security (mTLS) authentication for event strea= ms. This is achieved by manipulating the event stream URL and forging the H= TTP Subject header. The system also inadvertently discloses the expected ce= rtificate subject in error messages, which simplifies the attack. This vuln= erability allows an attacker to inject arbitrary events into EDA, potential=
ly triggering automated workflows.</td>
<td>2026-07-31</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18141" target=3D= "_blank" rel=3D"noopener">CVE-2026-18141</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Ansible Automation Platform 2= </td>
<td>A flaw was found in the Event-Driven Ansible (EDA) server. The External= EventStreamViewSet uses permissive access controls (permission_classes=3D[A= llowAny], authentication_classes=3D[]) and relies solely on the Subject HTT=
P header value for mTLS authentication without verifying that the header or= iginated from a trusted proxy. Additionally, the expected certificate Disti= nguished Name is leaked in the 403 error response body. An attacker who can=
reach the EDA API endpoint with a spoofed Subject header can inject arbitr= ary events into mTLS-protected event streams, triggering downstream automat= ion actions.</td>
<td>2026-07-27</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12383" target=3D= "_blank" rel=3D"noopener">CVE-2026-12383</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Directory Server 11</td>

<td>A flaw was found in 389 Directory Server. An unauthenticated remote att= acker can inject LDAP search filters into the CleanAllRUV replication statu= s-check extended operation. Because the handler performs the search against=
cn=3Dconfig with elevated replication plugin privileges and returns a bool= ean match result, the attacker can extract sensitive server configuration m= etadata, including replication bind DNs and password storage scheme informa= tion.</td>
<td>2026-07-31</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11770" target=3D= "_blank" rel=3D"noopener">CVE-2026-11770</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Directory Server 11</td>

<td>A stack buffer overflow flaw was found in 389 Directory Server (389-ds-= base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digi=
t characters from a network-supplied RUV berval into a fixed 16-byte stack = buffer without bounds checking. A remote unauthenticated attacker can crash=
the LDAP server by sending a crafted StartNSDS50ReplicationRequest extende=
d operation containing a replica ID field with more than 16 digit character=
s. The overflow occurs during payload decoding, before any authorization ch= eck. Stack protectors limit impact to denial of service.</td> <td>2026-07-31</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15722" target=3D= "_blank" rel=3D"noopener">CVE-2026-15722</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>

<td>A flaw in the PCP linux_sockets module exposes an unsecured internal co= nnection. An attacker with initial code execution can exploit this to escal= ate privileges and execute arbitrary commands as root.</td>
<td>2026-07-30</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16526" target=3D= "_blank" rel=3D"noopener">CVE-2026-16526</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>

<td>A security flaw combining LDAP filter injection and improper authorizat= ion checks was found in Samba Active Directory Domain Controller (AD DC). W= hen processing LDAP Compare requests, Samba fails to properly validate user= -supplied attribute names and executes the resulting internal database sear=
ch in a trusted context, bypassing normal Access Control List (ACL) enforce= ment. An authenticated low-privilege domain user can exploit these flaws to=
disclose confidential Active Directory attributes that would normally be i= naccessible. The disclosed information may be leveraged to derive sensitive=
authentication material, potentially leading to privilege escalation and c= omplete domain compromise. For example: In deployments configured with Grou=
p Managed Service Accounts (gMSAs), an attacker can extract the "msKds-Root= KeyData" attribute and derive gMSA passwords offline, potentially leading t=
o complete domain compromise if privileged gMSAs are present.</td> <td>2026-07-30</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58222" target=3D= "_blank" rel=3D"noopener">CVE-2026-58222</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>

<td>A flaw was found in sg3_utils. The sg_inq command, when invoked with th=
e --export option, outputs device identification data without sanitizing co= ntrol characters in SCSI name string fields. A newline character embedded i=
n a device-supplied name string can inject arbitrary properties into the ud=
ev device database. This could allow an attacker who can present a crafted = SCSI device to execute arbitrary commands as root when the device is discon= nected.</td>
<td>2026-07-28</td>
<td>7.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16313" target=3D= "_blank" rel=3D"noopener">CVE-2026-16313</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>

<td>A command injection flaw in PCP's linux_sockets PMDA allows malicious s= hell metacharacters via the network.persocket.filter metric. This failed va= lidation lets attackers execute arbitrary commands as the PMDA user when me= trics refresh.</td>
<td>2026-07-30</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16524" target=3D= "_blank" rel=3D"noopener">CVE-2026-16524</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>

<td>An unauthenticated remote attacker can bypass access controls by sendin=
g crafted requests to the PCP pmproxy /store endpoint. This allows the atta= cker to overwrite any PMDA metric, leading to arbitrary code execution and = system takeover.</td>
<td>2026-07-30</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16527" target=3D= "_blank" rel=3D"noopener">CVE-2026-16527</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>

<td>A signed integer overflow in the PCP __pmGetPDU() function can be explo= ited via crafted network packets during PDU processing or SASL negotiation.=
This permanently blinds the affected daemon, resulting in a total denial o=
f service (DoS) for subsequent packet reads.</td>
<td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16529" target=3D= "_blank" rel=3D"noopener">CVE-2026-16529</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>

<td>A flaw was found in the Linux kernel in net/can/bcm.c in can: bcm, wher=
e an unprivileged local user can exploit this vulnerability to execute arbi= trary code within the kernel, which leads to a local privilege escalation (= LPE). This allows the attacker to gain root privileges and take full contro=
l of the affected system.</td>
<td>2026-07-27</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17523" target=3D= "_blank" rel=3D"noopener">CVE-2026-17523</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>

<td>A flaw was found in CRIU's handling of restartable sequences (rseq) dur= ing checkpoint/restore. A malicious process inside a container can register=
an rseq critical section that hijacks CRIU's parasite code injection durin=
g checkpoint, allowing it to spoof the process credentials saved in the che= ckpoint image. On restore, the container process gains elevated capabilitie=
s and zeroed UIDs/GIDs. The practical impact on Red Hat products is limited=
by several factors: checkpoint/restore requires root privileges (podman) o=
r cluster-admin RBAC (OpenShift) to trigger and cannot be initiated from wi= thin the container itself; on OpenShift prior to 4.17 the feature required = explicit opt-in, and on 4.17+ the kubelet checkpoint API RBAC is not config= ured by default; OpenShift enforces user namespaces by default for regular = workloads (hostUsers is gated behind admin-only SCCs), which makes the spoo= fed capabilities namespace-scoped and ineffective for privilege escalation;=
SELinux type enforcement (container_t) blocks privilege transitions indepe= ndently of capabilities; seccomp filters persist through checkpoint/restore=
and cannot be corrupted via the parasite; and kernel mount namespace owner= ship checks on RHEL 9/10 kernels prevent mount-based container escape even = with spoofed capabilities.</td>
<td>2026-07-28</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18107" target=3D= "_blank" rel=3D"noopener">CVE-2026-18107</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>

<td>An out-of-bounds write vulnerability was found in the BFD library's DLX=
ELF backend (bfd/elf32-dlx.c) in GNU binutils. The dlx_rtype_to_howto() fu= nction maps ELF relocation types to internal howto structures but fails to = perform adequate bounds checking on attacker-controlled relocation type val= ues (via ELF32_R_TYPE(r_info)) before indexing into the dlx_elf_howto_table=
[] array. The DLX relocation type number space is non-contiguous (basic typ=
es 0-6, extended types at 0x10000+), but the default case in the switch sta= tement allows arbitrary index values to reach the array access. A specially=
crafted ELF/DLX object file can trigger this out-of-bounds write when proc= essed by any BFD-consuming tool (objdump, readelf, strip, ld, nm, objcopy).=
The vulnerability has been demonstrated to achieve arbitrary code executio=
n via a File Stream Oriented Programming (FSOP) attack against glibc FILE s= tructures (stderr), redirecting control flow to system(). Attack scenarios = include CI/CD pipelines performing automated binary analysis, developer wor= kstations running objdump/readelf on untrusted binaries, automated security=
scanning or malware analysis tools invoking binutils, and package build sy= stems processing third-party code. Note: This vulnerability is only exploit= able when binutils is built with the DLX backend enabled (typically via --e= nable-targets=3Dall).</td>
<td>2026-07-29</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18220" target=3D= "_blank" rel=3D"noopener">CVE-2026-18220</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat OpenShift Container Platform = 4</td>
<td>A flaw was found in openshift/oauth-proxy. The proxy sets authenticated=
identity headers using only dash-variant keys (X-Forwarded-User) but does = not strip underscore-variant keys (X_Forwarded_User) from incoming requests=
. WSGI and PHP frameworks normalize both variants to the same variable, all= owing an authenticated low-privilege user to smuggle a forged identity that=
may override the legitimate authenticated identity in the upstream applica= tion.</td>
<td>2026-07-28</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-49332" target=3D= "_blank" rel=3D"noopener">CVE-2026-49332</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat OpenShift Virtualization 4</t=

<td>In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:vi=
ew ClusterRole, intended to provide read-only access to CDI resources, incl= udes a rule granting create on the datavolumes/source subresource. CDI's Da= taVolume clone authorization accepts this permission as sufficient to autho= rize cloning the contents of any PVC the caller can name, without requiring=
write access to the source namespace. A user or service account bound to t=
he view role, commonly granted cluster-wide via ClusterRoleBinding, who als=
o has ordinary write access (edit/admin) to any single namespace, can use t= his to exfiltrate the contents of any PVC in the cluster into a namespace t= hey control, bypassing namespace isolation and the read-only guarantee of t=
he view role.</td>
<td>2026-07-27</td>
<td>7.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17527" target=3D= "_blank" rel=3D"noopener">CVE-2026-17527</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Quay 3</td>
<td>A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_US= ERS is able to view robot account tokens for repositories they are not a me= mber of, allowing an attacker with read-only superuser privileges to impers= onate any robot account.</td>
<td>2026-07-29</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18255" target=3D= "_blank" rel=3D"noopener">CVE-2026-18255</a></td>
</tr>

<td class=3D"vendor-product">redaxo--core</td>
<td>REDAXO is a PHP-based content management system. From 5.18.2 until 5.21= .1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/me= diapool.php lets an authenticated backend user with media[upload] permissio=
n upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers wit=
h multi-extension PHP handlers can execute as the web-server user. This iss=
ue is fixed in version 5.21.1.</td>
<td>2026-07-31</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53599" target=3D= "_blank" rel=3D"noopener">CVE-2026-53599</a></td>
</tr>

<td class=3D"vendor-product">RedHatInsights--yggdrasil-worker-package-manag= er</td>
<td>A flaw was found in yggdrasil-worker-package-manager. A local attacker = with existing access to the system could exploit an argument injection vuln= erability in the APT backend. This allows specially crafted package names, = which begin with a hyphen, to be misinterpreted as command options by apt-g= et. Successful exploitation could lead to remote code execution (RCE) with = root privileges, enabling the attacker to fully compromise the system's int= egrity, confidentiality, and availability.</td>
<td>2026-07-31</td>
<td>7.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18157" target=3D= "_blank" rel=3D"noopener">CVE-2026-18157</a></td>
</tr>

<td class=3D"vendor-product">RexTheme--Product Feed Manager</td> <td>Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager &lt;= =3D 7.6.1 versions.</td>
<td>2026-07-27</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59553" target=3D= "_blank" rel=3D"noopener">CVE-2026-59553</a></td>
</tr>

<td class=3D"vendor-product">Rich Source--DMS+ (Non-Mobile)</td>
<td>DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Cred= entials vulnerability. Unauthenticated remote attackers can exploit a fixed=
API key to gain control over all installed DMS+ devices.</td> <td>2026-07-31</td>
<td>10</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18452" target=3D= "_blank" rel=3D"noopener">CVE-2026-18452</a></td>
</tr>

<td class=3D"vendor-product">RomanCode--MapSVG</td>
<td>Unauthenticated SQL Injection in MapSVG &lt;=3D 8.14.0 versions.</td> <td>2026-07-27</td>
<td>9.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59527" target=3D= "_blank" rel=3D"noopener">CVE-2026-59527</a></td>
</tr>

<td class=3D"vendor-product">Roxnor--GetGenie</td>
<td>Unauthenticated Cross Site Scripting (XSS) in GetGenie &lt;=3D 4.4.3 ve= rsions.</td>
<td>2026-07-27</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65440" target=3D= "_blank" rel=3D"noopener">CVE-2026-65440</a></td>
</tr>

<td class=3D"vendor-product">rtCamp--rtMedia for WordPress, BuddyPress and = bbPress</td>
<td>Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and = bbPress &lt;=3D 4.7.10 versions.</td>
<td>2026-07-27</td>
<td>9.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59549" target=3D= "_blank" rel=3D"noopener">CVE-2026-59549</a></td>
</tr>

<td class=3D"vendor-product">rtCamp--rtMedia for WordPress, BuddyPress and = bbPress</td>
<td>Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPre=
ss &lt;=3D 4.7.10 versions.</td>
<td>2026-07-27</td>
<td>8.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59551" target=3D= "_blank" rel=3D"noopener">CVE-2026-59551</a></td>
</tr>

<td class=3D"vendor-product">Ruben Garcia--GamiPress</td>
<td>Unauthenticated SQL Injection in GamiPress &lt;=3D 7.9.7 versions.</td> <td>2026-07-27</td>
<td>9.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59538" target=3D= "_blank" rel=3D"noopener">CVE-2026-59538</a></td>
</tr>

<td class=3D"vendor-product">ruby-oauth--oauth</td>
<td>OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing=
clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request pa= rses the raw Location header of a 300 to 399 redirect returned by the OAuth=
server and follows the redirect recursively, which can mutate the consumer=
's configuration and expose signed OAuth request metadata, including the Au= thorization header, to a cross-origin host. This issue is fixed in version = 1.1.6.</td>
<td>2026-07-28</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54605" target=3D= "_blank" rel=3D"noopener">CVE-2026-54605</a></td>
</tr>

<td class=3D"vendor-product">ruby-oauth--oauth2</td>
<td>OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization framew= orks, including OpenID Connect (OIDC). From 0.4.0 to 2.0.21, a protocol-rel= ative redirect Location returned to OAuth2::Client#request overrides the re= quest authority, so the bearer Authorization header is sent to an attacker-= controlled host, leaking the credential. This issue is fixed in version 2.0= .22.</td>
<td>2026-07-28</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54603" target=3D= "_blank" rel=3D"noopener">CVE-2026-54603</a></td>
</tr>

<td class=3D"vendor-product">s9y--Serendipity</td>
<td>Serendipity before 2.6.1 contains an authentication context confusion v= ulnerability where password validation and session loading operate independ= ently without ensuring both use the same user record. An authenticated Edit=
or can create a username collision with an Administrator account and obtain=
administrative privileges by logging in with their own password while the = session loads the Administrator's account data.</td>
<td>2026-07-30</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67351" target=3D= "_blank" rel=3D"noopener">CVE-2026-67351</a></td>
</tr>

<td class=3D"vendor-product">saadiqbal--Wholesale for WooCommerce</td>

<td>The Wholesale for WooCommerce plugin for WordPress is vulnerable to Pri= vilege Escalation in all versions up to, and including, 2.0.5. This is due =
to the `save_requests_meta()` function applying only `sanitize_text_field()=
` to the `user_role_set` POST parameter before passing it directly to `WP_U= ser::add_role()`, with no allowlist validation against permitted wholesale = roles and no capability check such as `current_user_can('promote_users')` o=
r `current_user_can('manage_options')`. This makes it possible for authenti= cated attackers with author-level access and above to escalate their privil= eges to administrator by supplying `administrator` as the `user_role_set` v= alue in a crafted request. The function is gated only by a nonce (`request_= user_role_nonce`) that is rendered in the meta box on the `wwp_requests` po=
st edit screen; because the post type is registered with `capability_type = =3D&gt; 'post'`, any author-level user who has authored a `wwp_requests` po=
st - such as one created via the wholesale registration form - can access t= his nonce and submit the role-assignment request.</td>
<td>2026-07-29</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12144" target=3D= "_blank" rel=3D"noopener">CVE-2026-12144</a></td>
</tr>

<td class=3D"vendor-product">savonrb--savon</td>
<td>Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all= _operations interpolates attacker-controlled WSDL operation names into Ruby=
source passed to module_eval, allowing Ruby code execution in the applicat= ion process. This issue is fixed in version 2.17.2.</td>
<td>2026-07-31</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53510" target=3D= "_blank" rel=3D"noopener">CVE-2026-53510</a></td>
</tr>

<td class=3D"vendor-product">Sender--Sender Newsletter, SMS and Email Marke= ting Automation for WooCommerce</td>
<td>Administrator SQL Injection in Sender - Newsletter, SMS and Email Marke= ting Automation for WooCommerce &lt;=3D 2.10.22 versions.</td> <td>2026-07-27</td>
<td>7.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59537" target=3D= "_blank" rel=3D"noopener">CVE-2026-59537</a></td>
</tr>

<td class=3D"vendor-product">Shahadat Hossain--3D Flipbook PDF Viewer &amp;=
Embedder</td>
<td>Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF V= iewer &amp;amp; Embedder &lt;=3D 1.4.2 versions.</td>
<td>2026-07-27</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59552" target=3D= "_blank" rel=3D"noopener">CVE-2026-59552</a></td>
</tr>

<td class=3D"vendor-product">shiptime--ShipTime: Discounted Shipping Rates<=

<td>Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rat=
es &lt;=3D 1.1.1 versions.</td>
<td>2026-07-27</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59528" target=3D= "_blank" rel=3D"noopener">CVE-2026-59528</a></td>
</tr>

<td class=3D"vendor-product">SICK AG--InspectorP61x</td>
<td>An attacker may perform unauthenticated read and write operations on se= nsitive filesystem areas via the AppEngine Fileaccess over HTTP due to impr= oper access restrictions. A critical filesystem directory was unintentional=
ly exposed through the HTTP-based file access feature, allowing access with= out authentication. This includes device parameter files, enabling an attac= ker to read and modify application settings, including customer-defined pas= swords. Additionally, exposure of the custom application directory may allo=
w execution of arbitrary Lua code within the sandboxed AppEngine environmen= t.</td>
<td>2026-07-28</td>
<td>9.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11841" target=3D= "_blank" rel=3D"noopener">CVE-2026-11841</a></td>
</tr>

<td class=3D"vendor-product">siyuan-note--siyuan</td>
<td>SiYuan desktop before v3.7.2 contains a reflected cross-site scripting = vulnerability in the bazaar plugin readme handler that allows attackers to = execute arbitrary code by crafting a malicious siyuan:// deep link. Attacke=
rs can inject HTML payloads via the plugin name parameter that execute with=
full Node.js access through insertAdjacentHTML rendering in an insecurely = configured Electron renderer.</td>
<td>2026-07-27</td>
<td>9.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66395" target=3D= "_blank" rel=3D"noopener">CVE-2026-66395</a></td>
</tr>

<td class=3D"vendor-product">siyuan-note--siyuan</td>
<td>SiYuan before v3.7.3 contains stored and reflected cross-site scripting=
vulnerabilities in SVG sanitization that allows authenticated attackers to=
execute scripts by bypassing the HTML parser-based cleaner. Attackers can = hide script tags within desc, style, or noscript elements which the HTML pa= rser treats as raw text but browsers interpret as executable SVG content wh=
en served as image/svg+xml, enabling script execution in the application or= igin.</td>
<td>2026-07-27</td>
<td>8.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66394" target=3D= "_blank" rel=3D"noopener">CVE-2026-66394</a></td>
</tr>

<td class=3D"vendor-product">siyuan-note--siyuan</td>
<td>SiYuan before v3.7.2 fails to escape the title-img Individual Attribute=
List value when rendering Gallery and Kanban cover images, allowing stored=
cross-site scripting via unescaped style attribute interpolation. Attacker=
s with editor permissions can inject onload handlers that execute arbitrary=
code in the Electron renderer with full Node.js access when victims open a= ffected documents.</td>
<td>2026-07-27</td>
<td>8.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66396" target=3D= "_blank" rel=3D"noopener">CVE-2026-66396</a></td>
</tr>

<td class=3D"vendor-product">smub--Easy Digital Downloads eCommerce Payment=
s and Subscriptions made easy</td>
<td>The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitr= ary File Upload in versions up to and including 3.6.9. This is due to insuf= ficient file type validation in the edd_do_ajax_import_file_upload() functi=
on , which only checks the client-supplied $_FILES['edd-import-file']['type=
'] Content-Type header against an allow-list of CSV mime types, then uses r=
aw move_uploaded_file() (bypassing wp_handle_upload()'s core MIME enforceme= nt) to write the file under its original extension into the web-accessible = wp-content/uploads/edd/exports/ directory. This makes it possible for authe= nticated attackers, with Shop Manager-level access and above, to upload arb= itrary files on the affected site's server which may make remote code execu= tion possible.</td>
<td>2026-07-29</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12476" target=3D= "_blank" rel=3D"noopener">CVE-2026-12476</a></td>
</tr>

<td class=3D"vendor-product">Softtr Information Technology Trade Ltd. Co.--= E-Commerce Pack</td>
<td>Cross-Site request forgery (CSRF) vulnerability in Softtr Information T= echnology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery.=
This issue affects E-Commerce Pack: before 5.03.01.49.</td> <td>2026-07-30</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5219" target=3D"= _blank" rel=3D"noopener">CVE-2026-5219</a></td>
</tr>

<td class=3D"vendor-product">SolarWinds--Web Help Desk</td>
<td>SolarWinds Web Help Desk is found to be affected by a SAML authenticati=
on bypass vulnerability. This requires the SAML 2.0 authentication method t=
o be enabled.</td>
<td>2026-07-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28323" target=3D= "_blank" rel=3D"noopener">CVE-2026-28323</a></td>
</tr>

<td class=3D"vendor-product">somta--Juggle</td>
<td>Juggle through 1.6.0 contains a remote code execution vulnerability tha=
t allows unauthenticated remote attackers to execute arbitrary OS commands =
by connecting to the exposed H2 database web console using default shipped = credentials. Attackers can access the unprotected /h2-console endpoint, aut= henticate with default credentials, and leverage the H2 CREATE ALIAS Runtim= e.exec() technique to execute arbitrary commands, resulting in root-level c= ode execution when running the stock Docker image.</td>
<td>2026-07-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67208" target=3D= "_blank" rel=3D"noopener">CVE-2026-67208</a></td>
</tr>

<td class=3D"vendor-product">Spring--Spring Tools for Eclipse</td>
<td>Starting Spring Boot applications in the Spring Tools with the live inf= ormation mode enabled makes the running application vulnerable against JMX-= based remote code execution. Affected Spring Products and Versions: Spring = Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / The= ia: 2.2.0 and earlier</td>
<td>2026-07-30</td>
<td>8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-47858" target=3D= "_blank" rel=3D"noopener">CVE-2026-47858</a></td>
</tr>

<td class=3D"vendor-product">Spring--Spring Tools for Eclipse</td>
<td>The Boot Dashboard Docker integration in Spring Tools publishes contain=
er control ports on all of the host's network interfaces (0.0.0.0) rather t= han restricting them to loopback. Affected Spring Products and Versions: Sp= ring Tools for Eclipse: 5.2.0 and earlier</td>
<td>2026-07-30</td>
<td>8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-47873" target=3D= "_blank" rel=3D"noopener">CVE-2026-47873</a></td>
</tr>

<td class=3D"vendor-product">Spring--Spring Tools for Eclipse</td>
<td>When enabling Spring Boot DevTools support for a remote application tar= get (for example a Docker container or Cloud Foundry app) from the Spring T= ools Boot Dashboard, Spring Tools generates a shared secret that authentica= tes DevTools remote-restart uploads to the deployed application. This secre=
t was generated using a non-cryptographic pseudo-random number generator ra= ther than a cryptographically secure source of randomness. Affected Spring = Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier</td> <td>2026-07-30</td>
<td>8.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-47882" target=3D= "_blank" rel=3D"noopener">CVE-2026-47882</a></td>
</tr>

<td class=3D"vendor-product">Strategy11 Team--AWP Classifieds</td> <td>Unauthenticated SQL Injection in AWP Classifieds &lt;=3D 4.4.7 versions= .</td>
<td>2026-07-27</td>
<td>9.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59550" target=3D= "_blank" rel=3D"noopener">CVE-2026-59550</a></td>
</tr>

<td class=3D"vendor-product">StylemixThemes--Cost Calculator Builder PRO</t=

<td>The Cost Calculator Builder PRO plugin for WordPress is vulnerable to R= emote Code Execution in all versions up to, and including, 4.0.3 via the js= _to_php function. This is due to insufficient sanitization of the orderDeta= ils[*].originalValue field, which is injected verbatim into a calculator fo= rmula string passed to PHP eval() inside js_to_php(), with the regex allow-= list in evaluateFormula() only filtering alphanumeric tokens and leaving no= n-word punctuation characters intact. This makes it possible for unauthenti= cated attackers to execute code on the server. The only authentication barr= ier is a nonce check, but the required nonce is publicly emitted on every f= ront-end page via the wp_head hook, making it freely obtainable by unauthen= ticated visitors. Payloads must be non-word XOR gadgets to bypass sanitizat= ion.</td>
<td>2026-07-29</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14900" target=3D= "_blank" rel=3D"noopener">CVE-2026-14900</a></td>
</tr>

<td class=3D"vendor-product">Subtle Web Inc--FormCraft</td>
<td>Unauthenticated Server Side Request Forgery (SSRF) in FormCraft &lt;=3D=
3.9.15 versions.</td>
<td>2026-07-27</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65442" target=3D= "_blank" rel=3D"noopener">CVE-2026-65442</a></td>
</tr>

<td class=3D"vendor-product">superplanehq--superplane</td>
<td>SuperPlane before 0.27.0 contains a broken object-level authorization v= ulnerability in the CanvasService gRPC handlers that allows authenticated u= sers with viewer-level access to one organization to access resources belon= ging to other organizations by supplying arbitrary canvas or queue UUIDs wi= thout organization scoping. Attackers can read cross-tenant execution histo=
ry and event payloads containing sensitive secrets, write queue items and c= anvas events into victim organizations, delete arbitrary canvases, and disr= upt automation workflows across tenant boundaries.</td>
<td>2026-07-28</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57510" target=3D= "_blank" rel=3D"noopener">CVE-2026-57510</a></td>
</tr>

<td class=3D"vendor-product">Sylius--MolliePlugin</td>
<td>Sylius Mollie Plugin provides Mollie payment integration for Sylius app= lications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{= _locale}/update-payment payment webhook accepts attacker-controlled id and = orderId parameters but does not verify that the Mollie payment belongs to t=
he referenced Sylius order, allowing an unauthenticated attacker with any v= alid paid Mollie payment ID to mark a victim order as paid without transfer= ring funds for that order. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.<=

<td>2026-07-30</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-68500" target=3D= "_blank" rel=3D"noopener">CVE-2026-68500</a></td>
</tr>

<td class=3D"vendor-product">TeamViewer--Remote</td>
<td>TeamViewer Full Client and Host=C2=A0for macOS before version 15.80=C2= =A0contain=C2=A0a business logic error that can allow an authenticated atta= cker to bypass=C2=A0a=C2=A0configured 2FA=C2=A0for=C2=A0Connections approva=
l flow=C2=A0via=C2=A0Unattended=C2=A0Access=C2=A0and=C2=A0establish=C2=A0a = remote connection to an affected macOS host.</td>
<td>2026-07-29</td>
<td>8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12703" target=3D= "_blank" rel=3D"noopener">CVE-2026-12703</a></td>
</tr>

<td class=3D"vendor-product">termux--proot-distro</td>
<td>proot-distro is a utility for managing proot containers. Prior to versi=
on 5.1.5, proot-distro install extracted plain tarball root filesystems thr= ough _extract_plain_tar() in proot_distro/commands/install.py and Docker la= yers through _apply_layer() in proot_distro/helpers/docker.py without valid= ating archive-controlled symlink targets in member.linkname, allowing a mal= icious archive to plant an absolute host-path symlink and write files throu=
gh it onto the host filesystem. This issue is fixed in version 5.1.5.</td> <td>2026-07-29</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54574" target=3D= "_blank" rel=3D"noopener">CVE-2026-54574</a></td>
</tr>

<td class=3D"vendor-product">termux--proot-distro</td>
<td>proot-distro is a utility for managing proot containers. Prior to versi=
on 5.1.6, proot-distro restore accepted hardlink entries whose linkname ref= erenced another installed container and did not verify that the hardlink so= urce container matched the destination container being restored, allowing a=
crafted restore archive to copy files between otherwise isolated container=
s. This issue is fixed in version 5.1.6.</td>
<td>2026-07-29</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54727" target=3D= "_blank" rel=3D"noopener">CVE-2026-54727</a></td>
</tr>

<td class=3D"vendor-product">teydeastudio--WP Password Policy</td>
<td>The WP Password Policy plugin for WordPress is vulnerable to Privilege = Escalation in all versions up to and including 3.7.1. This is due to missin=
g authorization checks and nonce verification in the `get_user()` function =
of the `Module_Password_Hint` class, which unconditionally calls `WP_User::= set_role()` with the attacker-supplied `role` parameter on any account reso= lved via `$_POST['user_login']`, without confirming the requesting user hol=
ds the capability to assign roles. This makes it possible for authenticated=
attackers, with subscriber-level access and above, to escalate their own p= rivileges to Administrator by submitting a crafted POST request - with `act= ion` set to `createuser` and `role` set to `administrator` - to the passwor= d-reset form endpoint. The vulnerable code path is reachable via the `passw= ord_hint` filter hooked during the WordPress password-reset form render, me= aning an attacker need only possess a valid password-reset cookie to reach = the sink.</td>
<td>2026-07-28</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15992" target=3D= "_blank" rel=3D"noopener">CVE-2026-15992</a></td>
</tr>

<td class=3D"vendor-product">ThemeComplete--Extra Checkout Options - addon = for Extra Product Options plugin</td>
<td>The Extra Checkout Options (addon for Extra Product Options &amp; Add-O=
ns for WooCommerce) plugin for WordPress is vulnerable to Arbitrary File Up= load in all versions up to, and including, 2.3.2. This is due to missing au= thorization and nonce validation in the eco_save_settings() function, which=
allows low-privileged authenticated users to modify the tc_eco_custom_file= _types upload allowlist setting, combined with insufficient authorization o=
n the wc_eco_upload_file AJAX action. This makes it possible for authentica= ted attackers, with Subscriber-level access and above, to allow PHP uploads=
, upload a PHP file using the frontend upload nonce exposed on cart and che= ckout pages, and achieve remote code execution. NOTE: This vulnerability wa=
s partially fixed in version 2.3.2.</td>
<td>2026-07-29</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14270" target=3D= "_blank" rel=3D"noopener">CVE-2026-14270</a></td>
</tr>

<td class=3D"vendor-product">Themefic--Ultimate Addons for Contact Form 7</=

<td>Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Conta=
ct Form 7 &lt;=3D3.5.45 versions.</td>
<td>2026-07-27</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65439" target=3D= "_blank" rel=3D"noopener">CVE-2026-65439</a></td>
</tr>

<td class=3D"vendor-product">themetechmount--TrueBooker Appointment Booking=
and Scheduler System</td>
<td>The TrueBooker - Appointment Booking and Scheduler System plugin for Wo= rdPress is vulnerable to generic SQL Injection via the 'alldata[truebooker_= user]' parameter in all versions up to, and including, 1.2.2 due to insuffi= cient escaping on the user supplied parameter and lack of sufficient prepar= ation on the existing SQL query. This makes it possible for unauthenticated=
attackers to append additional SQL queries into already existing queries t= hat can be used to extract sensitive information from the database. The che= ck_ajax_referer() nonce guard does not constitute an authentication or auth= orization barrier because the nonce is exposed to unauthenticated visitors =
on TrueBooker front-end booking pages; exploitation additionally requires t= hat the required booking fields (category, service, person, date, and time = slot) be present in the alldata POST parameter so that execution reaches th=
e vulnerable SQL query branch.</td>
<td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13161" target=3D= "_blank" rel=3D"noopener">CVE-2026-13161</a></td>
</tr>

<td class=3D"vendor-product">Three Learning--Koollab LMS</td>
<td>A pre-authentication blind SQL injection vulnerability in Koollab LMS a= llowed an unauthenticated attacker to use a time-based SQL oracle via the S=
SO OAuth endpoint to read sensitive database contents, including personally=
identifiable information, credentials, and valid JWT tokens that may enabl=
e account takeover.</td>
<td>2026-07-29</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63229" target=3D= "_blank" rel=3D"noopener">CVE-2026-63229</a></td>
</tr>

<td class=3D"vendor-product">Three Learning--Koollab LMS</td>
<td>A pre-authentication error-based SQL injection vulnerability in Koollab=
LMS allowed an unauthenticated attacker to read sensitive database content=
s, including personally identifiable information, credentials, and valid JW=
T tokens that may enable account takeover, via the SCORM report endpoint.</=

<td>2026-07-29</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63230" target=3D= "_blank" rel=3D"noopener">CVE-2026-63230</a></td>
</tr>

<td class=3D"vendor-product">Three Learning--Koollab LMS</td>
<td>A SQL injection and unsafe deserialisation vulnerability in Koollab LMS=
allowed an authenticated attacker to inject through the assessment reinfor= cement endpoint, control data passed to unserialize(), write a webshell to =
a publicly accessible location, and execute arbitrary code on the server.</=

<td>2026-07-29</td>
<td>9.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63232" target=3D= "_blank" rel=3D"noopener">CVE-2026-63232</a></td>
</tr>

<td class=3D"vendor-product">Three Learning--Koollab LMS</td>
<td>A SQL injection and unsafe deserialisation vulnerability in Koollab LMS=
allowed an authenticated attacker to inject through the assessment overall=
answer endpoint, control data passed to unserialize(), write a webshell to=
a publicly accessible location, and execute arbitrary code on the server.<=

<td>2026-07-29</td>
<td>9.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63233" target=3D= "_blank" rel=3D"noopener">CVE-2026-63233</a></td>
</tr>

<td class=3D"vendor-product">Three Learning--Koollab LMS</td>
<td>A SQL injection and unsafe deserialisation vulnerability in Koollab LMS=
allowed an authenticated attacker to inject through the manual mark assess= ment endpoint, control data passed to unserialize(), write a webshell to a = publicly accessible location, and execute arbitrary code on the server.</td=

<td>2026-07-29</td>
<td>9.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63234" target=3D= "_blank" rel=3D"noopener">CVE-2026-63234</a></td>
</tr>

<td class=3D"vendor-product">Three Learning--Koollab LMS</td>
<td>A post-authentication SQL injection vulnerability in Koollab LMS allowe=
d an authenticated attacker to use an error-based SQL oracle via the face-t= o-face runs update endpoint to read the entire application database and obt= ain valid JWT tokens for account takeover.</td>
<td>2026-07-29</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63231" target=3D= "_blank" rel=3D"noopener">CVE-2026-63231</a></td>
</tr>

<td class=3D"vendor-product">Thrive Themes Coupon--Thrive Product Manager</=

<td>Unauthenticated Broken Access Control in Thrive Product Manager &lt;=3D=
10.9.2 versions.</td>
<td>2026-07-27</td>
<td>7.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59535" target=3D= "_blank" rel=3D"noopener">CVE-2026-59535</a></td>
</tr>

<td class=3D"vendor-product">thumbor--thumbor</td>
<td>Thumbor is an open-source photo thumbnail service by globo.com. Prior t=
o 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match=
() without escaping dots, so a hostname differing at dot positions can matc=
h the allowlist. This issue is fixed in 7.8.0.</td>
<td>2026-07-31</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53500" target=3D= "_blank" rel=3D"noopener">CVE-2026-53500</a></td>
</tr>

<td class=3D"vendor-product">thumbor--thumbor</td>
<td>Thumbor is an open-source photo thumbnail service by globo.com. Prior t=
o 7.8.0, Thumbor's HMAC validation can be bypassed due to the use of Python=
's .replace() when removing the signature from the URL before validation. S= ince .replace() removes all occurrences of the substring, an attacker can i= nsert the same signature multiple times in the URL and manipulate the final=
URL used for validation. This allows crafting URLs where the validated str= ing differs from the actual requested resource, enabling loading images fro=
m unintended domains or paths. This issue is fixed in 7.8.0.</td> <td>2026-07-31</td>
<td>8.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53501" target=3D= "_blank" rel=3D"noopener">CVE-2026-53501</a></td>
</tr>

<td class=3D"vendor-product">thumbor--thumbor</td>
<td>Thumbor is an open-source photo thumbnail service by globo.com. Prior t=
o 7.8.0, Thumbor's filters:convolution(&lt;matrix&gt;, &lt;columns&gt;, &lt= ;should_normalize&gt;) filter passes the user-controlled &lt;columns&gt; va= lue to a C extension (thumbor/ext/filters/_convolution.c) where it is used =
as a divisor (for % and /) without validating columns &gt; 0. When columns= =3D0, the C code triggers undefined behavior; on x86_64 this reliably resul=
ts in a fatal divide-by-zero trap (SIGFPE) and crashes the Thumbor process,=
causing a remote denial of service. This issue is fixed in 7.8.0.</td> <td>2026-07-31</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53503" target=3D= "_blank" rel=3D"noopener">CVE-2026-53503</a></td>
</tr>

<td class=3D"vendor-product">thumbor--thumbor</td>
<td>Thumbor is an open-source photo thumbnail service by globo.com. Prior t=
o 7.8.0, the convolution filter regular expression performs exponential bac= ktracking on crafted repeated numeric input, allowing a URL request to exha= ust processing time. This issue is fixed in 7.8.0.</td>
<td>2026-07-31</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53504" target=3D= "_blank" rel=3D"noopener">CVE-2026-53504</a></td>
</tr>

<td class=3D"vendor-product">thumbor--thumbor</td>
<td>Thumbor is an open-source photo thumbnail service by globo.com. Prior t=
o 7.8.0, Thumbor's filters:proportion(&lt;value&gt;) filter does not enforc=
e an upper bound on &lt;value&gt; and runs in the post-transform phase. An = attacker can trigger extremely large resizes (CPU/memory exhaustion) and ca= use denial of service. This issue is fixed in 7.8.0.</td>
<td>2026-07-31</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53505" target=3D= "_blank" rel=3D"noopener">CVE-2026-53505</a></td>
</tr>

<td class=3D"vendor-product">tigroumeow--AI Engine The Chatbot, AI Framewor=
k &amp; MCP for WordPress</td>
<td>The AI Engine - The Chatbot, AI Framework &amp; MCP for WordPress plugi=
n for WordPress is vulnerable to Cross-Site Request Forgery in all versions=
up to, and including, 3.6.5 This is due to missing or incorrect nonce vali= dation on the reauth_for_authorize function. This makes it possible for una= uthenticated attackers to create new administrator accounts with attacker-s= upplied credentials via a CSRF-based REST authentication bypass, granted th=
ey can trick a site administrator into performing an action such as clickin=
g on a link. This bypass can be combined with WordPress's ?_method=3DPOST m= ethod-override support to convert a top-navigation GET request into an auth= enticated POST to the REST users endpoint, requiring no existing account on=
the attacker's part.</td>
<td>2026-08-01</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15988" target=3D= "_blank" rel=3D"noopener">CVE-2026-15988</a></td>
</tr>

<td class=3D"vendor-product">tomaka--rouille</td>
<td>Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerab= ility that allows remote attackers to bypass access controls by injecting b= are line feed characters (0x0A) into client-supplied request header values = that are copied verbatim to upstream connections without validation. Attack= ers can craft a header value containing a complete additional HTTP request = that is interpreted as a separate request by backends such as Go net/http a=
nd Python http.server, causing the backend to process a smuggled request wi=
th attacker-chosen method, path, and headers that bypasses the rouille hand= ler's access control logic.</td>
<td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67182" target=3D= "_blank" rel=3D"noopener">CVE-2026-67182</a></td>
</tr>

<td class=3D"vendor-product">Toptech Systems--RCU II+</td>
<td>The RCU II+ and Multiload II+ are vulnerable to an unauthenticated serv= ice that exposes a debug interface granting full root-level access to the e= mbedded system. This vulnerability stems from a network-accessible port run= ning a Target Communications Framework (TCF) service that does not require = any authentication, allowing an attacker to directly interact with the Linu=
x environment that powers the device. Once connected, an attacker can freel=
y view and modify the filesystem, manipulate running processes, and control=
network interfaces, enabling deep alteration of system behavior.</td> <td>2026-07-30</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12562" target=3D= "_blank" rel=3D"noopener">CVE-2026-12562</a></td>
</tr>

<td class=3D"vendor-product">tugcantopaloglu--openclaw-dashboard</td> <td>OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulner= ability that allows unauthenticated remote attackers to inject arbitrary HT=
ML and script payloads by submitting a crafted username in a failed login P= OST request, which is recorded verbatim in the audit log. When an administr= ator opens the notification panel, the unescaped log entry is rendered via = innerHTML with a permissive Content-Security-Policy allowing inline event h= andlers, enabling the attacker-supplied payload to execute in the administr= ator's session and interact with authenticated endpoints including agent in= struction file editing and configuration changes.</td>

<td>2026-07-30</td>
<td>9.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66418" target=3D= "_blank" rel=3D"noopener">CVE-2026-66418</a></td>
</tr>

<td class=3D"vendor-product">tugcantopaloglu--openclaw-dashboard</td> <td>OpenClaw Dashboard contains a stored cross-site scripting vulnerability=
that allows unauthenticated remote attackers to execute arbitrary JavaScri=
pt in the administrator's browser session by injecting HTML markup into age=
nt transcript messages processed through the sessions API. Attackers can cr= aft a message containing inline event handler payloads such as an img tag w= ith an onerror attribute within the 60-character rendering budget, which is=
stored in the session transcript and interpolated unsanitized into innerHT=
ML on the default landing page, allowing theft of session tokens and unauth= orized calls to authenticated administrative endpoints including agent inst= ruction file modification.</td>
<td>2026-07-30</td>
<td>9.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66421" target=3D= "_blank" rel=3D"noopener">CVE-2026-66421</a></td>
</tr>

<td class=3D"vendor-product">UMAI Vision--Traffic Analysis System</td>

<td>Improper neutralization of special elements used in an SQL command ('SQ=
L injection') vulnerability in UMAI Vision Traffic Analysis System allows S=
QL Injection. This issue affects Traffic Analysis System: from 30 before 34= .</td>
<td>2026-07-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-4978" target=3D"= _blank" rel=3D"noopener">CVE-2026-4978</a></td>
</tr>

<td class=3D"vendor-product">umarbajwa--MailChimp Subscribe Form, Optin Bui= lder, PopUp Builder, Form Builder</td>
<td>The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builde=
r plugin for WordPress is vulnerable to Stored Cross-Site Scripting via For=
m Field Values in all versions up to, and including, 4.3.3 due to insuffici= ent input sanitization and output escaping. This makes it possible for unau= thenticated attackers to inject arbitrary web scripts in pages that will ex= ecute whenever a user accesses an injected page.</td>
<td>2026-08-01</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15052" target=3D= "_blank" rel=3D"noopener">CVE-2026-15052</a></td>
</tr>

<td class=3D"vendor-product">uncannyowl--Uncanny Automator Easy Automation,=
Integration, Webhooks &amp; Workflow Builder Plugin</td>
<td>The Uncanny Automator - Easy Automation, Integration, Webhooks &amp; Wo= rkflow Builder plugin for WordPress is vulnerable to Missing Authorization =
in versions up to, and including, 7.3.2 via the automator_google_contacts_f= etch_labels, automator_mautic_segment_fetch, automator_mautic_tags_fetch, a=
nd automator_mautic_render_contact_fields AJAX actions due to a missing cap= ability check and missing nonce verification in the corresponding handlers = (ajax_fetch_labels, segments_fetch, tags_fetch, and render_contact_fields).=
This makes it possible for authenticated attackers, with Subscriber-level = access and above, to enumerate sensitive Google Contacts groups/labels and = Mautic segments, tags, and contact-field definitions retrieved via integrat= ion credentials configured by an administrator, and to consume third-party = API quota.</td>
<td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15025" target=3D= "_blank" rel=3D"noopener">CVE-2026-15025</a></td>
</tr>

<td class=3D"vendor-product">undici--undici</td>
<td>undici's cache interceptor mishandles malformed Cache-Control private d= irectives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0=
, a response carrying a degenerate qualified private directive, such as pri= vate set to an empty value, can be stored in the default shared cache and l= ater served to a different caller with the same cache key, disclosing priva=
te response bodies and headers including Set-Cookie. Separately, a Cache-Co= ntrol header that combines an unqualified private directive with a qualifie=
d one triggers an uncaught TypeError in the cache-control parser, which rej= ects the request and, depending on the consumer's error handling, can termi= nate the process. Both issues affect applications using the cache intercept=
or in shared mode, including the default configuration. The issues are fixe=
d in undici 7.29.0 and 8.9.0.</td>
<td>2026-07-29</td>
<td>7.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13697" target=3D= "_blank" rel=3D"noopener">CVE-2026-13697</a></td>
</tr>

<td class=3D"vendor-product">Universal Software Inc.--UKBS</td>
<td>Missing authentication for critical function vulnerability in Universal=
Software Inc. UKBS allows Accessing Functionality Not Properly Constrained=
by ACLs. This issue affects UKBS: through 28072026. NOTE: The vendor was c= ontacted and it was learned that the product is not supported.</td> <td>2026-07-28</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7187" target=3D"= _blank" rel=3D"noopener">CVE-2026-7187</a></td>
</tr>

<td class=3D"vendor-product">Vacron--VIN-DS783E-E6</td>
<td>VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerabil= ity, allowing unauthenticated remote attackers to exploit a specific hidden=
function to obtain the administrator credentials of the device.</td> <td>2026-07-29</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18191" target=3D= "_blank" rel=3D"noopener">CVE-2026-18191</a></td>
</tr>

<td class=3D"vendor-product">vBulletin--vBulletin</td>
<td>vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval inje= ction vulnerability in the vB5_Template_Runtime::runMaths() method within t=
he template runtime that allows unauthenticated remote attackers to execute=
arbitrary PHP code by supplying crafted input through the pagenav[pagenumb= er] parameter. Attackers can exploit the insufficiently restrictive regex f= ilter by using phpfuck-style encoding with permitted characters to inject a=
nd execute arbitrary PHP code via the unauthenticated ajax/render template = route without any authentication.</td>
<td>2026-07-27</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-61511" target=3D= "_blank" rel=3D"noopener">CVE-2026-61511</a></td>
</tr>

<td class=3D"vendor-product">vlang--v</td>
<td>V through 0.5.2, fixed in commit 85859f0, contains a server-side reques=
t forgery (SSRF) bypass vulnerability that allows attackers to circumvent h= ost-based allowlists by exploiting a parser differential between net.urllib=
and net.http. Attackers can craft a URL containing a backslash in the auth= ority section such that net.urllib.parse() extracts the trusted host for al= lowlist validation while net.http.get() normalizes the backslash and connec=
ts to the internal host, enabling access to internal network services that = the allowlist was intended to block.</td>
<td>2026-07-29</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67201" target=3D= "_blank" rel=3D"noopener">CVE-2026-67201</a></td>
</tr>

<td class=3D"vendor-product">VMware--Cloud Foundation</td>
<td>VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3=
virtual network adapter.=C2=A0A malicious actor with local administrative = privileges on a virtual machine with VMXNET3 virtual network adapter may ex= ploit this issue to execute code on the host. Non VMXNET3 virtual adapters = are not affected by this issue.</td>
<td>2026-07-30</td>
<td>9.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-47876" target=3D= "_blank" rel=3D"noopener">CVE-2026-47876</a></td>
</tr>

<td class=3D"vendor-product">VMware--Cloud Foundation</td>
<td>VMware vCenter contains an authentication bypass vulnerability in the V= Mware Directory Service.=C2=A0A malicious actor with network access to vCen= ter=C2=A0may exploit this issue to bypass authentication and gain unauthori= zed access to the system.</td>
<td>2026-07-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59309" target=3D= "_blank" rel=3D"noopener">CVE-2026-59309</a></td>
</tr>

<td class=3D"vendor-product">VMware--Cloud Foundation</td>
<td>VMware vCenter contains a directory traversal vulnerability in the Sysl=
og server.=C2=A0A malicious actor with network access to vCenter=C2=A0may e= xploit this issue to execute arbitrary code.</td>
<td>2026-07-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59310" target=3D= "_blank" rel=3D"noopener">CVE-2026-59310</a></td>
</tr>

<td class=3D"vendor-product">VMware--Cloud Foundation</td>
<td>VMware ESX,=C2=A0Workstation, and Fusion=C2=A0contain an out-of-bounds = read vulnerability. A malicious actor with=C2=A0VM deployment privileges co= uld trigger an out-of-bounds read, potentially leading to information discl= osure or more likely a Denial-of-Service (DoS) condition of the host proces= s.=C2=A0On Workstation and Fusion, the impact of this vulnerability is rest= ricted to information disclosure.</td>
<td>2026-07-30</td>
<td>7.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-41703" target=3D= "_blank" rel=3D"noopener">CVE-2026-41703</a></td>
</tr>

<td class=3D"vendor-product">Wasiliy Strecker / ContestGallery developer--C= ontest Gallery</td>
<td>Unauthenticated Cross Site Scripting (XSS) in Contest Gallery &lt;=3D 3= 0.0.6 versions.</td>
<td>2026-07-27</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65447" target=3D= "_blank" rel=3D"noopener">CVE-2026-65447</a></td>
</tr>

<td class=3D"vendor-product">webaways--NEX-Forms Ultimate Forms Plugin for = WordPress</td>
<td>The Nex Forms - Ultimate Form Builder - Lite plugin for WordPress is vu= lnerable to arbitrary file deletion via path traversal in versions up to, a=
nd including, 9.2.3. This is due to the delete_file() AJAX handler retrievi=
ng a file path from the database and passing it directly to unlink() with n=
o validation (no realpath(), basename(), or allowlist check), combined with=
the insert_record() AJAX handler that lets the same authenticated user sto=
re an arbitrary value in the target 'location' column (wp_kses() only strip=
s HTML tags and does not neutralize path traversal or absolute paths). This=
makes it possible for authenticated attackers, with admin-level access and=
above, to delete arbitrary files on the affected site's server, including = wp-config. When the plugin's user-level option is configured to something e= lse, this may be exploitable with lower privileges.</td>
<td>2026-08-01</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15450" target=3D= "_blank" rel=3D"noopener">CVE-2026-15450</a></td>
</tr>

<td class=3D"vendor-product">WebPros--Plesk</td>
<td>Improper neutralization in the Plesk XML-RPC API allows a remote authen= ticated low-privileged user to perform SQL injection and read arbitrary dat=
a from the Plesk database, leading to full compromise of the panel.</td> <td>2026-07-30</td>
<td>9.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58046" target=3D= "_blank" rel=3D"noopener">CVE-2026-58046</a></td>
</tr>

<td class=3D"vendor-product">webreinvent--vaahcms</td>
<td>VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated Jav= aScript payload embedded in the Blade template responsible for rendering se= curity OTP emails, allowing remote attackers to execute unauthorized code i=
n any browser that renders the affected email template with JavaScript enab= led. The payload establishes a WebSocket connection to a hardcoded command-= and-control endpoint, installs a password-field keylogger using MutationObs= erver to capture dynamically added inputs, scrapes WhatsApp Web DOM content=
, and accepts remote commands to redirect or overwrite the rendered page.</=

<td>2026-07-29</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67595" target=3D= "_blank" rel=3D"noopener">CVE-2026-67595</a></td>
</tr>

<td class=3D"vendor-product">wedevs--StoreGrowth Upsell, BOGO, Quick View, = Direct Checkout &amp; Side Cart for WooCommerce</td>
<td>The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, D= irect Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to=
Stored Cross-Site Scripting via the 'message_popup' parameter in all versi= ons up to, and including, 2.1.0 due to insufficient input sanitization and = output escaping. This makes it possible for unauthenticated attackers to in= ject arbitrary web scripts in pages that will execute whenever a user acces= ses an injected page. The exploit is possible because the 'ajd_protected' n= once required by the create_popup handler is exposed to all unauthenticated=
frontend visitors via wp_localize_script under bogo_save_url.ajd_nonce, ef= fectively bypassing the nonce-only access control.</td>
<td>2026-07-28</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13440" target=3D= "_blank" rel=3D"noopener">CVE-2026-13440</a></td>
</tr>

<td class=3D"vendor-product">Weidmueller Interface--PROCON-WEB SCADA</td> <td>In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitize=
d. This allows a remote unauthenticated attacker to execute arbitrary SQL c= ommands.</td>
<td>2026-07-28</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16462" target=3D= "_blank" rel=3D"noopener">CVE-2026-16462</a></td>
</tr>

<td class=3D"vendor-product">wolfcms--wolfcms</td>
<td>Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability=
in FileManagerController that allows authenticated attackers to create arb= itrary PHP files by exploiting missing file extension validation in the cre= ate_file() and save() functions. Attackers with the file_manager_mkfile cap= ability can write malicious PHP content into the web-accessible FILES_DIR d= irectory and trigger execution by requesting the file over HTTP.</td> <td>2026-07-30</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67206" target=3D= "_blank" rel=3D"noopener">CVE-2026-67206</a></td>
</tr>

<td class=3D"vendor-product">wolfcms--wolfcms</td>
<td>Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability=
in BackupRestoreController that allows authenticated non-administrative us= ers to access restricted backup functionality due to a PHP operator precede= nce flaw in the permission check expression. Attackers can exploit the inco= rrect evaluation of the access control expression to create, download, and = restore backups without administrative privileges.</td>
<td>2026-07-30</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67207" target=3D= "_blank" rel=3D"noopener">CVE-2026-67207</a></td>
</tr>

<td class=3D"vendor-product">wordplus--Better Messages Chat Rooms, Group Ch= at, Private Messages &amp; AI Chat Bots</td>
<td>The Better Messages - Chat Rooms, Group Chat, Private Messages &amp; AI=
Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion du=
e to insufficient file path validation in the delete_sticker function in al=
l versions up to, and including, 2.15.19. This makes it possible for authen= ticated attackers, with administrator-level access and above, to delete arb= itrary files on the server, which can easily lead to remote code execution = when the right file is deleted (such as wp-config.php). The prefix check in= tended to restrict deletion to the uploads directory can be bypassed by cra= fting a URL that begins with the legitimate uploads base URL but embeds ../=
traversal sequences in the path portion, as the normalize_sticker function=
only applies esc_url_raw(), which does not strip ../ sequences, allowing t=
he traversal payload to be stored verbatim in WordPress options.</td> <td>2026-07-28</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16585" target=3D= "_blank" rel=3D"noopener">CVE-2026-16585</a></td>
</tr>

<td class=3D"vendor-product">WordPress--WordPress-Coding-Standards</td>

<td>WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) t= hat enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the Word= Press.WP.EnqueuedResourceParameters sniff (active in the WordPress and Word= Press-Extra rulesets) reconstructed the $ver argument passed to functions s= uch as wp_enqueue_script() and ran it through eval() inside its is_falsy() = method, so a maliciously crafted argument such as 'system'('id') would exec= ute during a scan; as a result, running PHPCS with WordPressCS over untrust=
ed PHP (for example a CI pipeline that lints pull requests, or a developer = reviewing third-party code) could lead to arbitrary command execution on th=
e scanning host. The WordPress-Core and WordPress-Docs rulesets are not aff= ected. This issue is fixed in version 3.4.1.</td>
<td>2026-07-28</td>
<td>8.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-45293" target=3D= "_blank" rel=3D"noopener">CVE-2026-45293</a></td>
</tr>

<td class=3D"vendor-product">WP Chill--Kali Forms</td>
<td>Unauthenticated Cross Site Scripting (XSS) in Kali Forms &lt;=3D 2.4.18=
versions.</td>
<td>2026-07-27</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65446" target=3D= "_blank" rel=3D"noopener">CVE-2026-65446</a></td>
</tr>

<td class=3D"vendor-product">WP Media--BackWPup</td>
<td>Unauthenticated Cross Site Scripting (XSS) in BackWPup &lt;=3D 5.7.4 ve= rsions.</td>
<td>2026-07-27</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65443" target=3D= "_blank" rel=3D"noopener">CVE-2026-65443</a></td>
</tr>

<td class=3D"vendor-product">wpchill--Kali Forms Contact Form &amp; Drag-an= d-Drop Builder</td>
<td>The Kali Forms - Contact Form &amp; Drag-and-Drop Builder plugin for Wo= rdPress is vulnerable to Remote Code Execution in all versions up to, and i= ncluding, 2.4.20 via the _save_data function. This is due to insufficient v= alidation of the 'thisPermalink' field value before it overwrites a trusted=
callable placeholder, allowing attacker-controlled strings to reach call_u= ser_func() in _save_data(). This makes it possible for unauthenticated atta= ckers to execute code on the server. Exploitation requires the target form =
to define a field with a name matching one of the reserved placeholder keys=
('thisPermalink', 'entryCounter', or 'submission_link'), as check_if_place= holders_changed() only processes POST keys present in the form's field_type= _map.</td>
<td>2026-08-01</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16144" target=3D= "_blank" rel=3D"noopener">CVE-2026-16144</a></td>
</tr>

<td class=3D"vendor-product">wpdevelop--Booking Calendar</td> <td>Unauthenticated Cross Site Scripting (XSS) in Booking Calendar &lt;=3D = 11.4.2 versions.</td>
<td>2026-07-27</td>
<td>7.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59558" target=3D= "_blank" rel=3D"noopener">CVE-2026-59558</a></td>
</tr>

<td class=3D"vendor-product">wpmanageninja--Fluent Forms Customizable Conta=
ct Forms, Survey, Quiz, &amp; Conversational Form Builder</td>
<td>The Fluent Forms - Customizable Contact Forms, Survey, Quiz, &amp; Conv= ersational Form Builder plugin for WordPress is vulnerable to Stored Cross-= Site Scripting via Name Field Nested `password` Member in all versions up t=
o, and including, 6.2.7 due to insufficient input sanitization and output e= scaping. This makes it possible for unauthenticated attackers to inject arb= itrary web scripts in pages that will execute whenever a user accesses an i= njected page.</td>
<td>2026-07-29</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16655" target=3D= "_blank" rel=3D"noopener">CVE-2026-16655</a></td>
</tr>

<td class=3D"vendor-product">wpswings--Subscriptions for WooCommerce</td> <td>The Subscriptions for WooCommerce plugin for WordPress is vulnerable to=
Privilege Escalation in versions up to, and including, 2.0.0. This is due =
to the `save_meta_boxes()` function persisting the `_wps_plan_user_role` me= mbership plan meta from `$_POST` without an allowlist that excludes privile= ged roles - the only validations applied, `sanitize_key()` and `wp_roles()-= &gt;is_role()`, both accept `'administrator'` as a valid value, and the UI'=
s `disabled` attribute on the role dropdown is a client-side-only control t= rivially bypassed via DevTools or a direct POST request; additionally, beca= use the `wps_membership_plan` custom post type is registered with `capabili= ty_type =3D&gt; 'post'`, any user who can edit posts satisfies the `current= _user_can('edit_post', $post_id)` guard in `save_meta_boxes()`. This makes =
it possible for authenticated attackers, with Contributor-level access and = above, to escalate their privileges to Administrator by storing `'administr= ator'` as the role granted on membership acquisition, which the Pro compani=
on plugin then applies via `add_role()` during membership lifecycle events.=
Successful exploitation requires the Subscriptions for WooCommerce Pro com= panion plugin to be active, as it is the component that reads the stored `_= wps_plan_user_role` meta via `get_post_meta()` and calls `add_role()` to ap= ply the role during membership lifecycle events.</td>
<td>2026-08-01</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15414" target=3D= "_blank" rel=3D"noopener">CVE-2026-15414</a></td>
</tr>

<td class=3D"vendor-product">wpswings--Subscriptions for WooCommerce</td> <td>The Subscriptions for WooCommerce plugin for WordPress is vulnerable to=
Missing Authorization in all versions up to, and including, 2.0.0. This is=
due to the plugin not properly verifying that a user is authorized to perf= orm an action via the wps_sfw_install_plugin_configuration AJAX handler. Th=
is makes it possible for authenticated attackers, with shop manager-level a= ccess and above, to install and activate arbitrary WordPress.org plugins.</=

<td>2026-07-30</td>
<td>7.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15397" target=3D= "_blank" rel=3D"noopener">CVE-2026-15397</a></td>
</tr>

<td class=3D"vendor-product">wpwax--FormGent Next-Gen AI Form Builder for W= ordPress with Multi-Step, Quizzes, Payments &amp; More</td>
<td>The FormGent plugin for WordPress is vulnerable to unauthorized arbitra=
ry file deletion due to a missing capability check on the /wp-json/formgent= /responses/attachments REST API endpoint in all versions up to, and includi= ng, 1.9.2 This is due to the REST API route being registered without any au= thentication middleware in routes/rest/api.php. This makes it possible for = unauthenticated attackers to delete arbitrary files within the formgent upl= oads directory. Additionally, on Linux servers where the wp-content/uploads= /formgent directory does not yet exist (the default state after plugin inst= allation), the path traversal protection can be bypassed, enabling deletion=
of arbitrary files including wp-config.php which can lead to complete site=
takeover via a fresh WordPress installation.</td>

<td>2026-08-01</td>
<td>9.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-3141" target=3D"= _blank" rel=3D"noopener">CVE-2026-3141</a></td>
</tr>

<td class=3D"vendor-product">WPWeb--WooCommerce - Social Login</td>
<td>The WooCommerce - Social Login plugin for WordPress is vulnerable to Au= thentication Bypass in all versions up to and including 2.8.7. This is due =
to the plugin's Apple login handler accepting the Apple id_token and decodi=
ng only its base64 payload without verifying the JWT signature against Appl= e's public keys or validating the issuer, audience, or expiry claims, combi= ned with the security nonce required to invoke the login flow being publicl=
y exposed to unauthenticated users via a localized JavaScript object on the=
login page. This makes it possible for unauthenticated attackers to log in=
as any existing WordPress user - including administrators - by supplying a=
forged id_token whose payload contains the target user's email address, as=
that email is used without any role exclusion to resolve a WordPress accou=
nt and immediately issue an authenticated session for it.</td> <td>2026-08-01</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8457" target=3D"= _blank" rel=3D"noopener">CVE-2026-8457</a></td>
</tr>

<td class=3D"vendor-product">Xendit--Xendit Payment</td>
<td>Unauthenticated Broken Access Control in Xendit Payment &lt;=3D 7.1.0 v= ersions.</td>
<td>2026-07-27</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66473" target=3D= "_blank" rel=3D"noopener">CVE-2026-66473</a></td>
</tr>

<td class=3D"vendor-product">Xlight--Xlight FTP Server</td>
<td>Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffe=
r overflow vulnerability that allows remote unauthenticated attackers to wr= ite past the end of a heap buffer by sending a malformed SSH client identif= ication string. A logic error in the recv loop's termination condition uses=
an incorrect OR operator where an AND operator is required, enabling explo= itation on any SSH or SFTP connection before authentication occurs.</td> <td>2026-07-29</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67191" target=3D= "_blank" rel=3D"noopener">CVE-2026-67191</a></td>
</tr>

<td class=3D"vendor-product">Xlight--Xlight FTP Server</td>
<td>Xlight FTP Server before 3.9.5 contains a pre-authentication stack buff=
er overflow vulnerability that allows unauthenticated attackers to corrupt = stack memory by sending malformed SSH packets when a GCM cipher is negotiat= ed. Attackers can craft packets with an unvalidated length field passed dir= ectly to the GCM decrypt function, overwriting the stack cookie and return = address to potentially achieve remote code execution before any authenticat= ion occurs.</td>
<td>2026-07-29</td>
<td>8.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67192" target=3D= "_blank" rel=3D"noopener">CVE-2026-67192</a></td>
</tr>

<td class=3D"vendor-product">Ylianst--MeshCentral</td>
<td>MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection=
bypass vulnerability that allows unauthenticated remote attackers to hijac=
k authenticated administrator sessions by exploiting an unconditional early=
return in the CheckWebServerOriginName() function within webserver.js when=
self-signed certificates are in use. Attackers can open cross-origin WebSo= cket connections to any of the twelve WebSocket endpoints, send crafted act= ion commands to exfiltrate the server sessionKey used to sign session cooki= es, forge session tokens as arbitrary users, and gain full remote control o=
f all managed devices governed by the MeshCentral instance.</td> <td>2026-07-30</td>
<td>8.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66420" target=3D= "_blank" rel=3D"noopener">CVE-2026-66420</a></td>
</tr>

<td class=3D"vendor-product">yolanmees--Spikster</td>
<td>Spikster through commit e1cdf8c contains a missing authentication vulne= rability that allows unauthenticated remote attackers to access all API rou= tes by exploiting the unattached CipiAuth middleware, which is registered b=
ut never applied to any route in the API routing configuration. Attackers c=
an invoke approximately 50 unprotected API endpoints to enumerate and provi= sion servers, reset root passwords, read and write arbitrary files on the h= ost, and create database users.</td>
<td>2026-07-30</td>
<td>9.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67594" target=3D= "_blank" rel=3D"noopener">CVE-2026-67594</a></td>
</tr>

<td class=3D"vendor-product">zephyrproject--zephyr</td>
<td>The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_= ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the application's params-= &gt;subscribe() callback after it had already called params-&gt;notify(conn=
, params, NULL, 0). Per the public GATT API, a notify callback with NULL da=
ta is the documented signal that the subscription has terminated and the bt= _gatt_subscribe_params struct may be freed or reused by the application; ca= lling subscribe() on the struct afterwards is a use-after-free, including a=
n indirect call through the freed params-&gt;subscribe function pointer. Th=
e error branch is remotely (adjacent) reachable: a Zephyr device acting as =
a GATT client that calls bt_gatt_subscribe() can be driven into this orderi=
ng when a connected GATT server peer answers the CCC write with an ATT Erro=
r Response (the peer-supplied error code flows through att_error_rsp -&gt; = att_handle_rsp into gatt_write_ccc_rsp). For applications that free or recy= cle subscription parameters in their notification-termination handler, this=
results in memory corruption, a crash (denial of service), or potentially = attacker-influenced control flow. The fix reorders the handler so the subsc= ribe() callback runs before the terminating notify(NULL) in both the error = and unsubscribe paths.</td>
<td>2026-07-31</td>
<td>7.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10685" target=3D= "_blank" rel=3D"noopener">CVE-2026-10685</a></td>
</tr>

<td class=3D"vendor-product">zephyrproject--zephyr</td>
<td>The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC fram=
es in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a hand-rolled he= lper, extract_string_field(), that copied the message's uid and action fiel=
ds with strncpy(out_buf, token + 1, outlen - 1) and then scanned the result=
with strchr(out_buf, '"'). Because strncpy does not NUL-terminate the dest= ination when the source is at least outlen - 1 (127) bytes long, the subseq= uent strchr reads past the 128-byte destination buffer into adjacent stack = memory; if a " byte is found beyond the buffer, a one-byte out-of-bounds NU=
L write also occurs. A related defect in extract_payload() runs strchr/strr= chr over the receive buffer, which may not be NUL-terminated when a maximal= -length frame fills it. The parsed bytes come directly from the OCPP centra= l-system server over a websocket: the reader thread fills recv_buf via webs= ocket_recv_msg() and calls parse_rpc_msg() on each inbound DATA frame (subs= ys/net/lib/ocpp/ocpp.c). A malicious or compromised central server, or an o= n-path attacker (OCPP is commonly deployed over plain ws://), can send an R=
PC frame whose uid or action field is 127+ bytes with no closing quote, tri= ggering the out-of-bounds access. The primary impact is a remotely triggera= ble denial of service: the unbounded scan can fault on an unmapped page, an=
d the stray NUL write can corrupt adjacent stack state. The over-read data =
is not reflected to the peer, so disclosure is limited. The feature is EXPE= RIMENTAL and must be explicitly enabled (CONFIG_OCPP). The fix replaces the=
manual parser with the bounds-respecting json_mixed_arr_parse() and copies=
the extracted uid with an explicitly NUL-terminated buffer, eliminating bo=
th over-reads.</td>
<td>2026-08-02</td>
<td>7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10848" target=3D= "_blank" rel=3D"noopener">CVE-2026-10848</a></td>
</tr>

<td class=3D"vendor-product">zip-lib--zip-lib</td>
<td>Versions of the package zip-lib before 1.1.0 are vulnerable to Director=
y Traversal via the caching mechanism for path validation during the extrac= tion process. An attacker can bypass security checks designed to prevent di= rectory traversal. The intended security function, isOutsideTargetFolder, o= nly checks and caches the path status when the initial directory symlink is=
created during the first extraction.</td>
<td>2026-07-28</td>
<td>7.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17524" target=3D= "_blank" rel=3D"noopener">CVE-2026-17524</a></td>
</tr>
</tbody>
</table>
<p><a href=3D"#top">Back to top</a></p>
</div>
<div id=3D"medium_v">
<h2 id=3D"medium_v_title">Medium Vulnerabilities</h2>
<table class=3D"table no-tablesaw" style=3D"table-layout: fixed; width: 100= %;" border=3D"1" summary=3D"Medium Vulnerabilities">
<thead>

<th class=3D"vendor-product" style=3D"width: 24%;" scope=3D"col">
<span class=3D"primary-vendor">Primary</span><br><span class=3D"primary-ven= dor">Vendor</span> -- Product</th>
<th style=3D"width: 44%;" scope=3D"col">Description</th>
<th style=3D"width: 10%;" scope=3D"col">Published</th>
<th style=3D"width: 8%;" scope=3D"col">CVSS Score</th>
<th style=3D"width: 7%;" scope=3D"col">Source Info</th>
</tr>
</thead>
<tbody>

<td class=3D"vendor-product">100plugins--Open User Map</td>
<td>Contributor Cross Site Scripting (XSS) in Open User Map &lt;=3D 1.4.46 = versions.</td>
<td>2026-07-27</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66445" target=3D= "_blank" rel=3D"noopener">CVE-2026-66445</a></td>
</tr>

<td class=3D"vendor-product">@fastify/forwarded--@fastify/forwarded</td>

<td>@fastify/forwarded resolves client addresses from the X-Forwarded-For h= eader. In versions before 3.0.2, when the header contains two or more comma=
separated entries, the parser trims only space characters and does not str=
ip horizontal tabs, even though RFC 7230 defines optional whitespace as bot=
h space and tab. As a result, an entry padded with a tab keeps the literal = tab in the resolved address string. Applications that make exact string mat=
ch security decisions on the resolved client IP, such as an allowlist, a bl= ocklist, a per IP rate limit key, or audit log correlation, can be evaded b= ecause the tab corrupted string no longer matches the expected value. This = does not cross the trust boundary, since a tab corrupted string is not a va= lid IP and cannot be mistaken for a trusted proxy. The issue is fixed in @f= astify/forwarded 3.0.2.</td>
<td>2026-07-29</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18174" target=3D= "_blank" rel=3D"noopener">CVE-2026-18174</a></td>
</tr>

<td class=3D"vendor-product">acacode--swagger-typescript-api</td> <td>swagger-typescript-api generates API clients for Fetch or Axios from Op= enAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warm= UpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocum= ent uses isHttpUrl to fetch any http or https target without private IP, re= direct, DNS rebinding, or same-origin validation, allowing an attacker-cont= rolled OpenAPI spec to make the generator issue requests to internal or lin= k-local services. This issue is fixed in version 13.12.2.</td> <td>2026-07-29</td>
<td>6.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54663" target=3D= "_blank" rel=3D"noopener">CVE-2026-54663</a></td>
</tr>

<td class=3D"vendor-product">acowebs--Checkout Field Editor for WooCommerce=
Checkout Manager</td>
<td>Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for Wo= oCommerce &amp;#8211; Checkout Manager &lt;=3D 3.0.5 versions.</td> <td>2026-07-27</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66475" target=3D= "_blank" rel=3D"noopener">CVE-2026-66475</a></td>
</tr>

<td class=3D"vendor-product">AcyMailing Newsletter Team--Anti Spam and list=
cleaner AcyChecker</td>
<td>Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleane=
r &amp;#8211; AcyChecker &lt;=3D 1.8.1 versions.</td>
<td>2026-07-27</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65448" target=3D= "_blank" rel=3D"noopener">CVE-2026-65448</a></td>
</tr>

<td class=3D"vendor-product">adonisjs--http-server</td>
<td>AdonisJS HTTP Server is a package for handling HTTP requests in the Ado= nisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9= .0.2, the error.message is interpolated into the default HTML exception res= ponse without escaping, allowing a crafted missing-route URL to execute att= acker-controlled JavaScript when a victim opens it and no custom status pag=
e or JSON response handles the error. When debug mode is disabled and no cu= stom status page handles the error, the default HTML renderer interpolates = error.message directly into an HTML response. This issue is fixed in versio=
ns 8.2.1 and 9.1.0.</td>
<td>2026-07-30</td>
<td>6.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-61526" target=3D= "_blank" rel=3D"noopener">CVE-2026-61526</a></td>
</tr>

<td class=3D"vendor-product">ads-tec Industrial IT--DVG-IRF1401</td>
<td>An unauthenticated remote attacker can abuse the improper validation of=
the post-login redirect of the web-UI to trick users to a malicious websit=
e. This can result in a loss of confidentiality and availability.</td> <td>2026-07-28</td>
<td>6.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14171" target=3D= "_blank" rel=3D"noopener">CVE-2026-14171</a></td>
</tr>

<td class=3D"vendor-product">Alibaba--Alibaba Cloud RDS OpenAPI MCP Server<=

<td>Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-ser= ver allows remote attackers to invoke exposed MCP tools via network access =
to an MCP endpoint listening on all network interfaces by default.</td> <td>2026-07-28</td>
<td>5.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9680" target=3D"= _blank" rel=3D"noopener">CVE-2026-9680</a></td>
</tr>

<td class=3D"vendor-product">ameliabooking--Booking System Trafft</td>

<td>The Booking System Trafft plugin for WordPress is vulnerable to Stored = Cross-Site Scripting via the `bookingWebsiteUrl` setting in all versions up=
to, and including, 1.0.17 due to a missing capability check on the `set_op= tions` AJAX action when the plugin is operating in agency mode. The `trafft= SetOptions()` handler verifies a nonce that is exposed to any authenticated=
user (it is printed inline on every admin page, including profile.php) but=
performs no capability check before calling `update_option('trafft_option'=
, ['bookingWebsiteUrl' =3D&gt; ...])`. This setting is then used by `trafft= AdminAssets()` to enqueue `&lt;bookingWebsiteUrl&gt;/embed.js` as a script =
on every front-end page that renders the booking shortcode. This makes it p= ossible for authenticated attackers, with Subscriber-level access and above=
, to point the embed-script URL at an attacker-controlled origin and execut=
e arbitrary JavaScript in the browser of every site visitor (including admi= ns).</td>
<td>2026-07-29</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8791" target=3D"= _blank" rel=3D"noopener">CVE-2026-8791</a></td>
</tr>

<td class=3D"vendor-product">ANDRITZ--HIPASE-250</td>
<td>The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in=
affected versions exposes an undocumented endpoint that changes the server=
's logging level and target without requiring authentication. A remote, una= uthenticated attacker with network access to the service may suppress audit=
logging, potentially concealing other activity on the system.</td> <td>2026-07-31</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65311" target=3D= "_blank" rel=3D"noopener">CVE-2026-65311</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Thrift</td> <td>Improper Validation of Certificate with Host Mismatch vulnerability in = Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.2= 4.0. Users are recommended to upgrade to version 0.24.0, which fixes the is= sue. This replaces=C2=A0CVE-2026-41603</td>
<td>2026-07-27</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66053" target=3D= "_blank" rel=3D"noopener">CVE-2026-66053</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Apache Traffic Server reads out of bounds while parsing DNS answers. Th=
is issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.=
0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgr= ade to version 9.2.15 or 10.1.4, which fix the issue.</td>
<td>2026-07-29</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58160" target=3D= "_blank" rel=3D"noopener">CVE-2026-58160</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Apache Traffic Server copies the client Host header into a fixed-size s= tack buffer without a bound during redirect handling, so an over-long Host = header overflows the stack when redirect following is enabled. This issue a= ffects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through = 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to ver= sion 9.2.15 or 10.1.4, which fix the issue.</td>
<td>2026-07-29</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-33930" target=3D= "_blank" rel=3D"noopener">CVE-2026-33930</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Apache Traffic Server mishandles integers while decoding HPACK/XPACK he= aders, corrupting memory. This issue affects Apache Traffic Server: from 8.= 0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. U= sers are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the = issue.</td>
<td>2026-07-29</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58152" target=3D= "_blank" rel=3D"noopener">CVE-2026-58152</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Apache Traffic Server mishandles PROXY protocol input, truncating ports=
and overflowing the stack. This issue affects Apache Traffic Server: from = 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.=
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix th=
e issue.</td>
<td>2026-07-29</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58158" target=3D= "_blank" rel=3D"noopener">CVE-2026-58158</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>The Apache Traffic Server prefetch plugin can crash when processing att= acker-influenced input. This issue affects Apache Traffic Server: from 8.0.=
0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Use=
rs are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the is= sue.</td>
<td>2026-07-29</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58183" target=3D= "_blank" rel=3D"noopener">CVE-2026-58183</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>The Apache Traffic Server intercept plugin has a use-after-free. This i= ssue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 th= rough 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade =
to version 9.2.15 or 10.1.4, which fix the issue.</td>
<td>2026-07-29</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58185" target=3D= "_blank" rel=3D"noopener">CVE-2026-58185</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Apache Traffic Server mis-parses ports in URLs and userinfo, allowing p= ort-based access-control bypass. This issue affects Apache Traffic Server: = from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10= .1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which f=
ix the issue.</td>
<td>2026-07-29</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58156" target=3D= "_blank" rel=3D"noopener">CVE-2026-58156</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Apache Traffic Server updates the HTTP/2 HPACK dynamic table before con= firming the header block encoded successfully, so an encode failure leaves = the encoder out of sync with the peer decoder and corrupts subsequent heade=
r blocks on the connection. This issue affects Apache Traffic Server: from = 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.=
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix th=
e issue.</td>
<td>2026-07-29</td>
<td>4.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65100" target=3D= "_blank" rel=3D"noopener">CVE-2026-65100</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>Apache Traffic Server reuses multiplexed HTTP/2 origin connections with= out verifying the server certificate covers the new request hostname. This = issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0=
through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1= .4, which fix the issue.</td>
<td>2026-07-29</td>
<td>4.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65325" target=3D= "_blank" rel=3D"noopener">CVE-2026-65325</a></td>
</tr>

<td class=3D"vendor-product">ArcadeData--arcadedb</td>
<td>ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database perm= ission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRAT= EGY SQL operations, which map to setCustomValue and setBucketSelectionStrat= egy in LocalDocumentType. An authenticated user with only read access (e.g.=
, a read-only API token) can submit these ALTER TYPE statements via the HTT=
P command endpoint to mutate a type's custom schema metadata and bucket-sel= ection strategy, bypassing the documented updateSchema permission boundary = and potentially corrupting schema metadata and record routing.</td> <td>2026-08-01</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67344" target=3D= "_blank" rel=3D"noopener">CVE-2026-67344</a></td>
</tr>

<td class=3D"vendor-product">ArnasDon--wacrm</td>
<td>WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlie=
r, the automation send_webhook action in src/lib/automations/engine.ts and = its validation in src/lib/automations/validate.ts allowed an authenticated = user with automation privileges to submit an arbitrary webhook URL that the=
server fetched without the existing isDeliverableUrl SSRF guard in src/lib= /webhooks/ssrf.ts, allowing requests to private, loopback, link-local, or c= loud metadata addresses such as the cloud metadata endpoint at 169.254.169.= 254. This vulnerability is fixed with commit 23838a9959550e975d732ae08a44a3= a2f0cc084b.</td>
<td>2026-07-30</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67530" target=3D= "_blank" rel=3D"noopener">CVE-2026-67530</a></td>
</tr>

<td class=3D"vendor-product">arnog--mathlive</td>
<td>MathLive provides web components for math display and input. Prior to 0= .110.0, MathLive fails to escape text-mode content in \text{} and \mbox{} c= ommands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and tex= t-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexTo= Markup, convertLatexToMathMl, &lt;math-span&gt;, &lt;math-div&gt;, and the = default identity MathfieldElement.createHTML, allowing malicious input to r=
un arbitrary JavaScript when rendered. This issue is fixed in version 0.110= .0.</td>
<td>2026-07-29</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54705" target=3D= "_blank" rel=3D"noopener">CVE-2026-54705</a></td>
</tr>

<td class=3D"vendor-product">AstrBotDevs--AstrBot</td>
<td>A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Aff= ected is an unknown function of the file astrbot/core/astr_main_agent.py. T=
he manipulation of the argument req.func_tool leads to incorrect authorizat= ion. The attack may be initiated remotely. The exploit is publicly availabl=
e and might be used. The identifier of the patch is d23011262e8e75e1ec41b0f= 1f0091493a022327e. It is suggested to install a patch to address this issue= .</td>
<td>2026-07-27</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17529" target=3D= "_blank" rel=3D"noopener">CVE-2026-17529</a></td>
</tr>

<td class=3D"vendor-product">AstrBotDevs--AstrBot</td>
<td>A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5=
. Affected by this vulnerability is the function _build_handoff_toolset of = the file AstrBot/astrbot/core/astr_agent_tool_exec.py of the component Suba= gent. The manipulation results in incorrect authorization. The attack may b=
e launched remotely. The exploit has been released to the public and may be=
used for attacks. The patch is identified as d23011262e8e75e1ec41b0f1f0091= 493a022327e. A patch should be applied to remediate this issue.</td> <td>2026-07-27</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17530" target=3D= "_blank" rel=3D"noopener">CVE-2026-17530</a></td>
</tr>

<td class=3D"vendor-product">Autodesk--AutoCAD</td>
<td>A maliciously crafted DWG or DXF file, when parsed through Autodesk Aut= oCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can = leverage this vulnerability to cause a crash or disclose sensitive informat= ion.</td>
<td>2026-07-29</td>
<td>6.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16465" target=3D= "_blank" rel=3D"noopener">CVE-2026-16465</a></td>
</tr>

<td class=3D"vendor-product">Autodesk--AutoCAD</td>
<td>A maliciously crafted DWG or DXF file, when parsed through Autodesk Aut= oCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can = leverage this vulnerability to cause a crash or disclose sensitive informat= ion.</td>
<td>2026-07-29</td>
<td>5.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17550" target=3D= "_blank" rel=3D"noopener">CVE-2026-17550</a></td>
</tr>

<td class=3D"vendor-product">azukaar--Cosmos-Server</td>
<td>Cosmos provides users the ability self-host a home server by acting as =
a secure gateway to your application, as well as a server manager. In 0.22.= 18, `GET /cosmos/api/constellation/public-devices` discloses Constellation = device metadata to a requester that supplies any non-empty Authorization he= ader. The handler strips the string Bearer from the header but never valida= tes the resulting token and never uses it in the database query. This vulne= rability is fixed in 0.22.19.</td>
<td>2026-07-28</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-49447" target=3D= "_blank" rel=3D"noopener">CVE-2026-49447</a></td>
</tr>

<td class=3D"vendor-product">better-auth--better-auth</td>
<td>better-auth versions before 1.4.9 contain a two-factor authentication b= ypass vulnerability when session.cookieCache is enabled. Attackers with val=
id primary credentials can access authenticated routes without completing s= econd-factor verification by exploiting premature session caching.</td> <td>2026-08-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67337" target=3D= "_blank" rel=3D"noopener">CVE-2026-67337</a></td>
</tr>

<td class=3D"vendor-product">better-auth--better-auth</td>
<td>better-auth (npm) before 1.4.2 allows an external request to configure = baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). =
An attacker able to make the very first request to the server after startup=
can poison the router's base path, causing all routes to return 404 for al=
l users (denial of service). The issue is not reachable when baseURL is exp= licitly configured or on typical managed hosting platforms.</td> <td>2026-08-02</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71401" target=3D= "_blank" rel=3D"noopener">CVE-2025-71401</a></td>
</tr>

<td class=3D"vendor-product">better-auth--better-auth</td>
<td>better-auth versions before 1.6.2 fail to validate the OAuth state para= meter against the stored nonce when using cookie-backed state storage witho=
ut PKCE. Attackers can forge the state parameter and supply an attacker-con= trolled authorization code to create authenticated sessions bound to the at= tacker's external identity or persistently link attacker accounts to victim=
profiles.</td>
<td>2026-08-01</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67335" target=3D= "_blank" rel=3D"noopener">CVE-2026-67335</a></td>
</tr>

<td class=3D"vendor-product">better-auth--oauth-provider</td> <td>@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-to= ken audience to the authorization grant, allowing clients to request tokens=
for unrelated resources. Attackers can complete an OAuth flow and obtain a= ccess tokens whose audience targets resource servers the authorization neve=
r covered, bypassing intended authorization boundaries.</td> <td>2026-08-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67332" target=3D= "_blank" rel=3D"noopener">CVE-2026-67332</a></td>
</tr>

<td class=3D"vendor-product">blendmedia--WP CTA Call Now Button, Sticky But= ton &amp; Call to Action Builder</td>
<td>The WP CTA plugin for WordPress is vulnerable to Server-Side Request Fo= rgery via the 'sticky_s_media' parameter in imported JSON files in all vers= ions up to, and including, 2.1.2. This is due to the import_sidebars() func= tion passing user-supplied URLs from imported JSON data to file_get_content= s() with only FILTER_VALIDATE_URL validation (which allows internal IPs). T= his makes it possible for authenticated attackers, with Administrator-level=
access and above, to make web requests to arbitrary locations originating = from the web application, which can be used to query and modify information=
from internal services. The response content is saved as a WordPress media=
attachment, making this a full-read SSRF.</td>
<td>2026-07-29</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-6089" target=3D"= _blank" rel=3D"noopener">CVE-2026-6089</a></td>
</tr>

<td class=3D"vendor-product">bplugins--Survey Form Block collect answers an=
d insights from your audience</td>
<td>The Survey Form Block plugin for WordPress is vulnerable to unauthorize=
d access of data due to a missing capability check on the get_all_data() fu= nction in all versions up to, and including, 1.0.1. This makes it possible = for authenticated attackers, with Subscriber-level access and above, to exp= ort all survey submission data and column metadata.</td>
<td>2026-07-29</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5626" target=3D"= _blank" rel=3D"noopener">CVE-2026-5626</a></td>
</tr>

<td class=3D"vendor-product">brainstormforce--SureForms Contact Form Builde=
r, AI Forms, Payment Form, Survey &amp; Quiz</td>
<td>The SureForms - Contact Form, Payment Form &amp; Other Custom Form Buil= der plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t=
he 'headingWrapper' parameter in all versions up to, and including, 2.8.1 d=
ue to insufficient input sanitization and output escaping. This makes it po= ssible for authenticated attackers, with contributor-level access and above=
, to inject arbitrary web scripts in pages that will execute whenever a use=
r accesses an injected page.</td>
<td>2026-08-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7623" target=3D"= _blank" rel=3D"noopener">CVE-2026-7623</a></td>
</tr>

<td class=3D"vendor-product">brightio--penelope</td>
<td>Penelope Shell Handler is a post-exploitation shell handler for authori= zed security testing. Prior to 0.20.0, the Unix download() implementation i=
n penelope.py used tar.extractall(local_download_folder) on tar archives re= turned by remote sessions without validating member paths, allowing a malic= ious or compromised session to write files outside the intended download di= rectory and potentially overwrite ~/.penelope/peneloperc. This issue is fix=
ed in version 0.20.0.</td>
<td>2026-07-29</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50558" target=3D= "_blank" rel=3D"noopener">CVE-2026-50558</a></td>
</tr>

<td class=3D"vendor-product">Budibase--budibase</td>
<td>Budibase before 3.38.1 contains a server-side request forgery vulnerabi= lity in the REST datasource integration that fails to validate HTTP redirec=
ts against the IP blacklist. Attackers with Builder role can configure a RE=
ST datasource pointing to an external server that returns a redirect to int= ernal IP addresses, bypassing blacklist protection to access cloud metadata=
endpoints and internal services.</td>
<td>2026-08-01</td>
<td>6.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67311" target=3D= "_blank" rel=3D"noopener">CVE-2026-67311</a></td>
</tr>

<td class=3D"vendor-product">Chaty--Chaty Pro</td>
<td>The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-= Based Blind SQL Injection in versions up to and including 3.5.5. This is du=
e to the fetch_custom_field() function in admin/class-admin-base.php retrie= ving the widget_id POST parameter via filter_input(INPUT_POST, ...) and dir= ectly concatenating the value into a raw SQL query in a numeric context wit= hout using $wpdb-&gt;prepare() or any integer casting. Additionally, the no= nce verification check is performed after the SQL query has already execute=
d, providing no protection against the injection. This makes it possible fo=
r authenticated attackers with subscriber-level access and above to inject = arbitrary SQL commands, potentially leading to unauthorized extraction of s= ensitive database contents including user credentials and configuration dat= a.</td>
<td>2026-07-28</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-6251" target=3D"= _blank" rel=3D"noopener">CVE-2026-6251</a></td>
</tr>

<td class=3D"vendor-product">chrisvrichardson--MapPress Maps for WordPress<=

<td>Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress = &lt;=3D 2.97.6 versions.</td>
<td>2026-07-27</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65564" target=3D= "_blank" rel=3D"noopener">CVE-2026-65564</a></td>
</tr>

<td class=3D"vendor-product">Cisco--Cisco Secure Firewall Management Center=
(FMC)</td>
<td>A vulnerability in the web interface of Cisco Secure Firewall Managemen=
t Center (FMC) Software could allow an unauthenticated, remote attacker to = log in to an affected device using a low-privileged account to access sensi= tive data within the impacted systems. This vulnerability is due to the pre= sence of static user credentials for a low-privileged&amp;nbsp;account. An = attacker could exploit this vulnerability by using the account to log in to=
an affected system. A successful exploit could allow the attacker to log i=
n to the affected system and access sensitive data as the low-privileged us= er.&amp;nbsp; Note:&amp;nbsp;If the FMC management interface does not have = public internet access, the attack surface that is associated with this vul= nerability is reduced.&amp;nbsp;&amp;nbsp; Cisco has assigned this security=
advisory a Security Impact Rating (SIR) of High rather than Medium as the = score indicates. The reason is that this vulnerability can be used with oth=
er Cisco Secure FMC Software vulnerabilities to elevate privileges.</td> <td>2026-07-29</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-20316" target=3D= "_blank" rel=3D"noopener">CVE-2026-20316</a></td>
</tr>

<td class=3D"vendor-product">clastix--kamaji</td>
<td>Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.= 7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements b=
y interpolating the user-supplied DataStoreUsername/DataStoreSchema directl=
y into SQL via fmt.Sprintf, without escaping identifiers. These fields have=
no format validation, so a value containing a quote character breaks out o=
f the quoted identifier - SQL injection executed over Kamaji's root connect= ion to the shared datastore. etcd driver is not affected.This issue is fixe=
d in version 26.7.4-edge.</td>
<td>2026-07-30</td>
<td>4.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62845" target=3D= "_blank" rel=3D"noopener">CVE-2026-62845</a></td>
</tr>

<td class=3D"vendor-product">cloudreve--cloudreve</td>
<td>Cloudreve is a self-hosted file management and sharing system. Prior to=
4.17.0, the built-in thumbnail and avatar image decoders limit compressed = file size but do not limit decoded pixel dimensions, allowing an authentica= ted user to submit a small PNG, JPEG, or GIF that triggers an unbounded all= ocation and terminates the Cloudreve process through fatal out-of-memory be= havior. This issue is fixed in version 4.17.0.</td>
<td>2026-07-31</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55497" target=3D= "_blank" rel=3D"noopener">CVE-2026-55497</a></td>
</tr>

<td class=3D"vendor-product">cloudreve--cloudreve</td>
<td>Cloudreve is a self-hosted file management and sharing system. Prior to=
4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI = access token and does not enforce the requested viewer action, allowing a m= alicious or compromised WOPI viewer with a view session to forge the token = suffix and invoke WOPI write routes for the underlying file. This issue is = fixed in version 4.17.0.</td>
<td>2026-07-31</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62323" target=3D= "_blank" rel=3D"noopener">CVE-2026-62323</a></td>
</tr>

<td class=3D"vendor-product">cloudreve--cloudreve</td>
<td>Cloudreve is a self-hosted file management and sharing system. Prior to=
4.17.0, the WOPI PUT_RELATIVE handler passes X-WOPI-SuggestedTarget to URI= .JoinRaw as a path rather than a filename, allowing slash and dot-dot segme= nts to escape the source file directory and create or conditionally overwri=
te files elsewhere in the same owner account. This issue is fixed in versio=
n 4.17.0.</td>
<td>2026-07-31</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55495" target=3D= "_blank" rel=3D"noopener">CVE-2026-55495</a></td>
</tr>

<td class=3D"vendor-product">cloudreve--cloudreve</td>
<td>Cloudreve is a self-hosted file management and sharing system. Prior to=
4.17.0, GET /api/v4/user/search calls SearchActive without adding a Status= Active predicate and serializes matches at RedactLevelUser, allowing any lo= gged-in user to enumerate email addresses and profile metadata for inactive=
or banned accounts. The service calls userClient.SearchActive, but despite=
its name that method filters only by email/nickname keyword and never adds=
a StatusActive predicate - while the sibling lookups GetActiveByID and Get= ActiveByDavAccount, defined a few lines above it, do. Search hits are seria= lized at RedactLevelUser, which includes the email address. This issue is f= ixed in version 4.17.0.</td>
<td>2026-07-31</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55496" target=3D= "_blank" rel=3D"noopener">CVE-2026-55496</a></td>
</tr>

<td class=3D"vendor-product">cloudreve--cloudreve</td>
<td>Cloudreve is a self-hosted file management and sharing system. Prior to=
4.17.0, a single-file share event-stream subscription resolves the share r= oot to the owner's parent folder and subscribes to that folder topic, allow= ing an authenticated share recipient to receive names, paths, rename target=
s, event types, and hashed identifiers for unshared sibling files and folde= rs. This issue is fixed in version 4.17.0.</td>
<td>2026-07-31</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55499" target=3D= "_blank" rel=3D"noopener">CVE-2026-55499</a></td>
</tr>

<td class=3D"vendor-product">codeigniter4--CodeIgniter4</td>
<td>CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7= .4, IncomingRequest::isSecure() trusted the X-Forwarded-Proto and Front-End= -Https headers from any incoming request, allowing an attacker could spoof = these headers and cause the application to incorrectly treat an HTTP reques=
t as secure. This may have impacted applications that rely on isSecure(), f= orce_https(), forceGlobalSecureRequests, or similar logic to enforce HTTPS-= only access or make security-sensitive decisions. Exploitability depends on=
deployment configuration. Applications are most exposed if the backend is = reachable directly over HTTP, or if a reverse proxy/load balancer forwards = client-supplied forwarding headers without stripping or overwriting them. T= his issue has been fixed in version 4.7.4.</td>
<td>2026-07-31</td>
<td>4.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63220" target=3D= "_blank" rel=3D"noopener">CVE-2026-63220</a></td>
</tr>

<td class=3D"vendor-product">codename065--Download Manager</td>
<td>The Download Manager plugin for WordPress is vulnerable to Stored Cross= -Site Scripting via 'icon' Shortcode Attribute in all versions up to, and i= ncluding, 3.3.66 due to insufficient input sanitization and output escaping=
. This makes it possible for authenticated attackers, with contributor-leve=
l access and above, to inject arbitrary web scripts in pages that will exec= ute whenever a user accesses an injected page. wp_kses_post() does not neut= ralize the payload because it operates on post content at save time and doe=
s not process shortcode attribute values that are emitted unescaped at rend=
er time.</td>
<td>2026-08-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16685" target=3D= "_blank" rel=3D"noopener">CVE-2026-16685</a></td>
</tr>

<td class=3D"vendor-product">codesupplyco--Powerkit Supercharge your WordPr= ess Site</td>
<td>The Powerkit - Supercharge your WordPress Site plugin for WordPress is = vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute i=
n all versions up to, and including, 3.1.0 due to insufficient input saniti= zation and output escaping. This makes it possible for authenticated attack= ers, with contributor-level access and above, to inject arbitrary web scrip=
ts in pages that will execute whenever a user accesses an injected page.</t=

<td>2026-08-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15644" target=3D= "_blank" rel=3D"noopener">CVE-2026-15644</a></td>
</tr>

<td class=3D"vendor-product">codesupplyco--Powerkit Supercharge your WordPr= ess Site</td>
<td>The Powerkit - Supercharge your WordPress Site plugin for WordPress is = vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in = all versions up to, and including, 3.1.0 due to insufficient input sanitiza= tion and output escaping. This makes it possible for authenticated attacker=
s, with contributor-level access and above, to inject arbitrary web scripts=
in pages that will execute whenever a user accesses an injected page.</td> <td>2026-08-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15645" target=3D= "_blank" rel=3D"noopener">CVE-2026-15645</a></td>
</tr>

<td class=3D"vendor-product">codesupplyco--Powerkit Supercharge your WordPr= ess Site</td>
<td>The Powerkit - Supercharge your WordPress Site plugin for WordPress is = vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all v= ersions up to, and including, 3.1.0 due to insufficient input sanitization = and output escaping. This makes it possible for authenticated attackers, wi=
th contributor-level access and above, to inject arbitrary web scripts in p= ages that will execute whenever a user accesses an injected page.</td> <td>2026-08-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15649" target=3D= "_blank" rel=3D"noopener">CVE-2026-15649</a></td>
</tr>

<td class=3D"vendor-product">CODESYS--CODESYS PROFINET</td>
<td>An out of bounds write vulnerability in the CODESYS PROFINET Controller=
allows an unauthenticated attacker on the same network segment to send mal= formed PROFINET communication data that triggers an exception in the affect=
ed PLC application. The exception is handled by the CODESYS Control runtime=
system and results in a controlled stop of the PLC application.</td> <td>2026-07-29</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-35226" target=3D= "_blank" rel=3D"noopener">CVE-2026-35226</a></td>
</tr>

<td class=3D"vendor-product">contrid--Newsletters</td>
<td>The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross= -Site Scripting via the 'target' attribute of the [newsletters_post] shortc= ode in versions up to and including 4.15. This is due to insufficient input=
sanitization and output escaping in the posts_single() function which prop= agates the attacker-controlled 'target' attribute into the global $wpml_tar= get, and in the shortcode_posts() 'post_thumbnail' handler which concatenat=
es $wpml_target into a target=3D"..." HTML attribute without esc_attr(). Th=
is makes it possible for authenticated attackers, with Contributor-level ac= cess and above, to inject arbitrary web scripts in pages that will execute = whenever a user accesses an injected page.</td>
<td>2026-07-29</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12938" target=3D= "_blank" rel=3D"noopener">CVE-2026-12938</a></td>
</tr>

<td class=3D"vendor-product">contrid--Newsletters</td>
<td>The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross= -Site Scripting via the 'link' attribute of the post_thumbnail (and newslet= ters_post_thumbnail) shortcodes in versions up to and including 4.15. This =
is due to insufficient input sanitization and output escaping in the post_t= humbnail() method in helpers/shortcode.php, which concatenates the user-con= trolled $link shortcode attribute directly into an href attribute without e= sc_url() or esc_attr(). This makes it possible for authenticated attackers,=
with contributor-level access and above, to inject arbitrary web scripts i=
n pages that will execute whenever a user accesses an injected page.</td> <td>2026-07-29</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12939" target=3D= "_blank" rel=3D"noopener">CVE-2026-12939</a></td>
</tr>

<td class=3D"vendor-product">cozythemes--Cozy Blocks Page Builder for Guten= berg Editor &amp; FSE with 600+ Patterns, 58 Blocks &amp; Templates</td> <td>The Cozy Blocks - Page Builder for Gutenberg Editor &amp; FSE with 600+=
Patterns, 58 Blocks &amp; Templates plugin for WordPress is vulnerable to = Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute in all=
versions up to, and including, 2.2.11 due to insufficient input sanitizati=
on and output escaping. This makes it possible for authenticated attackers,=
with contributor-level access and above, to inject arbitrary web scripts i=
n pages that will execute whenever a user accesses an injected page.</td> <td>2026-07-28</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15393" target=3D= "_blank" rel=3D"noopener">CVE-2026-15393</a></td>
</tr>

<td class=3D"vendor-product">cozythemes--Cozy Blocks Page Builder for Guten= berg Editor &amp; FSE with 700+ Patterns, 58 Blocks &amp; Templates</td> <td>The Cozy Blocks - Page Builder for Gutenberg Editor &amp; FSE with 600+=
Patterns, 58 Blocks &amp; Templates plugin for WordPress is vulnerable to = Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute in=
all versions up to, and including, 2.2.11 due to insufficient input saniti= zation and output escaping. This makes it possible for authenticated attack= ers, with contributor-level access and above, to inject arbitrary web scrip=
ts in pages that will execute whenever a user accesses an injected page.</t=

<td>2026-08-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15950" target=3D= "_blank" rel=3D"noopener">CVE-2026-15950</a></td>
</tr>

<td class=3D"vendor-product">cozyvision1--SMS Alert SMS &amp; OTP for WooCo= mmerce, Order Notifications &amp; Abandoned Cart Recovery</td>
<td>The SMS Alert - SMS &amp; OTP for WooCommerce, Order Notifications &amp=
; Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based = SQL Injection via the 'orderby' parameter in all versions up to, and includ= ing, 3.9.7 due to insufficient escaping on the user supplied parameter and = lack of sufficient preparation on the existing SQL query. This makes it pos= sible for authenticated attackers, with administrator-level access and abov=
e, to append additional SQL queries into already existing queries that can =
be used to extract sensitive information from the database.</td> <td>2026-07-28</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15670" target=3D= "_blank" rel=3D"noopener">CVE-2026-15670</a></td>
</tr>

<td class=3D"vendor-product">cozyvision1--SMS Alert SMS &amp; OTP for WooCo= mmerce, Order Notifications &amp; Abandoned Cart Recovery</td>
<td>The SMS Alert - SMS &amp; OTP for WooCommerce, Order Notifications &amp=
; Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL=
Injection via the 'id' parameter in all versions up to, and including, 3.9=
.7 due to insufficient escaping on the user supplied parameter and lack of = sufficient preparation on the existing SQL query. This makes it possible fo=
r authenticated attackers, with administrator-level access and above, to ap= pend additional SQL queries into already existing queries that can be used =
to extract sensitive information from the database.</td>

<td>2026-07-28</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15671" target=3D= "_blank" rel=3D"noopener">CVE-2026-15671</a></td>
</tr>

<td class=3D"vendor-product">cozyvision1--SMS Alert SMS &amp; OTP for WooCo= mmerce, Order Notifications &amp; Abandoned Cart Recovery</td>
<td>The SMS Alert - SMS &amp; OTP for WooCommerce, Order Notifications &amp=
; Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL=
Injection via 'checkout_payment_plans' and 'order_status' Settings in all = versions up to, and including, 3.9.7 due to insufficient escaping on the us=
er supplied parameter and lack of sufficient preparation on the existing SQ=
L query. This makes it possible for authenticated attackers, with administr= ator-level access and above, to append additional SQL queries into already = existing queries that can be used to extract sensitive information from the=
database. This is a second-order SQL injection: the malicious payload is s= tored in the 'checkout_payment_plans' and 'order_status' settings via updat= e_option() and executed later when the cod_to_prepaid_cart_notification_sen= dsms_hook WP-Cron event fires SA_CodTOPrepaid::sendSms().</td> <td>2026-07-28</td>
<td>4.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15673" target=3D= "_blank" rel=3D"noopener">CVE-2026-15673</a></td>
</tr>

<td class=3D"vendor-product">Creativeitem--Ekushey Project Manager CRM</td> <td>Ekushey Project Manager CRM through version 5.0 contains a missing uniq= ueness constraint vulnerability that allows authenticated administrators to=
create duplicate client accounts with identical email and password credent= ials. Attackers can exploit the lack of email field uniqueness enforcement =
to create conflicting account states where multiple accounts share the same=
email address with different passwords, resulting in unpredictable authent= ication behavior and unauthorized account access.</td>
<td>2026-07-27</td>
<td>6.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66028" target=3D= "_blank" rel=3D"noopener">CVE-2026-66028</a></td>
</tr>

<td class=3D"vendor-product">Creativeitem--Ekushey Project Manager CRM</td> <td>Ekushey Project Manager CRM through version 5.0 contains a stored cross= -site scripting vulnerability that allows authenticated client users to inj= ect arbitrary HTML and JavaScript by entering malicious payloads into the c= lient Name field on the Edit Profile page without sanitization. Attackers c=
an craft and store malicious scripts that execute in the browser sessions o=
f Staff or Administrator users who view the Manage Clients or Manage Client=
Projects pages where client names are rendered unsanitized.</td> <td>2026-07-27</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66029" target=3D= "_blank" rel=3D"noopener">CVE-2026-66029</a></td>
</tr>

<td class=3D"vendor-product">Creativeitem--Ekushey Project Manager CRM</td> <td>Ekushey Project Manager CRM through version 5.0 ccontains a stored cros= s-site scripting vulnerability that allows authenticated client users to in= ject arbitrary HTML and JavaScript by entering malicious payloads into the = Ticket Title field on the Create New Ticket page. Attackers can craft and s= tore malicious scripts that execute in the browser sessions of Staff or Adm= inistrator users who view the Client Support page where ticket titles are r= endered unsanitized.</td>
<td>2026-07-27</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66030" target=3D= "_blank" rel=3D"noopener">CVE-2026-66030</a></td>
</tr>

<td class=3D"vendor-product">Creativeitem--Ekushey Project Manager CRM</td> <td>Ekushey Project Manager CRM through version 5.0 contains a stored cross= -site scripting vulnerability that allows authenticated client users to inj= ect arbitrary HTML and JavaScript by entering malicious payloads into the R= eply Ticket field. Attackers can craft and store malicious scripts that exe= cute in the browser sessions of Staff or Administrator users who view the S= upport Ticket detail page.</td>
<td>2026-07-27</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66031" target=3D= "_blank" rel=3D"noopener">CVE-2026-66031</a></td>
</tr>

<td class=3D"vendor-product">CSL Mobile Limited--CSL 1010 M2M 3G WiFi Modul= e</td>
<td>CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak en= cryption vulnerability that allows unauthenticated attackers to recover all=
stored secrets in plaintext by reversing a single-byte XOR cipher that use=
s a static key to obfuscate the configuration backup file. Attackers can tr= ivially decrypt the Router.cfg backup file to expose web administration and=
telnet passwords, WPA/WPA2 pre-shared keys, PPPoE and 3G/APN credentials, = and SIM identifiers including IMSI and IMEI.</td>
<td>2026-07-30</td>
<td>6.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67596" target=3D= "_blank" rel=3D"noopener">CVE-2026-67596</a></td>
</tr>

<td class=3D"vendor-product">cubewp1211--CubeWP Framework</td>
<td>The CubeWP Framework plugin for WordPress is vulnerable to SQL Injectio=
n in all versions up to and including 1.1.30. This is due to insufficient i= nput sanitization in the cubewp_remove_relation() AJAX function, specifical=
ly the use of wp_unslash() on the relation_id parameter before interpolatin=
g it directly into a raw SQL query without using $wpdb-&gt;prepare(). The w= p_unslash() call explicitly removes the backslash escaping that WordPress's=
wp_magic_quotes() adds to all $_POST data, neutralizing the only layer of = SQL injection protection. The sanitize_text_field() function applied afterw= ard offers no SQL protection. This makes it possible for authenticated atta= ckers, with subscriber-level access and above, to append additional SQL que= ries to the existing query.</td>
<td>2026-08-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-6453" target=3D"= _blank" rel=3D"noopener">CVE-2026-6453</a></td>
</tr>

<td class=3D"vendor-product">CyberTimon--RapidRAW</td>
<td>RapidRAW before 1.6.0 does not validate the lutPath field in preset fil=
es before passing it to File::open() in lut_processing.rs. On Windows, a UN=
C path in lutPath causes an outbound SMB connection to an attacker-controll=
ed host, leaking the victim's NTLMv2 credentials. The vulnerable code path =
is reachable through two vectors: community presets fetched automatically f= rom the remote preset repository when the victim opens the Community tab, a=
nd individual preset files imported directly by the victim via the preset i= mport feature (handle_import_presets_from_file in file_management.rs). The = second vector does not require control of the community preset repository a=
nd is triggered when a user imports a preset file shared through Discord, f= orums, or similar channels.</td>
<td>2026-07-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64816" target=3D= "_blank" rel=3D"noopener">CVE-2026-64816</a></td>
</tr>

<td class=3D"vendor-product">DaveGamble--cJSON</td>
<td>cJSON through 1.7.19 contains an inefficient algorithmic complexity fla=
w in cJSON_Compare(). When comparing objects, the function recurses into ea=
ch shared subtree twice, once in each direction, with no depth guard, makin=
g the running time exponential in nesting depth. A small, deeply nested doc= ument of a few hundred bytes (depth around 40) compared for equality consum=
es hours of CPU, and the cost roughly doubles with each additional level of=
nesting. An application that calls cJSON_Compare() on attacker-influenced = JSON that is structurally equal to a reference document is exposed to a den= ial-of-service condition.</td>
<td>2026-07-29</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67216" target=3D= "_blank" rel=3D"noopener">CVE-2026-67216</a></td>
</tr>

<td class=3D"vendor-product">DaveGamble--cJSON</td>
<td>cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomica= lly in apply_patch() in cJSON_Utils.c. For a replace operation that is miss= ing its value member, or a move operation whose destination path cannot be = resolved, the existing target member is detached and deleted before the ope= ration is fully validated, so the target document is mutated while cJSONUti= ls_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failu=
re status. An attacker who can supply the patch document can destroy addres= sable members of the target document even though the API reports that the p= atch failed, defeating the all-or-nothing behavior callers rely on to rejec=
t bad patches.</td>
<td>2026-07-29</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67217" target=3D= "_blank" rel=3D"noopener">CVE-2026-67217</a></td>
</tr>

<td class=3D"vendor-product">davejesch--Database Collation Fix</td>
<td>The Database Collation Fix plugin for WordPress is vulnerable to time-b= ased SQL Injection via the 'force-collation-algorithm' parameter in all ver= sions up to, and including, 1.2.10 due to insufficient escaping on the user=
supplied parameter and lack of sufficient preparation on the existing SQL = query. This makes it possible for unauthenticated attackers to append addit= ional SQL queries into already existing queries that can be used to extract=
sensitive information from the database. Exploitation requires a trigger.t=
xt file to be present in the plugin's directory (/wp-content/plugins/databa= se-collation-fix/trigger.txt), a condition created by DesktopServer integra= tion events such as site creation, copy, import, move, export, or deploy.</=

<td>2026-08-01</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15018" target=3D= "_blank" rel=3D"noopener">CVE-2026-15018</a></td>
</tr>

<td class=3D"vendor-product">decidim--decidim</td>
<td>Decidim is a participatory democracy framework. Prior to 0.30.9, from 0= .31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal downlo= ad_your_data flow requires the requester to be logged in as the export owne=
r, but the resulting Active Storage blob redirect URL can be replayed witho=
ut authentication by anyone who obtains it. This is because Decidim::Downlo= adYourDataController#download_file authenticates the export owner but redir= ects to a signed Active Storage blob URL that is no longer bound to the own=
er session. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.= </td>
<td>2026-07-31</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-45377" target=3D= "_blank" rel=3D"noopener">CVE-2026-45377</a></td>
</tr>

<td class=3D"vendor-product">decidim--decidim</td>
<td>Decidim is a participatory democracy framework. From 0.31.1 before 0.31=
.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /ad= min/demographics/questions/edit_questions and reach the demographics questi= onnaire editor without the required administrator authorization. The demogr= aphics questionnaire editor should require admin access, but the route unde=
r /admin/demographics/questions renders the editor interface without checki=
ng whether the caller is an admin. A normal participant can load the page a=
nd see the live update form action, which proves the protected interface is=
reachable. This issue is fixed in versions 0.31.5 and 0.32.0.rc2.</td> <td>2026-07-31</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-45086" target=3D= "_blank" rel=3D"noopener">CVE-2026-45086</a></td>
</tr>

<td class=3D"vendor-product">decidim--decidim</td>
<td>Decidim is a participatory democracy framework. Prior to 0.30.9, from 0= .31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/or= ganization/users search interpolates params[:term] into raw Arel.sql ORDER =
BY similarity expressions before sanitization, allowing an authenticated or= ganization administrator to execute blind PostgreSQL expressions and infer = data through timing differences. This issue is fixed in versions 0.30.9, 0.= 31.5, and 0.32.0.rc2.</td>
<td>2026-07-31</td>
<td>5.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-45376" target=3D= "_blank" rel=3D"noopener">CVE-2026-45376</a></td>
</tr>

<td class=3D"vendor-product">decidim--decidim</td>
<td>Decidim is a participatory democracy framework. Prior to 0.30.9, from 0= .31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-docu= ment verification admin controllers load pending Authorization records by r=
aw identifier without confirming current_organization ownership, allowing a=
n administrator from one tenant to view, approve, or reject another tenant'=
s ID-document request. This issue is fixed in versions 0.30.9, 0.31.5, and = 0.32.0.rc2.</td>
<td>2026-07-31</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-45330" target=3D= "_blank" rel=3D"noopener">CVE-2026-45330</a></td>
</tr>

<td class=3D"vendor-product">deveasel--Demi One Click Demo Import, Backup &= amp; Site Migration</td>
<td>The Demi - One Click Demo Import, WP Backup &amp; Site Migration plugin=
for WordPress is vulnerable to Arbitrary Directory Copy in all versions up=
to, and including, 0.0.8 via the handle_restore_step function. This is due=
to missing HTTP access controls on the wp-content/uploads/demi-backup-stat=
e/ directory, which exposes the cryptographic restore key used to both auth= enticate the unauthenticated AJAX handler and forge signed restore-state en= velopes. This makes it possible for unauthenticated attackers to copy arbit= rary files to attacker-controlled destinations on the server. An active res= tore operation must have been initiated, which writes the .restore_key and = .restore_step_token files to the public upload directory, before the expose=
d secrets can be harvested and chained to achieve unauthenticated arbitrary=
file copy.</td>
<td>2026-07-28</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15012" target=3D= "_blank" rel=3D"noopener">CVE-2026-15012</a></td>
</tr>

<td class=3D"vendor-product">devitemsllc--ShopLentor All-in-One WooCommerce=
Growth &amp; Store Enhancement Plugin</td>
<td>The ShopLentor - All-in-One WooCommerce Growth &amp; Store Enhancement = Plugin plugin for WordPress is vulnerable to Insecure Direct Object Referen=
ce in all versions up to, and including, 3.4.5 via the 'optionSection' para= meter due to missing validation on a user controlled key. This makes it pos= sible for authenticated attackers, with contributor-level access and above,=
to read arbitrary wp_options rows - including internal plugin news feed da= ta, WooCommerce block pattern transients, and third-party configuration rec= ords - whose values are stored as arrays-of-arrays containing 'title' keys,=
enabling cross-plugin data leakage.</td>
<td>2026-07-28</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16797" target=3D= "_blank" rel=3D"noopener">CVE-2026-16797</a></td>
</tr>

<td class=3D"vendor-product">devitemsllc--ShopLentor All-in-One WooCommerce=
Growth &amp; Store Enhancement Plugin</td>
<td>The ShopLentor - All-in-One WooCommerce Growth &amp; Store Enhancement = Plugin plugin for WordPress is vulnerable to time-based SQL Injection via t=
he 'orderby' parameter in all versions up to, and including, 3.4.5 due to i= nsufficient escaping on the user supplied parameter and lack of sufficient = preparation on the existing SQL query. This makes it possible for authentic= ated attackers, with administrator-level access and above, to append additi= onal SQL queries into already existing queries that can be used to extract = sensitive information from the database.</td>
<td>2026-07-28</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16811" target=3D= "_blank" rel=3D"noopener">CVE-2026-16811</a></td>
</tr>

<td class=3D"vendor-product">dfir-iris--iris-web</td>
<td>The IRIS web application in version 2.4.26 and possibly others does not=
protect its MFA validation against brute-force attacks.</td> <td>2026-07-30</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16971" target=3D= "_blank" rel=3D"noopener">CVE-2026-16971</a></td>
</tr>

<td class=3D"vendor-product">dfir-iris--iris-web</td>
<td>The IRIS web application in version 2.4.26 and possibly others does not=
protect its user authentication against brute-force attacks.</td> <td>2026-07-30</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18362" target=3D= "_blank" rel=3D"noopener">CVE-2026-18362</a></td>
</tr>

<td class=3D"vendor-product">dfir-iris--iris-web</td>
<td>The IRIS web application in version 2.4.26 and possibly others contains=
a logout functionality which is ineffective. Stolen session cookies can th= erefore be misused for a long time.</td>
<td>2026-07-30</td>
<td>4.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16970" target=3D= "_blank" rel=3D"noopener">CVE-2026-16970</a></td>
</tr>

<td class=3D"vendor-product">dotonpaper--Pinpoint Booking System Version 2<=

<td>The Pinpoint Booking System - Version 2 plugin for WordPress is vulnera= ble to blind SQL Injection via the 'field' parameter in all versions up to,=
and including, 2.9.9.6.9 due to insufficient escaping on the user supplied=
parameter and lack of sufficient preparation on the existing SQL query. Th=
is makes it possible for authenticated attackers, with administrator-level = access and above, to append additional SQL queries into already existing qu= eries that can be used to extract sensitive information from the database. = The nonce required to reach the vulnerable endpoint is emitted on all plugi=
n admin pages loaded under manage_options, making it trivially obtainable b=
y any authenticated administrator.</td>
<td>2026-08-01</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15403" target=3D= "_blank" rel=3D"noopener">CVE-2026-15403</a></td>
</tr>

<td class=3D"vendor-product">drakkan--SFTPGo</td>
<td>SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that a= llows authenticated users to circumvent per-directory access controls by cr= eating symbolic links in a permitted directory that point to files in direc= tories where download, upload, or overwrite permissions are denied. Attacke=
rs can exploit the create_symlinks permission combined with read and write = access in one directory to read or modify files in restricted directories, =
as operations are authorized against the link's directory permissions rathe=
r than the dereferenced target's directory permissions.</td> <td>2026-07-30</td>
<td>4.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10031" target=3D= "_blank" rel=3D"noopener">CVE-2026-10031</a></td>
</tr>

<td class=3D"vendor-product">edge22--GenerateBlocks</td>
<td>The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-S= ite Scripting via Dynamic Tag Injection in HTML Attributes in all versions =
up to, and including, 2.3.0 due to insufficient input sanitization and outp=
ut escaping. This makes it possible for authenticated attackers, with contr= ibutor-level access and above, to inject arbitrary web scripts in pages tha=
t will execute whenever a user accesses an injected page. A Contributor-lev=
el attacker can store the malicious payload by placing a dynamic tag such a=
s {{post_meta key:...}} in a non-URL HTML attribute (e.g., title, aria-labe=
l, alt, or data-* attributes) of a GenerateBlocks element block, then setti=
ng the corresponding unprotected post meta key via the Custom Fields metabo=
x to a value containing a closing quote and an injected event-handler attri= bute.</td>
<td>2026-08-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13458" target=3D= "_blank" rel=3D"noopener">CVE-2026-13458</a></td>
</tr>

<td class=3D"vendor-product">eLyiN--gemini-bridge</td>
<td>gemini-bridge is a lightweight MCP server bridging AI agents to Google'=
s Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_wi= th_files in inline mode read any file path supplied in the files argument w= ithout confining it to the working directory, then forwarded the contents t=
o the Gemini CLI. Because the caller also controls query, the file contents=
are echoed back through the Gemini round-trip (and sent to Google), making=
this an arbitrary local file read. This issue is fixed in version 1.3.1.</=

<td>2026-07-31</td>
<td>6.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54785" target=3D= "_blank" rel=3D"noopener">CVE-2026-54785</a></td>
</tr>

<td class=3D"vendor-product">facturadorvirtual--Facturacin Electrnica Costa=
Rica</td>
<td>The Facturaci=C3=83=C2=B3n Electr=C3=83=C2=B3nica Costa Rica plugin for=
WordPress is vulnerable to Cross-Site Request Forgery in all versions up t=
o, and including, 2.0.2. This is due to missing or incorrect nonce validati=
on on the (global scope, included by fvcr_admin_page_html) function. This m= akes it possible for unauthenticated attackers to modify the plugin's confi= guration, including API tokens, access tokens, economic activity, Hacienda = environment mode, invoice and ticket emission flags, exchange rate, and bra= nch settings via a forged request granted they can trick a site administrat=
or into performing an action such as clicking on a link.</td> <td>2026-07-29</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9720" target=3D"= _blank" rel=3D"noopener">CVE-2026-9720</a></td>
</tr>

<td class=3D"vendor-product">Flipper Code--WP Maps</td>
<td>Insertion of Sensitive Information Into Sent Data vulnerability in Flip= per Code WP Maps allows Retrieve Embedded Sensitive Data. This issue affect=
s WP Maps: from n/a through 4.9.6.</td>
<td>2026-07-31</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28144" target=3D= "_blank" rel=3D"noopener">CVE-2026-28144</a></td>
</tr>

<td class=3D"vendor-product">foomagoo--Plugin Organizer</td>
<td>The Plugin Organizer plugin for WordPress is vulnerable to SQL Injectio=
n via the 'PO_plugin_path' parameter in versions up to, and including, 10.2= .4. This is due to insufficient escaping on the user-supplied parameter in = the perform_plugin_search() function, where esc_sql() output is passed as t=
he replacement string to preg_replace(), which collapses backslash escapes = and defeats the quoting protection; additionally, the AJAX handler lacks bo=
th nonce verification and capability checks. This makes it possible for aut= henticated attackers, with subscriber-level access and above, to append add= itional SQL queries into already existing queries that can be used to extra=
ct sensitive information from the database.</td>
<td>2026-07-28</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15304" target=3D= "_blank" rel=3D"noopener">CVE-2026-15304</a></td>
</tr>

<td class=3D"vendor-product">Franky--Events Made Easy</td>
<td>Unauthenticated Broken Access Control in Events Made Easy &lt;=3D 3.1.3=
versions.</td>
<td>2026-07-27</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59557" target=3D= "_blank" rel=3D"noopener">CVE-2026-59557</a></td>
</tr>

<td class=3D"vendor-product">FreeRDP--FreeRDP</td>
<td>FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability i=
n the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). Th=
e client's Pong reply reuses a fixed 1024-byte response stream whose length=
is not sealed to the actual received Ping payload, so a malicious gateway/= WebSocket peer sending a non-empty Ping control frame causes the client to = reply with an overlong Pong that discloses bytes beyond the received payloa=
d (the peer receives the masking key and can unmask the reply). A zero-leng=
th Ping reaches an assertion and terminates the client (denial of service).= </td>
<td>2026-08-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67292" target=3D= "_blank" rel=3D"noopener">CVE-2026-67292</a></td>
</tr>

<td class=3D"vendor-product">FreeRDP--FreeRDP</td>
<td>FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR = paths in drive redirection, allowing attackers to access prefix-sibling pat=
hs outside the configured shared root. A malicious RDP server can read, wri= te, delete, and enumerate files in sibling directories by sending non-roote=
d paths that bypass the shared-root boundary check.</td>
<td>2026-08-01</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67295" target=3D= "_blank" rel=3D"noopener">CVE-2026-67295</a></td>
</tr>

<td class=3D"vendor-product">FreeRDP--FreeRDP</td>
<td>FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU)=
purpose of the peer certificate during client-side server TLS authenticati= on. In x509_utils_verify(), when server-purpose (X509_PURPOSE_SSL_SERVER) v= erification fails, the code falls back to client-purpose and any-purpose ve= rification, so a trusted, hostname-matching certificate valid only for clie= ntAuth can be accepted as the RDP server certificate. In environments relyi=
ng on EKU separation between client and server certificates, this allows a = clientAuth-only certificate issued by a trusted CA to bypass server certifi= cate purpose validation.</td>
<td>2026-08-01</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67294" target=3D= "_blank" rel=3D"noopener">CVE-2026-67294</a></td>
</tr>

<td class=3D"vendor-product">FreeRDP--FreeRDP</td>
<td>FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulne= rability in the RDP6 planar RLE bitmap decoder functions planar_decompress_= plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c=
. Only the 1-byte control byte is bounds-checked; the subsequent 0-15 attac= ker-declared raw bytes are read without validating that the source buffer c= ontains them. A malicious or compromised RDP server can send a truncated pl= anar-encoded bitmap or surface update (reachable via both the Bitmap Update=
PDU and RDPGFX Surface Command paths) that causes the client to read past = the end of the source buffer. The issue is fixed in FreeRDP 3.29.0.</td> <td>2026-08-01</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67306" target=3D= "_blank" rel=3D"noopener">CVE-2026-67306</a></td>
</tr>

<td class=3D"vendor-product">FreeRDP--FreeRDP</td>
<td>FreeRDP before 3.29.0 (affected versions &lt;=3D 3.28.0) contains an im= proper certificate hostname validation vulnerability. The TLS hostname matc= her (tls_match_hostname() in libfreerdp/crypto/tls.c) treats a wildcard pat= tern such as *.example.com as matching any hostname ending in .example.com,=
so it incorrectly accepts a wildcard certificate for multi-label subdomain=
s like a.b.example.com (which OpenSSL's X509_check_host() rejects). This we= akens TLS server authentication under wildcard-certificate conditions.</td> <td>2026-08-01</td>
<td>4.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67293" target=3D= "_blank" rel=3D"noopener">CVE-2026-67293</a></td>
</tr>

<td class=3D"vendor-product">FreeRDP--FreeRDP</td>
<td>FreeRDP before 3.29.0 (affected versions &lt;=3D 3.28.0) contains a div= ide-by-zero vulnerability in the rdpecam camera redirection client. ecam_de= v_process_start_streams_request() parses a server-controlled CAM_MEDIA_TYPE= _DESCRIPTION from a StartStreamsRequest PDU but validates only Format and F= lags, not FrameRateDenominator. When a malicious or compromised RDP server = sends a StartStreamsRequest with FrameRateDenominator set to zero, ecam_enc= oder_context_init() (channels/rdpecam/client/encoding.c) computes FrameRate= Numerator / FrameRateDenominator, causing an integer division by zero (SIGF= PE) and termination of the FreeRDP client process. Camera redirection must =
be enabled on the client for the channel to be reachable. Fixed in FreeRDP = 3.29.0.</td>
<td>2026-08-01</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67302" target=3D= "_blank" rel=3D"noopener">CVE-2026-67302</a></td>
</tr>

<td class=3D"vendor-product">FreeRDP--FreeRDP</td>
<td>FreeRDP before 3.29.0 contains a reachable assertion (WINPR_ASSERT(Outp= utBufferLength =3D=3D BytesReturned)) in serial_process_irp_device_control(=
) in channels/serial/client/serial_main.c. When serial device redirection i=
s enabled and a server-controlled IRP_MJ_DEVICE_CONTROL request specifies a=
n unsupported IOCTL with a non-zero OutputBufferLength, CommDeviceIoControl=
() can fail with BytesReturned =3D 0, causing the mismatch to trigger the a= ssertion and abort the client process (denial of service).</td> <td>2026-08-01</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67303" target=3D= "_blank" rel=3D"noopener">CVE-2026-67303</a></td>
</tr>

<td class=3D"vendor-product">fusewp--FuseWP WordPress User Sync to Email Li=
st &amp; Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign = etc.)</td>
<td>The FuseWP plugin for WordPress is vulnerable to Cross-Site Request For= gery in all versions up to, and including, 1.1.24.2. This is due to missing=
nonce verification on the toggle_sync_status() function. This makes it pos= sible for unauthenticated attackers to toggle the status of sync rules (ena= ble/disable) via a forged request granted they can trick a site administrat=
or into performing an action such as clicking on a link.</td>

<td>2026-07-30</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5582" target=3D"= _blank" rel=3D"noopener">CVE-2026-5582</a></td>
</tr>

<td class=3D"vendor-product">getgrav--grav</td>
<td>Grav Login Plugin versions before 3.8.13 contain an insufficient sessio=
n expiration vulnerability in TokenStorage.php where the findTriplet() meth=
od fails to properly validate Remember Me token timestamps. Attackers with =
a captured Remember Me cookie can authenticate indefinitely instead of the = configured timeout period, as the expiry check compares an array to a scala=
r value which always evaluates incorrectly in PHP.</td>
<td>2026-07-29</td>
<td>4.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66400" target=3D= "_blank" rel=3D"noopener">CVE-2026-66400</a></td>
</tr>

<td class=3D"vendor-product">ggml-org--llama.cpp</td>
<td>A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. Thi=
s affects the function _visit_pattern of the file common/json-schema-to-gra= mmar.cpp. The manipulation results in null pointer dereference. The attack = can be launched remotely. The pull request to fix this issue awaits accepta= nce.</td>
<td>2026-07-27</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17500" target=3D= "_blank" rel=3D"noopener">CVE-2026-17500</a></td>
</tr>

<td class=3D"vendor-product">ggml-org--llama.cpp</td>
<td>A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability=
affects the function transform of the file common/json-schema-to-grammar.c=
pp of the component JSON-Schema-to-GBNF Conversion. This manipulation cause=
s uncontrolled recursion. The attack may be initiated remotely. The pull re= quest to fix this issue awaits acceptance.</td>
<td>2026-07-27</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17501" target=3D= "_blank" rel=3D"noopener">CVE-2026-17501</a></td>
</tr>

<td class=3D"vendor-product">GitLab--GitLab</td>
<td>GitLab has remediated an issue in GitLab EE affecting all versions from=
17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under = certain conditions could have allowed an authenticated user to merge code i= nto a protected branch without the required approvals due to a race conditi=
on in approval rule processing.</td>
<td>2026-07-29</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13113" target=3D= "_blank" rel=3D"noopener">CVE-2026-13113</a></td>
</tr>

<td class=3D"vendor-product">GitLab--GitLab</td>
<td>GitLab has remediated an issue in GitLab EE affecting all versions from=
18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under = certain conditions could have allowed some sensitive information to be disc= losed to an unintended host due to improper handling of upstream requests i=
n virtual registries.</td>
<td>2026-07-29</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16553" target=3D= "_blank" rel=3D"noopener">CVE-2026-16553</a></td>
</tr>

<td class=3D"vendor-product">GitLab--GitLab</td>
<td>GitLab has remediated an issue in GitLab CE/EE affecting all versions f= rom 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that und=
er certain conditions could have allowed an unauthorized user to view proje=
ct import source information due to a missing authorization check.</td> <td>2026-07-29</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-6336" target=3D"= _blank" rel=3D"noopener">CVE-2026-6336</a></td>
</tr>

<td class=3D"vendor-product">GitLab--GitLab</td>
<td>GitLab has remediated an issue in GitLab CE/EE affecting all versions f= rom 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that und=
er certain conditions could have allowed an authenticated user with Maintai= ner role to modify protected branch configuration due to improper authoriza= tion in a projects API endpoint.</td>
<td>2026-07-29</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14341" target=3D= "_blank" rel=3D"noopener">CVE-2026-14341</a></td>
</tr>

<td class=3D"vendor-product">GitLab--GitLab</td>
<td>GitLab has remediated an issue in GitLab CE/EE affecting all versions f= rom 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that unde=
r certain conditions could have allowed an unauthenticated user to view the=
title of a confidential issue through a publicly accessible merge request = due to improper authorization checks.</td>
<td>2026-07-29</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14351" target=3D= "_blank" rel=3D"noopener">CVE-2026-14351</a></td>
</tr>

<td class=3D"vendor-product">GitLab--GitLab</td>
<td>GitLab has remediated an issue in GitLab EE affecting all versions from=
19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions co= uld have allowed an authenticated user to access information from unauthori= zed projects due to improper neutralization of untrusted content processed =
by the AI-assisted code review functionality.</td>
<td>2026-07-29</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15077" target=3D= "_blank" rel=3D"noopener">CVE-2026-15077</a></td>
</tr>

<td class=3D"vendor-product">GitLab--GitLab</td>
<td>GitLab has remediated an issue in GitLab EE affecting all versions from=
19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions co= uld have allowed an authenticated user to bypass administrator-configured t= ool governance policies due to improper authorization enforcement during to= ken generation.</td>
<td>2026-07-29</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15831" target=3D= "_blank" rel=3D"noopener">CVE-2026-15831</a></td>
</tr>

<td class=3D"vendor-product">GitLab--GitLab</td>
<td>GitLab has remediated an issue in GitLab CE/EE affecting all versions f= rom 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that und=
er certain conditions could have allowed an attacker to execute arbitrary J= avaScript in another user's browser via a crafted URL, due to improper sani= tization of user-controlled input.</td>
<td>2026-07-29</td>
<td>4.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-3093" target=3D"= _blank" rel=3D"noopener">CVE-2026-3093</a></td>
</tr>

<td class=3D"vendor-product">GitLab--GitLab</td>
<td>GitLab has remediated an issue in GitLab CE/EE affecting all versions f= rom 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that und=
er certain conditions could have allowed an authenticated user with guest-r= ole permissions to access test report contents they were not authorized to = view due to improper access control enforcement.</td>
<td>2026-07-29</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-4672" target=3D"= _blank" rel=3D"noopener">CVE-2026-4672</a></td>
</tr>

<td class=3D"vendor-product">Gladinet--CentreStack</td>
<td>CentreStack before 17.4 contains a session variable injection vulnerabi= lity that allows unauthenticated attackers to inject arbitrary session vari= ables by embedding newline and tab characters into a crafted AccountName pa= rameter posted to the SelectProvider.aspx endpoint. Attackers can exploit t=
he lack of input sanitization in the custom session serialization format to=
inject a resellerid session variable, bypassing the IsValidRSession authen= tication check and gaining unauthorized access to management pages.</td> <td>2026-07-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54364" target=3D= "_blank" rel=3D"noopener">CVE-2026-54364</a></td>
</tr>

<td class=3D"vendor-product">GNOME--GIMP</td>
<td>A flaw was found in the file-sgi plugin in GIMP. When processing an RLE= -compressed SGI image, the plugin allocates memory for a row table. The ima=
ge header dimensions (ysize and zsize) are read as 16-bit unsigned integers=
. If a crafted file sets both dimensions to their maximum value (65535), th=
e multiplication ysize * zsize overflows the standard 32-bit int boundary b= efore being passed to calloc. This integer overflow issue results in undefi= ned behavior, aborting the plugin and causing a denial of service.</td> <td>2026-07-27</td>
<td>5.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66757" target=3D= "_blank" rel=3D"noopener">CVE-2026-66757</a></td>
</tr>

<td class=3D"vendor-product">go-vikunja--vikunja</td>
<td>Vikunja versions &gt;=3D 0.24.0 and &lt;=3D 2.3.0 contain a broken obje=
ct level authorization (BOLA) vulnerability in the task-collection endpoint=
(GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads th=
e requested project view from the URL path without verifying the caller is = authorized for it. For a link-share token holder, the task scope is pinned =
to the share's own project, but the view is taken from the attacker-control= led path and never re-validated. As a result, a holder of any project share=
link can read any other tenant's kanban bucket records - bucket titles and=
the full created_by user object (username, name, id) - for every view in t=
he instance. The same missing pre-authorization view load also creates a pr= oject/view-ID existence oracle (404 vs. non-404) usable by link shares and = ordinary authenticated users. Task contents remain constrained to the share=
's own project and are not disclosed. Fixed in 2.4.0.</td>
<td>2026-08-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-68582" target=3D= "_blank" rel=3D"noopener">CVE-2026-68582</a></td>
</tr>

<td class=3D"vendor-product">goshs-labs--goshs</td>
<td>goshs is a feature-rich single-binary file server for red teamers and d= evelopers. Prior to 2.1.5, the httpserver/updown.go multipart upload handle=
r split part.FileName() on / but did not reject .., allowing an unauthentic= ated upload with filename .. to create a file outside the served tree. This=
issue is fixed in version 2.1.5.</td>
<td>2026-07-28</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66063" target=3D= "_blank" rel=3D"noopener">CVE-2026-66063</a></td>
</tr>

<td class=3D"vendor-product">goshs-labs--goshs</td>
<td>goshs is a feature-rich single-binary file server for red teamers and d= evelopers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opene=
d files using a cleaned path but derived the authorization filename from ra=
w req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection=
and block-list checks. This issue is fixed in version 2.1.5.</td> <td>2026-07-28</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66064" target=3D= "_blank" rel=3D"noopener">CVE-2026-66064</a></td>
</tr>

<td class=3D"vendor-product">guzzle--guzzle</td>
<td>guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy= -Authorization headers from origin servers in cURL handlers. Attackers can = capture proxy credentials through origin server access logs when requests a=
re redirected, bypassed, or sent through SOCKS proxies that Guzzle misclass= ifies as direct connections.</td>
<td>2026-08-01</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67339" target=3D= "_blank" rel=3D"noopener">CVE-2026-67339</a></td>
</tr>

<td class=3D"vendor-product">guzzle--guzzle</td>
<td>guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vu= lnerability in the CookieJar that accepts unlimited Set-Cookie header field=
s with no size restrictions. Attackers can return many large cookies from a=
malicious server, causing Guzzle to store excessive data in memory and gen= erate oversized Cookie headers that fail in handlers or destination servers= .</td>
<td>2026-08-01</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67353" target=3D= "_blank" rel=3D"noopener">CVE-2026-67353</a></td>
</tr>

<td class=3D"vendor-product">guzzle--guzzle</td>
<td>guzzlehttp/guzzle versions before 7.15.1 contain an information disclos= ure vulnerability in RedirectMiddleware. When the optional allow_redirects.= referer setting is enabled, the middleware copies the URI fragment (the por= tion after '#') from the referring request into the generated Referer heade=
r when following a same-scheme redirect (e.g., HTTPS to HTTPS). An attacker=
who controls the redirect destination can read this fragment from the inco= ming Referer header, potentially disclosing one-time login secrets, access = tokens, state values, or other sensitive client data to a server never mean=
t to receive it. The referer setting is disabled by default. Fixed in 7.15.=
1, which strips the fragment before generating the Referer value.</td> <td>2026-08-01</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67354" target=3D= "_blank" rel=3D"noopener">CVE-2026-67354</a></td>
</tr>

<td class=3D"vendor-product">guzzle--guzzle</td>
<td>guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only coo= kie scope, storing the request host in the Domain field instead of marking = cookies as host-only. Attackers controlling child hosts can receive host-on=
ly cookies intended only for parent hosts, potentially disclosing session i= dentifiers and authorization tokens when the same cookie jar is reused acro=
ss trust boundaries.</td>
<td>2026-08-01</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67355" target=3D= "_blank" rel=3D"noopener">CVE-2026-67355</a></td>
</tr>

<td class=3D"vendor-product">HCL Software--HCL iControl</td>
<td>HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabi= lities. It involves the public exposure of internal configuration files due=
to improper web server or application hardening.</td>
<td>2026-07-31</td>
<td>5.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56567" target=3D= "_blank" rel=3D"noopener">CVE-2026-56567</a></td>
</tr>

<td class=3D"vendor-product">HCL Software--HCL iControl</td>
<td>HCL iControl was affected by Sensitive Data Exposure vulnerabilities. I=
t involves the public exposure of internal configuration files due to impro= per web server or application hardening.</td>
<td>2026-07-31</td>
<td>4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56569" target=3D= "_blank" rel=3D"noopener">CVE-2026-56569</a></td>
</tr>

<td class=3D"vendor-product">HCL--HCL iControl</td>
<td>HCL iControl was affected by Improper Input Validation vulnerability. I=
t is vulnerable to unexpected system behavior and potential security bypass= es. This was caused by an implementation flaw in an architectural security = tactic that fails to properly validate whether the received input matches t=
he expected type.</td>
<td>2026-07-31</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-62347" target=3D= "_blank" rel=3D"noopener">CVE-2025-62347</a></td>
</tr>

<td class=3D"vendor-product">hfiref0x--LightFTP</td>
<td>LightFTP 2.3.1 contains a race condition vulnerability that allows remo=
te attackers to crash the server by racing a fresh connection that reuses t=
he FTP context against an in-progress ABRT cleanup. Attackers can exploit t=
he unprotected re-check of WorkerThreadId between worker_thread_cleanup() a=
nd pthread_join() outside of MTLock to cause pthread_join() to operate on a=
n invalid thread ID, resulting in a server crash. CVE-2024-11144 identifies=
an incomplete fix of this vulnerability.</td>
<td>2026-07-31</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67607" target=3D= "_blank" rel=3D"noopener">CVE-2026-67607</a></td>
</tr>

<td class=3D"vendor-product">HT Plugins--Insert Headers and Footers Code HT=
Script</td>
<td>Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and=
Footers Code - HT Script &lt;=3D 1.1.8 versions.</td>
<td>2026-07-27</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66474" target=3D= "_blank" rel=3D"noopener">CVE-2026-66474</a></td>
</tr>

<td class=3D"vendor-product">IBM--DataPower Gateway 10.6CD</td>
<td>IBM DataPower Gateway is vulnerable to an XML external entity injection=
(XXE) attack when processing XML data. A privileged user could exploit thi=
s vulnerability to expose sensitive information or consume memory resources= .</td>
<td>2026-07-30</td>
<td>5.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-36374" target=3D= "_blank" rel=3D"noopener">CVE-2025-36374</a></td>
</tr>

<td class=3D"vendor-product">IBM--Db2</td>
<td>IBM Db2 12.1.0 through 12.1.4 federated server is vulnerable to a denia=
l of service when running non fenced federated queries.</td> <td>2026-07-30</td>
<td>6.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10695" target=3D= "_blank" rel=3D"noopener">CVE-2026-10695</a></td>
</tr>

<td class=3D"vendor-product">IBM--Engineering Requirements Management DOORS=
and DOORS Web Access</td>
<td>IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.= 2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-s= ite scripting. This vulnerability allows an unauthenticated attacker to emb=
ed arbitrary JavaScript code in the Web UI thus altering the intended funct= ionality potentially leading to credentials disclosure within a trusted ses= sion.</td>
<td>2026-07-30</td>
<td>6.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-0152" target=3D"= _blank" rel=3D"noopener">CVE-2025-0152</a></td>
</tr>

<td class=3D"vendor-product">IBM--Langflow OSS</td>
<td>IBM Langflow OSS 1.0.0 through 1.8.4 contains multiple broken access co= ntrol vulnerabilities in its file handling API that allow unauthorized acce=
ss to user files.The /api/v1/files/images/{flow_id}/{file_name} endpoint do=
es not enforce authentication or authorization checks, allowing unauthentic= ated remote attackers to retrieve image files associated with any flow by s= pecifying a valid flow_id and file_name.Additionally, the /api/v1/files/dow= nload/{flow_id}/{file_name} endpoint requires authentication but fails to p= roperly validate ownership of the requested resource. As a result, an authe= nticated user can access files belonging to other users by supplying arbitr= ary identifiers, leading to an authorization bypass (IDOR).Successful explo= itation may result in unauthorized disclosure of sensitive data, including = files stored in private flows. This issue breaks tenant isolation in multi-= user deployments.</td>
<td>2026-07-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10700" target=3D= "_blank" rel=3D"noopener">CVE-2026-10700</a></td>
</tr>

<td class=3D"vendor-product">IBM--OPENBMC</td>
<td>IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.7=
1 allows ReadOnly users to escalate privileges and give themselves administ= rator privileges.</td>
<td>2026-07-28</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7868" target=3D"= _blank" rel=3D"noopener">CVE-2026-7868</a></td>
</tr>

<td class=3D"vendor-product">IBM--OPENBMC</td>
<td>IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.7=
1 allows a user to supply a password with a resource dump request stores th=
at password into the BMC audit log where an admin user can see it.</td> <td>2026-07-28</td>
<td>4.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8058" target=3D"= _blank" rel=3D"noopener">CVE-2026-8058</a></td>
</tr>

<td class=3D"vendor-product">IBM--Operations Analytics - Log Analysis</td> <td>IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.= 5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3= .8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance = which could allow an authenticated user to impersonate another user on the = system.</td>
<td>2026-07-30</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2024-40683" target=3D= "_blank" rel=3D"noopener">CVE-2024-40683</a></td>
</tr>

<td class=3D"vendor-product">IBM--PowerVM Hypervisor</td>
<td>IBM PowerVM Hypervisor FW1110.00 through FW1110.20, and FW1060.00 throu=
gh FW1060.71 could allow an attacker with physical access to the Transparen=
t Memory Encryption (TME) hardware to decrypt encrypted memory due to insuf= ficient cryptographic entropy.</td>
<td>2026-07-28</td>
<td>4.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-4932" target=3D"= _blank" rel=3D"noopener">CVE-2026-4932</a></td>
</tr>

<td class=3D"vendor-product">IBM--Sterling B2B Integrator</td>
<td>IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through = 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM=
Sterling File Gateway 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2=
, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 Ebics server com= ponent is vulnerable to cross-site scripting. This vulnerability allows an = authenticated user to embed arbitrary JavaScript code in the Web UI thus al= tering the intended functionality potentially leading to credentials disclo= sure within a trusted session.</td>
<td>2026-07-30</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-36298" target=3D= "_blank" rel=3D"noopener">CVE-2025-36298</a></td>
</tr>

<td class=3D"vendor-product">IBM--Sterling B2B Integrator</td>
<td>IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.0_1 and IBM Sterling = File Gateway 6.2.2.0 through 6.2.2.0_1 is vulnerable to cross-site scriptin=
g. This vulnerability allows an authenticated user to embed arbitrary JavaS= cript code in the Web UI thus altering the intended functionality potential=
ly leading to credentials disclosure within a trusted session.</td> <td>2026-07-30</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-36431" target=3D= "_blank" rel=3D"noopener">CVE-2025-36431</a></td>
</tr>

<td class=3D"vendor-product">IBM--Sterling B2B Integrator</td>
<td>IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.= 2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.=
0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1=
is vulnerable to=C2=A0stored=C2=A0cross-site=C2=A0scripting. This vulnerab= ility allows a privileged user=C2=A0to embed arbitrary JavaScript=C2=A0code= =C2=A0in the Web UI=C2=A0thus altering the=C2=A0intended functionality pote= ntially leading to credentials disclosure within a trusted session.</td> <td>2026-07-28</td>
<td>5.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7775" target=3D"= _blank" rel=3D"noopener">CVE-2026-7775</a></td>
</tr>

<td class=3D"vendor-product">IBM--Sterling B2B Integrator</td>
<td>IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through = 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.= 0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2= .0_1 stores potentially sensitive information in log files that could be re=
ad by a privileged user.</td>
<td>2026-07-28</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-1918" target=3D"= _blank" rel=3D"noopener">CVE-2026-1918</a></td>
</tr>

<td class=3D"vendor-product">IBM--Sterling B2B Integrator</td>
<td>IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through = 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.= 0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2= .0_1 is vulnerable to an information disclosure due to sensitive informatio=
n being included in the source code comments of a mailbox component.</td> <td>2026-07-28</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-3157" target=3D"= _blank" rel=3D"noopener">CVE-2026-3157</a></td>
</tr>

<td class=3D"vendor-product">IBM--Sterling B2B Integrator</td>
<td>IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through = 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.= 0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2= .0_1 is vulnerable to an information disclosure due to sensitive informatio=
n being included in the source code comments of a dashboard component.</td> <td>2026-07-28</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-3158" target=3D"= _blank" rel=3D"noopener">CVE-2026-3158</a></td>
</tr>

<td class=3D"vendor-product">IBM--Sterling B2B Integrator</td>
<td>IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 thro= ugh 6.2.2.0_1 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.1_2, and = 6.2.2.0 through 6.2.2.0_1 could allow an authenticated user to obtain sensi= tive information that should only be available to a privileged user.</td> <td>2026-07-28</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7362" target=3D"= _blank" rel=3D"noopener">CVE-2026-7362</a></td>
</tr>

<td class=3D"vendor-product">IBM--Tivoli System Automation Application Mana= ger</td>
<td>IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere = Application Server is affected by cross-site scripting in the Administrativ=
e Console.</td>
<td>2026-07-30</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11383" target=3D= "_blank" rel=3D"noopener">CVE-2026-11383</a></td>
</tr>

<td class=3D"vendor-product">IBM--TS4500 CLI tool</td>
<td>IBM TS4500 CLI tool Versions:=C2=A0 0.1.31 through 1.12.0.0 does not va= lidate or improperly validates TLS certificate validation, which could allo= w=C2=A0an attacker to obtain sensitive information using man in the middle = techniques.</td>
<td>2026-07-28</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16107" target=3D= "_blank" rel=3D"noopener">CVE-2026-16107</a></td>
</tr>

<td class=3D"vendor-product">IBM--UCD - IBM UrbanCode Deploy</td>
<td>IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.= 3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.= 1.2.6, and 8.2 through 8.2.1.0 is susceptible to an Exposure of Sensitive I= nformation Vulnerability in plugin output logs. This exposure could allow a=
n attacker with access to the logs to potentially obtain senstive values re= lated to that step.</td>
<td>2026-07-30</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10569" target=3D= "_blank" rel=3D"noopener">CVE-2026-10569</a></td>
</tr>

<td class=3D"vendor-product">IBM--Verify Identity Access</td>
<td>IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify = Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 = through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9=
.1 could allow a remote attacker to obtain sensitive information when a det= ailed technical error message is returned in the browser. This information = could be used in further attacks against the system.</td>
<td>2026-07-30</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11904" target=3D= "_blank" rel=3D"noopener">CVE-2026-11904</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server</td>
<td>IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a=
remote attacker to conduct a cross-site scripting attack.</td> <td>2026-07-28</td>
<td>6.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14515" target=3D= "_blank" rel=3D"noopener">CVE-2026-14515</a></td>
</tr>

<td class=3D"vendor-product">icegram--Icegram Engage Popups, Optins, CTAs &= amp; Lead Generation</td>
<td>The Icegram Engage - Popups, Optins, CTAs &amp; Lead Generation plugin = for WordPress is vulnerable to second-order SQL Injection via 'messages[][i= d]' Parameter in all versions up to, and including, 3.1.42 due to insuffici= ent escaping on the user supplied parameter and lack of sufficient preparat= ion on the existing SQL query. This makes it possible for authenticated att= ackers, with contributor-level access and above, to append additional SQL q= ueries into already existing queries that can be used to extract sensitive = information from the database. The injection is second-order: the malicious=
id value is first persisted to post meta via the save_campaign_preview() A= JAX action (gated by a nonce check and edit_post capability, requiring Edit= or-level access or above), and only executed as SQL when a subsequent previ=
ew request triggers get_message_data() to interpolate the stored value dire= ctly into a SQL IN() clause without $wpdb-&gt;prepare() or integer casting.= </td>
<td>2026-08-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16087" target=3D= "_blank" rel=3D"noopener">CVE-2026-16087</a></td>
</tr>

<td class=3D"vendor-product">icegram--Icegram Mailer Reliable Email Deliver= ability, No-code SMTP Replacement &amp; Email logs</td>
<td>The Icegram Mailer plugin for WordPress is vulnerable to SQL Injection = via the 'fields' parameter in versions up to, and including, 1.0.12. This i=
s due to insufficient escaping on the user supplied parameter and lack of s= ufficient preparation on the existing SQL query in the Icegram_Mailer_Logs_= Table::get_logs() function, where each element of the `fields` array receiv=
ed from $_REQUEST['data'] is joined verbatim into the SELECT clause via imp= lode() with no whitelist, escaping, or prepared-statement placeholder. This=
makes it possible for authenticated attackers, with Administrator-level ac= cess and above, to append additional SQL queries into already existing quer= ies that can be used to extract sensitive information from the database.</t=

<td>2026-08-01</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15951" target=3D= "_blank" rel=3D"noopener">CVE-2026-15951</a></td>
</tr>

<td class=3D"vendor-product">igloohome--Smart Lock Mobile Application</td> <td>In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusi=
on of Sensitive Information in Source Code vulnerability could allow an una= uthorized actor to access functions or backend services that were not suffi= ciently protected by authentication controls.</td>
<td>2026-07-28</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16581" target=3D= "_blank" rel=3D"noopener">CVE-2026-16581</a></td>
</tr>

<td class=3D"vendor-product">ImageMagick--ImageMagick</td>
<td>ImageMagick is free and open-source software used for editing and manip= ulating digital images. In versions prior to 7.1.2-27, a heap buffer over-w= rite can occur in the fx operation by passing a crafted argument. This issu=
e has been fixed in version 7.1.2-27.</td>
<td>2026-07-30</td>
<td>5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62363" target=3D= "_blank" rel=3D"noopener">CVE-2026-62363</a></td>
</tr>

<td class=3D"vendor-product">ImageMagick--ImageMagick</td>
<td>ImageMagick is free and open-source software used for editing and manip= ulating digital images. In versions prior to both 6.9.13-52 and 7.1.2-27, p= rocessing an extremely large JNX file on 32-bit platforms can cause an inte= ger overflow, leading to a heap buffer over-write. This issue has been fixe=
d in versions 6.9.13-52 and 7.1.2-27.</td>
<td>2026-07-30</td>
<td>5.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62946" target=3D= "_blank" rel=3D"noopener">CVE-2026-62946</a></td>
</tr>

<td class=3D"vendor-product">ImageMagick--ImageMagick</td>
<td>ImageMagick is free and open-source software used for editing and manip= ulating digital images. In versions prior to 7.1.2-27, the BGR decoder does=
not check for an end-of-file in every location so a crafted image could re= sult in an heap buffer over-read. This issue has been fixed in version 7.1.= 2-27.</td>
<td>2026-07-29</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64685" target=3D= "_blank" rel=3D"noopener">CVE-2026-64685</a></td>
</tr>

<td class=3D"vendor-product">ImageMagick--ImageMagick</td>
<td>ImageMagick is free and open-source software used for editing and manip= ulating digital images. In versions prior to 6.9.13-51 and 7.0.1-0 and abov=
e prior to 7.1.2-26, an invalid kernel can cause a heap buffer over-write w= hen performing a morphology operation with a user supplied kernel. This iss=
ue has been fixed in versions 6.9.13-51 and 7.1.2-26.</td>
<td>2026-07-29</td>
<td>4.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62343" target=3D= "_blank" rel=3D"noopener">CVE-2026-62343</a></td>
</tr>

<td class=3D"vendor-product">inspirythemes--RealHomes Memberships</td>

<td>The RealHomes Memberships plugin for WordPress is vulnerable to authori= zation bypass in all versions up to, and including, 3.0.9. This is due to t=
he plugin not properly verifying that a user is authorized to perform an ac= tion. This makes it possible for authenticated attackers, with subscriber-l= evel access and above, to grant themselves any premium membership tier with= out completing a PayPal transaction, generating a falsified active payment = receipt and gaining unauthorized access to restricted property listing allo= wances.</td>
<td>2026-08-01</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10782" target=3D= "_blank" rel=3D"noopener">CVE-2026-10782</a></td>
</tr>

<td class=3D"vendor-product">iSaumya--Ad Invalid Click Protector (AICP)</td=

<td>Unauthenticated Broken Access Control in Ad Invalid Click Protector (AI= CP) &lt;=3D 1.3.0 versions.</td>
<td>2026-07-27</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65445" target=3D= "_blank" rel=3D"noopener">CVE-2026-65445</a></td>
</tr>

<td class=3D"vendor-product">itpathsolutions--Contact Form to Any API</td> <td>The Contact Form to Any API plugin for WordPress is vulnerable to Store=
d Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta in all versions=
up to, and including, 3.0.6 due to insufficient input sanitization and out= put escaping. This makes it possible for authenticated attackers, with cont= ributor-level access and above, to inject arbitrary web scripts in pages th=
at will execute whenever a user accesses an injected page.</td> <td>2026-07-29</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15735" target=3D= "_blank" rel=3D"noopener">CVE-2026-15735</a></td>
</tr>

<td class=3D"vendor-product">jegtheme--Jeg Kit for Elementor Powerful Addon=
s for Elementor, Widgets &amp; Templates for WordPress</td>
<td>The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensiti=
ve Information Exposure in all versions up to, and including, 3.1.1 via the=
`enqueue_scripts()` method in `class/dashboard/class-dashboard.php`. The p= lugin injects a `JkitDashboardOption` JavaScript object containing full plu= gin inventory (names, versions, paths, active status), system environment d= etails (WordPress version, PHP version, site URLs, server capabilities), an=
d potentially third-party API credentials (Mailchimp API key via `jkit_user= _data`) as an inline script on the `post.php` admin page. Because this data=
is output without any capability check beyond post editing access, any aut= henticated user with Contributor-level access or above can view this sensit= ive configuration data by inspecting the page source. This makes it possibl=
e for authenticated attackers, with Contributor-level access and above, to = extract sensitive site configuration data, installed plugin details, and po= tentially third-party API keys.</td>
<td>2026-08-01</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-2916" target=3D"= _blank" rel=3D"noopener">CVE-2026-2916</a></td>
</tr>

<td class=3D"vendor-product">jfrog--artifactory</td>
<td>Improper URL validation when handling specific URLs, allows an attacker=
, under certain conditions, to make unauthorized requests from JFrog Artifa= ctory, potentially exposing internal services and cached response data.</td=

<td>2026-07-27</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65618" target=3D= "_blank" rel=3D"noopener">CVE-2026-65618</a></td>
</tr>

<td class=3D"vendor-product">jfrog--artifactory</td>
<td>A URL validation weakness in JFrog Artifactory Ansible repository handl= ing could allow a user, under specific repository access conditions, to cau=
se unintended server-side requests. The issue primarily affects confidentia= lity and integrity and has been addressed in fixed Artifactory versions.</t=

<td>2026-07-27</td>
<td>6.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65923" target=3D= "_blank" rel=3D"noopener">CVE-2026-65923</a></td>
</tr>

<td class=3D"vendor-product">jfrog--artifactory</td>
<td>JFrog Artifactory support for Terraform remote repositories was found t=
o be susceptible to Server-Side Request Forgery (SSRF). An authenticated us=
er - or, if anonymous access is enabled on the repository, an unauthenticat=
ed user - could cause Artifactory to issue outbound HTTP requests to arbitr= ary destinations and receive the response content.</td>
<td>2026-07-27</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65924" target=3D= "_blank" rel=3D"noopener">CVE-2026-65924</a></td>
</tr>

<td class=3D"vendor-product">jfrog--artifactory</td>
<td>A user with JFrog Artifactory Cargo remote repository read access could=
make Artifactory request unintended URLs and return the response.</td> <td>2026-07-27</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65925" target=3D= "_blank" rel=3D"noopener">CVE-2026-65925</a></td>
</tr>

<td class=3D"vendor-product">jfrog--artifactory</td>
<td>Build readers can access another repository's environment properties. A=
caller with read access to an ordinary repository can select a readable re= pository parameter while retrieving environment properties for a protected = build, exposing build environment secrets (confidentiality impact; no integ= rity or availability impact demonstrated).</td>
<td>2026-07-27</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66018" target=3D= "_blank" rel=3D"noopener">CVE-2026-66018</a></td>
</tr>

<td class=3D"vendor-product">jgwhite33--WP Google Review Slider</td> <td>Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review S= lider &lt;=3D 18.4 versions.</td>
<td>2026-07-27</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66428" target=3D= "_blank" rel=3D"noopener">CVE-2026-66428</a></td>
</tr>

<td class=3D"vendor-product">juev--nebula-mesh</td>
<td>nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtua=
l private network. Prior to version 0.3.2, newly-minted operator API key ex= posed in redirect URL (Referer, history, proxy logs). This issue has been p= atched in version 0.3.2.</td>
<td>2026-07-28</td>
<td>5.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-47768" target=3D= "_blank" rel=3D"noopener">CVE-2026-47768</a></td>
</tr>

<td class=3D"vendor-product">jupyterlab--jupyterlab</td>
<td>JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerab= ility in the Extension Manager that fails to validate URI protocols in pack= age metadata URLs. Attackers can publish malicious PyPI packages with javas= cript: URLs in project metadata that execute arbitrary JavaScript in the Ju= pyterLab origin when users click the extension name.</td>
<td>2026-08-01</td>
<td>6.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67338" target=3D= "_blank" rel=3D"noopener">CVE-2026-67338</a></td>
</tr>

<td class=3D"vendor-product">klubraum--Klubraum Membership Request</td>

<td>The Klubraum Membership Request plugin for WordPress is vulnerable to u= nauthorized modification of data due to a missing capability check on the `= kr_mr_store_settings()` function in all versions up to, and including, 1.1.=
0. This makes it possible for unauthenticated attackers to update the plugi= n's settings, including the Klubraum API token and introduction text, effec= tively hijacking the plugin's integration with the Klubraum service.</td> <td>2026-07-29</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-4604" target=3D"= _blank" rel=3D"noopener">CVE-2026-4604</a></td>
</tr>

<td class=3D"vendor-product">labelblanc--Improved Save Button</td>
<td>The Improved Save Button plugin for WordPress is vulnerable to second-o= rder SQL Injection via 'meta_key' Custom Field via 'Save and Duplicate' Act= ion in all versions up to, and including, 1.2.1 due to insufficient escapin=
g on the user supplied parameter and lack of sufficient preparation on the = existing SQL query. This makes it possible for authenticated attackers, wit=
h author-level access and above, to append additional SQL queries into alre= ady existing queries that can be used to extract sensitive information from=
the database.</td>
<td>2026-07-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16092" target=3D= "_blank" rel=3D"noopener">CVE-2026-16092</a></td>
</tr>

<td class=3D"vendor-product">Leantime--Leantime</td>
<td>Leantime 3.6.2 and prior contains a broken access control vulnerability=
that allows authenticated users to read milestone data from projects they = are not assigned to by supplying arbitrary integer milestone IDs to the tic= kets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milest= one IDs through the JSON-RPC API to access project planning information, mi= lestone titles, descriptions, and timelines across all projects on the inst= ance regardless of project membership.</td>
<td>2026-07-27</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66412" target=3D= "_blank" rel=3D"noopener">CVE-2026-66412</a></td>
</tr>

<td class=3D"vendor-product">Leantime--Leantime</td>
<td>Leantime 3.6.2 contains an open redirect vulnerability in the Login con= troller that allows unauthenticated attackers to redirect authenticated use=
rs to arbitrary external sites by manipulating the redirectUrl POST paramet= er. Attackers can craft a malicious login URL with a tampered redirectUrl v= alue that bypasses FILTER_SANITIZE_URL validation to redirect victims to at= tacker-controlled sites for phishing or credential theft.</td>

<td>2026-07-30</td>
<td>6.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66414" target=3D= "_blank" rel=3D"noopener">CVE-2026-66414</a></td>
</tr>

<td class=3D"vendor-product">lrnz--Shortcodify</td>
<td>The Shortcodify plugin for WordPress is vulnerable to Stored Cross-Site=
Scripting via 'name' Shortcode Attribute in all versions up to, and includ= ing, 1.4.3 due to insufficient input sanitization and output escaping. This=
makes it possible for authenticated attackers, with contributor-level acce=
ss and above, to inject arbitrary web scripts in pages that will execute wh= enever a user accesses an injected page.</td>
<td>2026-07-28</td>
<td>5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11598" target=3D= "_blank" rel=3D"noopener">CVE-2026-11598</a></td>
</tr>

<td class=3D"vendor-product">magepeopleteam--Event Booking Manager for WooC= ommerce Sell Tickets, Event Registration, RSVP &amp; Event Calendar</td> <td>The Event Booking Manager for WooCommerce - Sell Tickets, Event Registr= ation, RSVP &amp; Event Calendar plugin for WordPress is vulnerable to auth= orization bypass in all versions up to, and including, 5.3.7. This is due t=
o the plugin not properly verifying that a user is authorized to perform an=
action. This makes it possible for authenticated attackers, with contribut= or-level access and above, to modify site-wide payment settings - including=
WooCommerce payment enablement, cart redirect behavior, login requirements=
for checkout, confirmation page ID, and confirmed ticket statuses - that g= overn how all event bookings are processed.</td>
<td>2026-07-29</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17166" target=3D= "_blank" rel=3D"noopener">CVE-2026-17166</a></td>
</tr>

<td class=3D"vendor-product">mailerpress--MailerPress Newsletter, email mar= keting &amp; AI automation</td>
<td>The MailPress plugin for WordPress is vulnerable to unauthorized access=
in versions up to, and including, 1.5.0 via the campaign revision-restore = REST endpoint (POST /wp-json/mailpress/v1/campaign/&lt;id&gt;/restore-revis= ion/&lt;revision_id&gt;). The route in the vulnerable range was registered = without a permissionCallback, allowing the restoreRevision() handler to run=
for unauthenticated requests and overwrite a campaign's content_html with = any prior revision. This makes it possible for unauthenticated attackers to=
modify campaign content by restoring an arbitrary revision.</td> <td>2026-07-31</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18436" target=3D= "_blank" rel=3D"noopener">CVE-2026-18436</a></td>
</tr>

<td class=3D"vendor-product">mailerpress--MailerPress Newsletter, email mar= keting &amp; AI automation</td>
<td>The MailerPress - Newsletter, email marketing &amp; AI automation plugi=
n for WordPress is vulnerable to unauthorized access due to a missing capab= ility check on the `mailerpress/v1/contact` endpoint in all versions up to,=
and including, 1.5.0. This makes it possible for unauthenticated attackers=
to update contact details.</td>
<td>2026-07-31</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18437" target=3D= "_blank" rel=3D"noopener">CVE-2026-18437</a></td>
</tr>

<td class=3D"vendor-product">Mattermost--Mattermost</td>
<td>Mattermost versions 11.6.x &lt;=3D 11.6.5, 10.11.x &lt;=3D 10.11.20, 11= .8.x &lt;=3D 11.8.1, 11.7.x &lt;=3D 11.7.4 fail to limit the number of fram=
es and enforce the file size cap on animated GIF uploads, which allows an a= uthenticated attacker to cause a denial of service via a crafted animated G=
IF uploaded as a custom emoji.. Mattermost Advisory ID: MMSA-2026-00695</td=

<td>2026-07-27</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10819" target=3D= "_blank" rel=3D"noopener">CVE-2026-10819</a></td>
</tr>

<td class=3D"vendor-product">Mattermost--Mattermost</td>
<td>Mattermost versions 11.8.x &lt;=3D 11.8.0, 11.7.x &lt;=3D 11.7.3, 11.6.=
x &lt;=3D 11.6.5, 10.11.x &lt;=3D 10.11.20 fail to verify file deletion pat=
h which allows an admin with SAML system-console write permissions to delet=
e arbitrary files outside the config directory from the server via the remo=
ve file endpoint.. Mattermost Advisory ID: MMSA-2026-00666</td>

<td>2026-07-28</td>
<td>5.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7521" target=3D"= _blank" rel=3D"noopener">CVE-2026-7521</a></td>
</tr>

<td class=3D"vendor-product">Mattermost--Mattermost</td>
<td>Mattermost versions 11.8.x &lt;=3D 11.8.0, 11.7.x &lt;=3D 11.7.3, 11.6.=
x &lt;=3D 11.6.5, 10.11.x &lt;=3D 10.11.20 fail to bound the time and resou= rce consumption of server-side document content extraction which allows an = authenticated user with file-upload permission to degrade file uploads for = all users on the server via repeatedly uploading small documents that are c= heap to upload but expensive to extract, saturating the shared extraction w= orker pool.. Mattermost Advisory ID: MMSA-2026-00694</td>
<td>2026-07-27</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10600" target=3D= "_blank" rel=3D"noopener">CVE-2026-10600</a></td>
</tr>

<td class=3D"vendor-product">mervb1--Easy Property Listings</td>
<td>The Easy Property Listings plugin for WordPress is vulnerable to Stored=
Cross-Site Scripting via 'facebook' User Contact Method in all versions up=
to, and including, 3.5.24 due to insufficient input sanitization and outpu=
t escaping. This makes it possible for authenticated attackers, with subscr= iber-level access and above, to inject arbitrary web scripts in pages that = will execute whenever a user accesses an injected page.</td>

<td>2026-08-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16684" target=3D= "_blank" rel=3D"noopener">CVE-2026-16684</a></td>
</tr>

<td class=3D"vendor-product">Microsoft--Microsoft Edge for Android</td>

<td>Improper input validation in Microsoft Edge for Android allows an unaut= horized attacker to perform tampering over a network.</td>
<td>2026-07-28</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62828" target=3D= "_blank" rel=3D"noopener">CVE-2026-62828</a></td>
</tr>

<td class=3D"vendor-product">mihail-barinov--Advanced Woo Labels Product La= bels &amp; Badges for WooCommerce</td>
<td>The Advanced Woo Labels - Product Labels &amp; Badges for WooCommerce p= lugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'b= g_color' parameter in all versions up to, and including, 2.48 due to insuff= icient input sanitization and output escaping. This makes it possible for a= uthenticated attackers, with contributor-level access and above, to inject = arbitrary web scripts in pages that will execute whenever a user accesses a=
n injected page.</td>
<td>2026-08-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15662" target=3D= "_blank" rel=3D"noopener">CVE-2026-15662</a></td>
</tr>

<td class=3D"vendor-product">MikroTik--RouterOS</td>
<td>An API session management flaw in products with the MikroTik RouterOS A=
PI enabled are vulnerable to a Insufficient Session Expiration vulnerabilit=
y. This could allow active sessions to retain their previous permission set=
after inactivity timeouts or user group changes. As a result, an authentic= ated user whose permissions have been reduced may continue accessing inform= ation.</td>
<td>2026-07-30</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14227" target=3D= "_blank" rel=3D"noopener">CVE-2026-14227</a></td>
</tr>

<td class=3D"vendor-product">miniOrange--WordPress Social Login and Registe= r</td>
<td>Contributor Cross Site Scripting (XSS) in WordPress Social Login and Re= gister &lt;=3D 7.8.0 versions.</td>
<td>2026-07-27</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65561" target=3D= "_blank" rel=3D"noopener">CVE-2026-65561</a></td>
</tr>

<td class=3D"vendor-product">mndpsingh287--Theme Editor</td>
<td>The Theme Editor plugin for WordPress is vulnerable to Cross-Site Reque=
st Forgery in all versions up to, and including, 3.1. This is due to missin=
g nonce validation on the ms_update AJAX action. This makes it possible for=
unauthenticated attackers to modify child theme CSS styles via a forged re= quest granted they can trick an administrator into performing an action suc=
h as clicking on a link.</td>
<td>2026-08-01</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-14469" target=3D= "_blank" rel=3D"noopener">CVE-2025-14469</a></td>
</tr>

<td class=3D"vendor-product">modelcontextprotocol--ruby-sdk</td>
<td>MCP Ruby SDK is the official Ruby SDK for Model Context Protocol server=
s and clients. Prior to 0.23.0, MCP::Server::Transports::StdioTransport and=
MCP::Client::Stdio in the mcp gem use IO#gets without a byte limit, allowi=
ng a peer that sends data without a newline to exhaust process memory. This=
issue is fixed in version 0.23.0.</td>
<td>2026-07-29</td>
<td>6.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63119" target=3D= "_blank" rel=3D"noopener">CVE-2026-63119</a></td>
</tr>

<td class=3D"vendor-product">modelcontextprotocol--ruby-sdk</td>
<td>MCP Ruby SDK is the official Ruby SDK for Model Context Protocol server=
s and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTran= sport in the mcp gem does not expire sessions by default, so repeated initi= alize requests retain unbounded ServerSession objects and can exhaust proce=
ss memory. This issue is fixed in version 0.23.0.</td>
<td>2026-07-29</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67430" target=3D= "_blank" rel=3D"noopener">CVE-2026-67430</a></td>
</tr>

<td class=3D"vendor-product">mohammadr3z--</td>
<td>The Persian Elementor (=C3=98=C2=A7=C3=99=E2=80=9E=C3=99=E2=80=A6=C3=99= =E2=80=A0=C3=98=C2=AA=C3=99=CB=86=C3=98=C2=B1 =C3=99=C2=81=C3=98=C2=A7=C3= =98=C2=B1=C3=98=C2=B3=C3=9B=C5=92) plugin for WordPress is vulnerable to Pr= ice Manipulation in all versions up to, and including, 2.8.1. This is due t=
o the plugin trusting a user-supplied payment amount without server-side va= lidation against the configured ZarinPal widget price. This makes it possib=
le for unauthenticated attackers to submit arbitrary payment amounts to the=
ZarinPal gateway via the 'amount' parameter.</td>
<td>2026-07-30</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-1982" target=3D"= _blank" rel=3D"noopener">CVE-2026-1982</a></td>
</tr>

<td class=3D"vendor-product">MoonshotAI--Kimi Code</td>
<td>Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SS=
RF hardening as a static hostname and IP-literal denylist in assertSafeFetc= hTarget, without resolving DNS or re-validating hosts after HTTP redirects.=
An attacker who can influence a FetchURL call (for example via prompt inje= ction) can supply a crafted public hostname that resolves to loopback or an= other internal address, or a public URL that redirects to such a target, an=
d thereby reach internal network services that the denylist was intended to=
block. FetchURL is included in the default auto-approve tool set, so the c= all does not require interactive user confirmation in manual mode.</td> <td>2026-07-27</td>
<td>5.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17534" target=3D= "_blank" rel=3D"noopener">CVE-2026-17534</a></td>
</tr>

<td class=3D"vendor-product">MZ Automation GmbH--libiec61850</td>
<td>The ACSE layer contains a flaw in the processing of AARQ PDUs during MM=
S connection establishment. When parsing certain fields within the calling =
AP title, an attacker controlled length value of zero or one may cause the = parser to read past the end of a heap buffer.</td>
<td>2026-07-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56758" target=3D= "_blank" rel=3D"noopener">CVE-2026-56758</a></td>
</tr>

<td class=3D"vendor-product">MZ Automation GmbH--libiec61850</td>
<td>The MMS BER decoder contains a boundary-handling flaw in the processing=
of certain fields within confirmed-request messages. When a crafted BER-en= coded element is received over an established MMS session (TCP port 102), t=
he decoder may advance its internal read position incorrectly, leading to a=
heap out-of-bounds read. This condition causes the MMS handling process to=
terminate unexpectedly, resulting in a denial-of-service.</td> <td>2026-07-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63550" target=3D= "_blank" rel=3D"noopener">CVE-2026-63550</a></td>
</tr>

<td class=3D"vendor-product">MZ Automation GmbH--libiec61850</td>
<td>The MMS BER decoder contains a flaw in decoding fixed-width BER fields = (boolean/integer): an attacker-supplied length value is not validated, caus= ing a read past the end of a heap buffer. This leads to termination of the = MMS service process and a denial-of-service condition.</td>
<td>2026-07-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65421" target=3D= "_blank" rel=3D"noopener">CVE-2026-65421</a></td>
</tr>

<td class=3D"vendor-product">MZ Automation GmbH--libiec61850</td>
<td>The MMS server connection handler contains a flaw in its processing of = BER-encoded request data. When an MMS confirmed request PDU containing an e= xtended BER tag is received over an established session, the decoder may ad= vance its internal buffer incorrectly due to a missing bounds check. This r= esults in a one byte heap out-of-bounds read and causes the MMS service pro= cess to terminate, leading to a denial-of-service condition.</td> <td>2026-07-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66349" target=3D= "_blank" rel=3D"noopener">CVE-2026-66349</a></td>
</tr>

<td class=3D"vendor-product">MZ Automation GmbH--libiec61850</td>
<td>The GOOSE payload parser contains a boundary handling flaw that can be = triggered by a single unauthenticated Layer 2 multicast frame on the proces=
s bus. When processing specific payload fields, an attacker controlled inne=
r element length may exceed its enclosing length, causing the parser to ove=
r read by one byte. This out-of-bounds read reliably terminates the subscri= ber process, resulting in a denial-of-service condition.</td>

<td>2026-07-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66364" target=3D= "_blank" rel=3D"noopener">CVE-2026-66364</a></td>
</tr>

<td class=3D"vendor-product">MZ Automation GmbH--libiec61850</td>
<td>The GOOSE parser contains an off-by-one boundary-handling flaw that can=
be triggered by a single unauthenticated Layer-2 multicast frame on the pr= ocess bus. When specific GOOSE message fields are processed, the parser adv= ances its internal buffer position incorrectly, resulting in a heap out-of-= bounds read. On affected platforms, this condition reliably terminates the = subscriber process and causes a denial-of-service.</td>
<td>2026-07-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66369" target=3D= "_blank" rel=3D"noopener">CVE-2026-66369</a></td>
</tr>

<td class=3D"vendor-product">MZ Automation GmbH--libiec61850</td>
<td>The GOOSE subscriber component improperly validates the UTC timestamp f= ield in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2 multicas=
t messages. A specially crafted GOOSE frame containing an undersized timest= amp field can trigger a heap out-of-bounds read during message processing, = causing the process to crash and resulting in a denial-of-service condition= .</td>
<td>2026-07-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66720" target=3D= "_blank" rel=3D"noopener">CVE-2026-66720</a></td>
</tr>

<td class=3D"vendor-product">MZ Automation--lib60870</td>
<td>A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an in= flated object count causes TestCommand_getFromBuffer to read one byte past = the end of the heap-allocated message buffer.</td>
<td>2026-07-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-61893" target=3D= "_blank" rel=3D"noopener">CVE-2026-61893</a></td>
</tr>

<td class=3D"vendor-product">MZ Automation--lib60870</td>
<td>A crafted IEC 60870-5-104 I-frame with a declared object count exceedin=
g what fits in the ASDU body causes InformationObject_ParseObjectAddress to=
read one byte past the end of the heap-allocated message buffer.</td> <td>2026-07-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63033" target=3D= "_blank" rel=3D"noopener">CVE-2026-63033</a></td>
</tr>

<td class=3D"vendor-product">nanoid_project--nanoid</td>
<td>nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAl= phabet and customRandom functions. When these functions are configured with=
a size of 0, the internal generation loop never satisfies its exit conditi=
on and spins indefinitely, hanging the calling thread. An application that = passes an unvalidated, attacker-controlled size of 0 to these functions is = exposed to a denial-of-service condition.</td>
<td>2026-07-29</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67213" target=3D= "_blank" rel=3D"noopener">CVE-2026-67213</a></td>
</tr>

<td class=3D"vendor-product">nanoid_project--nanoid</td>
<td>nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customA= lphabet and nanoid functions of its non-secure module (nanoid/non-secure). = When these functions are given a negative size, the loop counter is decreme= nted from a negative value and never reaches its termination condition, spi= nning indefinitely and hanging the calling thread. An application that pass=
es an unvalidated, attacker-controlled negative size to these functions is = exposed to a denial-of-service condition.</td>
<td>2026-07-29</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67214" target=3D= "_blank" rel=3D"noopener">CVE-2026-67214</a></td>
</tr>

<td class=3D"vendor-product">nasirahmed--Advanced Form Integration Connect = Forms to 200+ Apps</td>
<td>The Advanced Form Integration - Connect Forms to 200+ Apps plugin for W= ordPress is vulnerable to authorization bypass in all versions up to, and i= ncluding, 2.6.0. This is due to the plugin not properly verifying that a us=
er is authorized to perform an action. This makes it possible for authentic= ated attackers, with subscriber-level access and above, to overwrite the si= te's stored MailUp OAuth tokens in the adfoin_mailup_keys option with attac= ker-controlled tokens, hijacking future form-submission data to a MailUp ac= count they control or nulling the tokens to break the integration entirely.=
This is exploitable by any authenticated user who can reach /wp-admin/prof= ile.php, as admin_init fires for all logged-in users visiting any wp-admin = page.</td>
<td>2026-07-28</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16587" target=3D= "_blank" rel=3D"noopener">CVE-2026-16587</a></td>
</tr>

<td class=3D"vendor-product">netty--netty</td>
<td>Netty is an asynchronous, event-driven network application framework. I=
n versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder (= =C2=A0StompSubframeEncoder=C2=A0) does not escape or validate header values=
in =C2=A0CONNECT=C2=A0 and =C2=A0CONNECTED=C2=A0 frames, so raw newline (= =C2=A0\n=C2=A0) characters in a header value are written directly to the wi= re, allowing an attacker who controls a header value to inject additional S= TOMP headers. This happens because the encoder intentionally skips escaping=
for CONNECT/CONNECTED frames per the STOMP 1.2 specification but never rej= ects the raw newlines, and since a broker parses each line as a separate he= ader, an attacker controlling a value such as a user-supplied login or pass= code can overwrite connection parameters or add authentication/role headers=
to bypass authentication or escalate privileges (the actual impact is brok= er-dependent). The issue is fixed in versions 4.1.136.Final and 4.2.16.Fina= l.</td>
<td>2026-07-29</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59920" target=3D= "_blank" rel=3D"noopener">CVE-2026-59920</a></td>
</tr>

<td class=3D"vendor-product">netty--netty</td>
<td>Netty is an asynchronous, event-driven network application framework. I=
n versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder=
(=C2=A0HAProxyMessageEncoder=C2=A0) writes AF_UNIX source and destination = socket addresses into the HAProxy V1 text protocol without validating them = for CRLF characters, so an attacker who controls an AF_UNIX address can inj= ect =C2=A0\r\n=C2=A0 sequences and split the single PROXY header into multi= ple lines. This is possible because the V1 protocol uses CRLF as its line t= erminator and, unlike IPv4/IPv6 addresses whose format checks implicitly re= ject CRLF, AF_UNIX addresses are only validated for length (up to 108 bytes=
), allowing a forged second PROXY header line that spoofs the client source= /destination IP to a downstream server or load balancer. The issue is fixed=
in versions 4.1.136.Final and 4.2.16.Final.</td>

<td>2026-07-29</td>
<td>5.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59919" target=3D= "_blank" rel=3D"noopener">CVE-2026-59919</a></td>
</tr>

<td class=3D"vendor-product">netty--netty</td>
<td>Netty is an asynchronous, event-driven network application framework. P= rior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder con= structs multipart HTTP request bodies by directly concatenating user-suppli=
ed filenames and field names into Content-Disposition MIME headers without = validating or sanitizing CRLF characters (\r\n). Since MIME headers are del= imited by CRLF, an attacker who controls the filename can inject arbitrary = MIME headers into the multipart body part. The root cause is that neither t=
he encoder nor the FileUpload implementations' setFilename() methods, which=
only check for null, neutralize CRLF characters before the filename is emb= edded into the header. This issue has been fixed in versions 4.1.136.Final = and 4.2.16.Final.</td>
<td>2026-07-28</td>
<td>5.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59921" target=3D= "_blank" rel=3D"noopener">CVE-2026-59921</a></td>
</tr>

<td class=3D"vendor-product">Nexcess--Event Tickets</td>
<td>Unauthenticated Broken Access Control in Event Tickets &lt;=3D 5.29.0.1=
versions.</td>
<td>2026-07-27</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65567" target=3D= "_blank" rel=3D"noopener">CVE-2026-65567</a></td>
</tr>

<td class=3D"vendor-product">nextlevelbuilder--GoClaw</td>
<td>A flaw has been found in nextlevelbuilder GoClaw up to 3.13.2. Affected=
by this vulnerability is the function ExecTool.Execute of the file goclaw/= internal/http/tools_invoke.go of the component jq Handler. Executing a mani= pulation can lead to information disclosure. The attack can be launched rem= otely. The exploit has been published and may be used. This patch is called=
1230. It is advisable to implement a patch to correct this issue.</td> <td>2026-07-28</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18038" target=3D= "_blank" rel=3D"noopener">CVE-2026-18038</a></td>
</tr>

<td class=3D"vendor-product">nice-select2--nice-select2</td>
<td>Versions of the package nice-select2 before 2.4.1 are vulnerable to Cro= ss-site Scripting (XSS) via the &lt;select&gt; element. An attacker can sup= ply a malicious payload that is rendered directly into the DOM without prop=
er sanitization, causing arbitrary script execution in a victim's browser w= hen they view or interact with the affected page.</td>
<td>2026-07-28</td>
<td>6.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17528" target=3D= "_blank" rel=3D"noopener">CVE-2026-17528</a></td>
</tr>

<td class=3D"vendor-product">nik00726--Responsive Thumbnail Slider</td>

<td>The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable t=
o Reflected Cross-Site Scripting via the 'id' parameter in versions up to, = and excluding, 1.1.53. This is due to insufficient input sanitization and o= utput escaping in the responsive_thumbnail_image_management() function, whi=
ch echoes $_GET['id'] directly into a double-quoted HTML attribute with no = esc_attr() call. The only guard is a loose PHP numeric comparison ($_GET['i= d']&gt;0) that a string beginning with a numeric prefix trivially satisfies=
, and the addslashes() applied by wp_magic_quotes() is inert in HTML-attrib= ute context because backslash is not an HTML escape character. This makes i=
t possible for unauthenticated attackers to inject arbitrary web scripts in=
pages that execute if they can successfully trick a user into performing a=
n action such as clicking on a specially crafted link.</td>
<td>2026-08-01</td>
<td>6.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18344" target=3D= "_blank" rel=3D"noopener">CVE-2026-18344</a></td>
</tr>

<td class=3D"vendor-product">NTPsec--ntpsec</td>
<td>Buffer overflow in NTPsec's Zyfer refclock allows local attacker to cra=
sh ntpd</td>
<td>2026-07-31</td>
<td>4.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18321" target=3D= "_blank" rel=3D"noopener">CVE-2026-18321</a></td>
</tr>

<td class=3D"vendor-product">o6 Automation--open62541</td>
<td>An unsigned integer underflow in the PubSub signature verification path=
in open62541 may allow a remote attacker to cause a denial of service via =
a crafted UDP packet.</td>
<td>2026-07-30</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63362" target=3D= "_blank" rel=3D"noopener">CVE-2026-63362</a></td>
</tr>

<td class=3D"vendor-product">OliveTin--OliveTin</td>
<td>OliveTin gives access to predefined shell commands from a web interface=
. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go=
checkShellArgumentSafety function does not treat regex: custom argument ty= pes as unsafe for Shell mode actions, allowing values that pass typeSafetyC= heckRegex to be interpolated by wrapCommandInShell into an sh -c command st= ring and enabling OS command injection. This issue is fixed in version 3000= .17.0.</td>
<td>2026-07-29</td>
<td>6.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67438" target=3D= "_blank" rel=3D"noopener">CVE-2026-67438</a></td>
</tr>

<td class=3D"vendor-product">OliveTin--OliveTin</td>
<td>OliveTin gives safe and simple access to predefined shell commands from=
a web interface. Prior to 3000.17.0, the service/internal/api/api.go Start= ActionAndWait and StartActionByGetAndWait endpoints return full LogEntry ou= tput after execution without enforcing the logs permission, allowing a user=
with exec permission but logs:false to read action output. This issue is f= ixed in version 3000.17.0.</td>
<td>2026-07-29</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67439" target=3D= "_blank" rel=3D"noopener">CVE-2026-67439</a></td>
</tr>

<td class=3D"vendor-product">onionshare--onionshare</td>
<td>OnionShare is an open source tool that lets you securely and anonymousl=
y share files, host websites, and chat with friends using the Tor network. = Prior to 2.6.4, OnionShare CLI/Desktop does not enforce the Receive mode di= sable_files setting in cli/onionshare_cli/web/receive_mode.py, where Receiv= eModeRequest._get_file_stream() writes multipart file[] data to disk despit=
e the text-only setting. This issue is fixed in version 2.6.4.</td> <td>2026-07-31</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54707" target=3D= "_blank" rel=3D"noopener">CVE-2026-54707</a></td>
</tr>

<td class=3D"vendor-product">onionshare--onionshare</td>
<td>OnionShare is an open source tool that lets you securely and anonymousl=
y share files, host websites, and chat with friends using the Tor network. = Prior to 2.6.4, OnionShare CLI/Desktop follows symbolic links in cli/onions= hare_cli/web/send_base_mode.py through SendBaseModeWeb.set_file_info() and = stream_individual_file(), allowing remote recipients of Share or Website mo=
de to read local files outside the selected directory. This issue is fixed =
in version 2.6.4.</td>
<td>2026-07-31</td>
<td>4.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54706" target=3D= "_blank" rel=3D"noopener">CVE-2026-54706</a></td>
</tr>

<td class=3D"vendor-product">opajaap--WP Photo Album Plus</td>
<td>The WP Photo Album Plus plugin for WordPress is vulnerable to generic S=
QL Injection via the 'table' parameter in all versions up to, and including=
, 9.2.04.002 due to insufficient escaping on the user supplied parameter an=
d lack of sufficient preparation on the existing SQL query. This makes it p= ossible for authenticated attackers, with administrator-level access and ab= ove, to append additional SQL queries into already existing queries that ca=
n be used to extract sensitive information from the database. The export-ta= ble endpoint lacks a nonce check, meaning this vulnerability can also be tr= iggered via CSRF by tricking an authenticated administrator into visiting a=
malicious page.</td>
<td>2026-07-29</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15344" target=3D= "_blank" rel=3D"noopener">CVE-2026-15344</a></td>
</tr>

<td class=3D"vendor-product">openremote--openremote</td>
<td>OpenRemote (org.openremote:openremote) versions &lt;=3D 1.26.2 contain =
an insecure direct object reference vulnerability in the setAssetLinks endp= oint of AlarmResourceImpl. The realm access check validates only a single r= ealm obtained via realms.stream().findFirst() on a HashSet of realms from t=
he request, rather than all realms. Because HashSet iteration order is non-= deterministic, an authenticated attacker who includes alarm-asset links fro=
m both their own realm and a victim realm can, with roughly 50% probability=
per request (retryable), persist cross-tenant links and disclose victim as= set names (returned via @Formula fields) through GET requests on the attack= er's own alarm. Fixed in 1.27.0.</td>
<td>2026-08-01</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67310" target=3D= "_blank" rel=3D"noopener">CVE-2026-67310</a></td>
</tr>

<td class=3D"vendor-product">openwrt--luci</td>
<td>luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scrip= ting vulnerability in the blocklist name field that allows lower-privileged=
users to inject active HTML. When an administrator views the AdBlock Fast = status page, the injected payload executes in the administrator's browser u= nder the LuCI origin.</td>
<td>2026-08-02</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-68583" target=3D= "_blank" rel=3D"noopener">CVE-2026-68583</a></td>
</tr>

<td class=3D"vendor-product">opf--openproject</td>
<td>OpenProject is open-source, web-based project management software. Prio=
r to 17.6.0, GET /api/v3/custom_options/:id resolved CustomOption records b=
y global numeric id and allowed UserCustomField and GroupCustomField option=
s without checking visible(current_user), so authenticated non-admin users = could enumerate sequential custom option ids and read labels belonging to a= dmin_only user or group custom fields. This issue is fixed in 17.6.0.</td> <td>2026-07-30</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67528" target=3D= "_blank" rel=3D"noopener">CVE-2026-67528</a></td>
</tr>

<td class=3D"vendor-product">opf--openproject</td>
<td>OpenProject is open-source, web-based project management software. Prio=
r to 17.6.0, GET /api/v3/time_entries and GET /api/v3/cost_entries rendered=
_links.workPackage.title and _links.workPackage.href through associated_re= source in modules/costs/lib/api/v3/time_entries/time_entry_representer.rb a=
nd modules/costs/lib/api/v3/cost_entries/cost_entry_representer.rb without = checking WorkPackage.visible or view_work_packages, allowing users with vie= w_time_entries or view_cost_entries to read private work package subjects a=
nd ids. This issue is fixed in 17.6.0.</td>
<td>2026-07-30</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67529" target=3D= "_blank" rel=3D"noopener">CVE-2026-67529</a></td>
</tr>

<td class=3D"vendor-product">papra-hq--papra</td>
<td>Papra is a minimalistic document management and archiving platform. Pri=
or to version 26.5.0, an authenticated user who is a member of any organiza= tion can delete or rename tags belonging to a different organization, given=
the target tag's ID. The route handler verifies the caller's membership of=
the ":organizationId" in the URL, but the repository write filters on tag.=
id alone, so the URL-level org scope never reaches the database. This issue=
has been patched in version 26.5.0.</td>
<td>2026-07-27</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48052" target=3D= "_blank" rel=3D"noopener">CVE-2026-48052</a></td>
</tr>

<td class=3D"vendor-product">pgadmin.org--pgAdmin 4</td>
<td>In SERVER mode, pgAdmin 4 enforces authentication per route via the @pg= a_login_required decorator; the application's before_request hook only hand= les desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so an=
y route shipped without the decorator is reachable without authentication (= CWE-306). This is the same defect class previously fixed as CVE-2026-12046 = (the sqleditor close/update_connection routes). A follow-up sweep, prompted=
by a report describing an incomplete fix for CVE-2026-12046, found further=
routes missing @pga_login_required: the Constraints blueprint's nodes and = proplist (object listing) routes and its delete route (a state-mutating DEL= ETE that removes table constraints); preferences.get_all_cli (GET, disclose=
s all CLI-settable preference values); debugger.close (DELETE); and schema_= diff.close (DELETE). An unauthenticated network client could therefore enum= erate constraint metadata, delete table constraints, read preference values=
, and force-close debugger or schema-diff sessions belonging to other users=
, without ever authenticating. Fix adds the missing @pga_login_required dec= orator (and the corresponding import to the Constraints module) to each of = these routes. The change is decorator-only; no behavioral changes to the un= derlying handlers. This issue affects pgAdmin 4 in SERVER mode: the Constra= ints and Debugger routes from 1.0, the Schema Diff close route from 4.18, a=
nd preferences.get_all_cli from 8.2, all before 9.17.</td>
<td>2026-07-31</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17348" target=3D= "_blank" rel=3D"noopener">CVE-2026-17348</a></td>
</tr>

<td class=3D"vendor-product">pgadmin.org--pgAdmin 4</td>
<td>The per-tool permission system (custom roles / role-based tool permissi= ons, introduced in pgAdmin 4 9.3) did not enforce its permission check cons= istently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask= -Security permission, but the permission decorator (permissions_required) w=
as applied only to a single "front door" route per tool. Every other backen=
d route and Socket.IO handler in that tool's workflow relied solely on pga_= login_required/socket_login_required, which check authentication but not th=
e tool permission. The reporter verified three cases against a test build: = (1) a user without tools_query_tool permission received 403 on the protecte=
d sqleditor initialization route, but the same session went on to connect t=
he server, initialize the viewdata backend chain, and retrieve real table r=
ow content; (2) a user without tools_grant_wizard received 403 on the prote= cted acl route, but the same session still enumerated grantable objects, ge= nerated GRANT SQL, and successfully applied it -- confirmed database-side v=
ia has_table_privilege(); (3) a user without tools_schema_diff received 403=
on the protected panel route, but the same session initialized schema diff=
, enumerated and connected databases, and obtained real DDL differences via=
the compare_database Socket.IO handler. The reporter also confirmed a rela= ted but distinct issue: a non-owner triggering /misc/workspace/adhoc_connec= t_server against an administrator-owned shared server caused pgAdmin to per= sist a new server row still owned by the administrator (user_id/shared unch= anged from the source), even though the connection attempt itself reported = failure. During remediation, the same front-door-only permission gap was fo= und to also affect the ERD, PSQL, and Debugger tools, and the Backup, Resto= re, Maintenance, and Import/Export blueprints, none of which were part of t=
he original report; these were fixed using the same pattern as an extension=
of the reported defect class. An authenticated user who had valid pgAdmin = login and a stored, working database connection, but had been explicitly de= nied a specific tool's permission by an administrator, could therefore stil=
l drive that tool end-to-end through its other routes and sockets, includin=
g obtaining an interactive psql session over the /pty Socket.IO namespace a=
nd invoking backup/restore/maintenance/import-export jobs. Because the bypa=
ss only restores access to tools operating over the user's own already-auth= enticated database connection, it does not grant the user any database priv= ilege they did not already hold; it circumvents pgAdmin's own tool-level ac= cess-control policy (an organisational segregation-of-duties control, separ= ate from database-level authorization), letting a user reach a pgAdmin feat= ure an administrator intended to withhold from them, using capabilities the=
ir existing database role already permits through other means. Socket.IO ev= ent handlers had no permission-aware equivalent of permissions_required; on=
ly socket_login_required existed, checking authentication but not the tool = permission. Fix adds a socket_permissions_required decorator (mirroring per= missions_required, honouring the Administrator bypass, reading permissions = via has_permission()) and applies it, alongside permissions_required, as th=
e outermost decorator on every backend route and Socket.IO handler for the = affected tools. Regression tests assert 403 on every gated route and socket=
handler for a permission-less user. This issue affects pgAdmin 4 in SERVER=
mode: from 9.3 before 9.17.</td>
<td>2026-07-31</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17350" target=3D= "_blank" rel=3D"noopener">CVE-2026-17350</a></td>
</tr>

<td class=3D"vendor-product">Phoenix Contact--CHARX SEC-3150</td>
<td>The credentials for the local user "user-app" may be exposed in log fil= es, potentially enabling a low-privileged local attacker with access to the=
logs to authenticate via SSH as the limited user "user-app". Charging coul=
d be interrupted.</td>
<td>2026-07-30</td>
<td>6.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44105" target=3D= "_blank" rel=3D"noopener">CVE-2026-44105</a></td>
</tr>

<td class=3D"vendor-product">Phoenix Contact--CHARX SEC-3150</td>
<td>An unauthenticated remote attacker can trigger a firmware update downlo=
ad via the OCPP backend by supplying an invalid firmware file. This will ca= use the file to remain accessible for a short period before it is deleted d=
ue to improper locking during the cleanup process.</td>
<td>2026-07-30</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44102" target=3D= "_blank" rel=3D"noopener">CVE-2026-44102</a></td>
</tr>

<td class=3D"vendor-product">Phoenix Contact--CHARX SEC-3150</td>
<td>An unauthenticated remote attacker can inject malicious firmware into t=
he internal charging module because the JupiCore service transmits firmware=
updates without performing integrity or verification check. Successful exp= loitation may compromise the integrity of the affected device. This vulnera= bility could be used in chain with CVE-2026-44104.</td>
<td>2026-07-30</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44103" target=3D= "_blank" rel=3D"noopener">CVE-2026-44103</a></td>
</tr>

<td class=3D"vendor-product">pion--stun</td>
<td>pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddr= ess.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS = attribute in STUN or ICE Binding-response parsing paths, allowing remote de= nial of service. This issue is fixed in version 3.1.3.</td>
<td>2026-07-31</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54909" target=3D= "_blank" rel=3D"noopener">CVE-2026-54909</a></td>
</tr>

<td class=3D"vendor-product">pixelyoursite--PixelYourSite Your smart PIXEL = (TAG) &amp; API Manager</td>
<td>The PixelYourSite - Your smart PIXEL (TAG) &amp; API Manager plugin for=
WordPress is vulnerable to Sensitive Information Exposure in all versions =
up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes =
it possible for unauthenticated attackers to extract WooCommerce purchase m= etadata - including product names, product IDs, quantities, per-item prices=
, order totals, currency, and order/transaction IDs - for any existing orde=
r by supplying an invalid or arbitrary order key. This is exploitable again=
st any known or enumerated order ID, as the plugin resolves the order from = the URL path variable alone and emits the full woo_purchase tracking payloa=
d into the page HTML via the pysOptions JavaScript object across its Facebo= ok, Google Analytics, and Google Tag Manager integrations regardless of key=
validity.</td>
<td>2026-08-01</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18059" target=3D= "_blank" rel=3D"noopener">CVE-2026-18059</a></td>
</tr>

<td class=3D"vendor-product">projectcapsule--capsule</td>
<td>Capsule is a multi-tenancy and policy-based framework for Kubernetes. P= rior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Rege=
x and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex wer=
e not validated by the configuration admission webhook, allowing a Cluster = Admin to store a malformed regex that later reached regexp.MustCompile in p= kg/api/forbidden_list.go through internal/webhook/node/user_metadata.go and=
crashed the node admission webhook on Node create, update, or patch reques= ts. This issue is fixed in version 0.13.8.</td>
<td>2026-07-30</td>
<td>6.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65834" target=3D= "_blank" rel=3D"noopener">CVE-2026-65834</a></td>
</tr>

<td class=3D"vendor-product">projectcapsule--capsule</td>
<td>Capsule is a multi-tenancy and policy-based framework for Kubernetes. F= rom 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantRes= ource RawItems and Generators in internal/controllers/resources/collect.go,=
including handleRawItem and handleGeneratorItem, did not apply the Resourc= eReference.LoadResources and IsNamespacedGVK cluster-scoped resource reject= ion guard used by NamespacedItems, allowing a Tenant Owner to create cluste= r-scoped resources such as ClusterRole or ValidatingWebhookConfiguration th= rough the cluster-admin controller client. This issue is fixed in version 0= .13.8.</td>
<td>2026-07-30</td>
<td>6.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65835" target=3D= "_blank" rel=3D"noopener">CVE-2026-65835</a></td>
</tr>

<td class=3D"vendor-product">pterodactyl--wings</td>
<td>Wings is the server control plane for Pterodactyl, a free, open-source = game server management panel. Prior to 1.13.0, unbounded json, yaml, and xm=
l configuration-file parsers in parser.go can process an oversized non-file=
parser configuration file and exhaust Wings process memory. This issue is = fixed in version 1.13.0.</td>
<td>2026-07-31</td>
<td>5.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52857" target=3D= "_blank" rel=3D"noopener">CVE-2026-52857</a></td>
</tr>

<td class=3D"vendor-product">pydantic--pydantic-ai</td>
<td>Pydantic AI is a Python agent framework for building Generative AI appl= ications. In versions 1.56.0 through 1.98.0, when an application opts a URL=
into force_download=3D'allow-local' (disabling the default block on privat= e/internal IPs), the cloud-metadata blocklist could be bypassed by encoding=
the metadata IP in an IPv6 transition form (IPv4-mapped IPv6, 6to4, or NAT= 64), exposing cloud IAM short-term credentials on dual-stack or translated = networks. This is an incomplete fix of GHSA-2jrp-274c-jhv3 / CVE-2026-25580=
, whose remediation did not hold for IPv6-encoded forms of the metadata IPs=
. An application is affected only if it explicitly opts a FileUrl (ImageUrl=
, AudioUrl, VideoUrl, DocumentUrl) into force_download=3D'allow-local' on a=
URL influenced by untrusted input; it is not affected when using bundled i= ntegrations to ingest user input (Agent.to_web / clai web, VercelAIAdapter,=
AGUIAdapter / Agent.to_ag_ui), since they do not propagate force_download = from external data, nor when downloading only from developer-controlled URL=
s. This issue has been fixed in version 1.99.0.</td>
<td>2026-07-29</td>
<td>6.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-46678" target=3D= "_blank" rel=3D"noopener">CVE-2026-46678</a></td>
</tr>

<td class=3D"vendor-product">pydantic--pydantic-ai</td>
<td>Pydantic AI is a Python agent framework for building Generative AI appl= ications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, =
a client that submits message history to a Pydantic AI UI adapter (such as = the Vercel AI adapter) can reference arbitrary files in the application's m= odel-provider or cloud-storage account. While file URL parts are validated = against a scheme allowlist, UploadedFile references - which point to a file=
by provider file ID or cloud-storage URI (e.g. s3://, gs://) - were forwar= ded without validation. Because the provider resolves an UploadedFile using=
the server-side identity (IAM role, service account, or provider API key) = rather than the client's, an attacker can craft message history to make the=
server read objects from its own account or other tenants, given a referen= ceable identifier. Exploitation requires a valid file identifier, which is = not always unguessable depending on how the application names objects. This=
issue has been fixed in versions 1.106.0 and 2.0.0b6.</td>
<td>2026-07-29</td>
<td>6.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54249" target=3D= "_blank" rel=3D"noopener">CVE-2026-54249</a></td>
</tr>

<td class=3D"vendor-product">pydantic--pydantic-ai</td>
<td>Pydantic AI is a Python agent framework for building applications and w= orkflows with Generative AI. In versions 1.88.0 up to but not including 1.1= 07.1 and 2.0.0b1 up to but not including 2.5.0, the UI adapters (AG-UI via = Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdapter) use saniti= ze_messages to strip unresolved ("dangling") client-submitted tool calls fr=
om untrusted message history before it reaches the agent, a defense-in-dept=
h default that prevents the agent from executing tool calls the model never=
emitted. However, the strip anchored to a message index computed before sa= nitization ran, so when a trailing client message sanitized to empty and wa=
s dropped (for example a client system message under the default manage_sys= tem_prompt=3D'server'), a preceding assistant response carrying an unresolv=
ed tool call became the new tail and was dispatched without inspection. As =
a result, a remote client could cause a registered, non-approval server too=
l to run with client-supplied arguments rather than arguments the model pro= duced. The impact is bounded by what the affected tools do and is most sign= ificant for applications that gate tool execution in a model-request hook (= before_model_request / after_model_request), since a forged call skips the = model turn and bypasses that guardrail; approval-gated tools (requires_appr= oval=3DTrue) are not auto-executed by this path. This issue has been fixed =
in versions 1.107.1 and 2.5.0.</td>
<td>2026-07-29</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65975" target=3D= "_blank" rel=3D"noopener">CVE-2026-65975</a></td>
</tr>

<td class=3D"vendor-product">quantumcloud--WPBot AI ChatBot for Live Suppor=
t, Lead Generation, AI Services</td>
<td>The WPBot - AI ChatBot for Live Support, Lead Generation, AI Services p= lugin for WordPress is vulnerable to Sensitive Information Exposure in all = versions up to, and including, 8.5.9 via the wpbot_send_email_transcript_fr= ee. This makes it possible for unauthenticated attackers to exfiltrate full=
chat transcripts and associated user PII - including names, email addresse=
s, and phone numbers - stored in the wpbot_user and wpbot_conversation tabl=
es to an attacker-controlled email address.</td>
<td>2026-07-28</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16773" target=3D= "_blank" rel=3D"noopener">CVE-2026-16773</a></td>
</tr>

<td class=3D"vendor-product">quantumcloud--WPBot AI ChatBot for Live Suppor=
t, Lead Generation, AI Services</td>
<td>The Chatbot plugin for WordPress is vulnerable to Missing Authorization=
in versions up to, and including, 8.5.9 via the wpcs_send_email() AJAX han= dler. This is due to the wpcs_send_email() function being registered on bot=
h wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email with no nonce = verification, capability check, or rate limiting, while forwarding attacker= -controlled recipient, subject, and body directly to wp_mail(). This makes =
it possible for unauthenticated attackers to send arbitrary emails to any r= ecipient from the site's domain, enabling spam, phishing, and abuse that ca=
n lead to the site's IP/domain being blacklisted.</td>

<td>2026-07-28</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16774" target=3D= "_blank" rel=3D"noopener">CVE-2026-16774</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Cost Management Metrics Operator</td> <td>A flaw was found in koku-metrics-operator. The operator's CostManagemen= tMetricsConfig custom resource allows a user able to edit the CR to specify=
an arbitrary OAuth token endpoint. When authentication.type is set to serv= ice-account, the operator sends the tenant's Red Hat SSO client_id and clie= nt_secret to this user-controlled URL, allowing the attacker to obtain the = credentials.</td>
<td>2026-07-30</td>
<td>6.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18382" target=3D= "_blank" rel=3D"noopener">CVE-2026-18382</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Build of Keycloak</td>
<td>A flaw was found in the group policy evaluation logic of Keycloak, an i= dentity and access management solution. When a group policy is set to exten=
d permissions to child groups, the system incorrectly uses a simple text-ba= sed prefix check to verify group membership. This allows a user who belongs=
to a different group with a similar starting name to bypass security check=
s and gain unauthorized access to administrative functions or protected res= ources.</td>
<td>2026-07-31</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18203" target=3D= "_blank" rel=3D"noopener">CVE-2026-18203</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Build of Keycloak</td>
<td>A flaw was found in the client policy enforcement mechanism of Keycloak=
. The issue occurs when the system checks group membership by name instead =
of a unique identifier. An attacker with client management privileges could=
bypass security policies by joining a group with a matching name in a diff= erent part of the group hierarchy, potentially allowing them to register or=
update clients without following required security hardening profiles.</td=

<td>2026-07-29</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18207" target=3D= "_blank" rel=3D"noopener">CVE-2026-18207</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Build of Keycloak</td>
<td>A flaw was found in the OIDC token introspection endpoint of the keyclo= ak-services component. Keycloak is an open-source identity and access manag= ement solution used to secure modern applications and services. The issue o= ccurs when a confidential client, configured to receive signed JWT introspe= ction responses, attempts to introspect a token issued for a different audi= ence. Although the endpoint correctly identifies the token as inactive for = that client, it still returns the full set of token claims within a signed = JWT field. This allows an unauthorized client to bypass audience-based rest= rictions and access sensitive information contained in the token.</td> <td>2026-07-31</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18208" target=3D= "_blank" rel=3D"noopener">CVE-2026-18208</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Build of Keycloak</td> <td>Keycloak allows users to log in using Google accounts and can be config= ured to only allow users from specific Google Workspace domains. A flaw was=
found where the token exchange feature, which allows swapping a Google tok=
en for a Keycloak token, does not check these domain restrictions. This mea=
ns an attacker with a valid Google account from a different domain could by= pass the security check and gain access to the Keycloak realm.</td> <td>2026-07-31</td>
<td>6.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18214" target=3D= "_blank" rel=3D"noopener">CVE-2026-18214</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Build of Keycloak</td> <td>Keycloak provides a way to let users log in using Microsoft accounts wh= ile restricting access to a specific organization (tenant). A flaw was disc= overed where this restriction is ignored when using the token exchange feat= ure. This means an attacker with a valid Microsoft token from a completely = different organization could gain access to the Keycloak realm, potentially=
accessing sensitive data or performing unauthorized actions.</td> <td>2026-07-31</td>
<td>6.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18215" target=3D= "_blank" rel=3D"noopener">CVE-2026-18215</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Build of Keycloak</td>
<td>A flaw was found in the user creation component of Keycloak when Fine-G= rained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-a= dministrator with permission to create users to add those users to any grou=
p, even groups the sub-administrator is not authorized to manage. This coul=
d lead to unauthorized access to sensitive information or elevated privileg=
es for the newly created users.</td>
<td>2026-08-02</td>
<td>6.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18571" target=3D= "_blank" rel=3D"noopener">CVE-2026-18571</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Build of Keycloak</td> <td>Keycloak provides authorization services that allow administrators to r= estrict access to resources based on time policies (for example, only allow= ing access during business hours). A flaw was discovered where a user can i= nclude a fake time value in their authorization request that overrides the = actual server time. This allows the user to bypass these time-based restric= tions and access protected resources at unauthorized times.</td> <td>2026-08-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18572" target=3D= "_blank" rel=3D"noopener">CVE-2026-18572</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Build of Keycloak</td>
<td>A flaw was found in the keycloak-services component of Keycloak, which =
is used for managing authentication and authorization flows. The issue occu=
rs when a realm administrator configures client policies to enforce specifi=
c authentication requirements on confidential clients. Due to improper eval= uation of the client state during an update operation, an attacker with cli= ent management permissions can bypass these security policies by first crea= ting a public client and then updating it to a confidential client with wea= ker authentication. This can result in the persistence of clients that do n=
ot comply with the intended security hardening of the realm.</td> <td>2026-08-02</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18573" target=3D= "_blank" rel=3D"noopener">CVE-2026-18573</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Build of Keycloak</td> <td>Keycloak provides a way to manage identity providers and organizations = through its administrative API. A flaw was discovered where an administrato=
r with permission to manage identity providers could link a new provider to=
an organization without having the required permissions to manage that org= anization. This could allow an unauthorized administrator to influence how = users log into specific organizations.</td>
<td>2026-07-29</td>
<td>5.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18201" target=3D= "_blank" rel=3D"noopener">CVE-2026-18201</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Build of Keycloak</td>
<td>A flaw was found in the full-scope-disabled client-policy executor with=
in the keycloak-services component. This component is responsible for enfor= cing security policies during client registration and configuration in Red = Hat Build of Keycloak. The issue occurs because the executor only validates=
the fullScopeAllowed field when it is explicitly provided in a request. By=
omitting this field, a delegated user can bypass the policy, resulting in =
a client created with full scope access. This allows the client to obtain t= okens with unauthorized role mappings.</td>
<td>2026-08-02</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18570" target=3D= "_blank" rel=3D"noopener">CVE-2026-18570</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Build of Keycloak</td>
<td>A flaw was found in the RoleContainerResource component of Keycloak. Th=
e issue occurs because certain name-based endpoints in the admin REST API d=
o not properly enforce authorization checks when managing composite roles. = This allows a delegated administrator with manage-realm permissions to remo=
ve essential child roles from built-in admin roles, potentially disrupting = administrative functions within a realm.</td>
<td>2026-07-31</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16105" target=3D= "_blank" rel=3D"noopener">CVE-2026-16105</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Build of Keycloak</td>
<td>A flaw was found in the secure-client-uris client policy executor withi=
n Keycloak core services. This component is responsible for enforcing secur= ity requirements on client configurations, such as requiring encrypted conn= ections for redirect URIs. Due to an improper check that only looks at the = start of a web address rather than properly verifying the host, an attacker=
can bypass these security restrictions by using a specially crafted domain=
name. This could allow an attacker to intercept sensitive authentication c= odes over unencrypted connections.</td>
<td>2026-07-31</td>
<td>4.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18211" target=3D= "_blank" rel=3D"noopener">CVE-2026-18211</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Build of Keycloak</td>
<td>A flaw was found in the TokenManager component of the Keycloak identity=
management service. When an administrator attempts to revoke tokens for a = specific application (client) using a "not-before" policy, the revocation m=
ay be silently ignored if the overall security realm already has an older, = non-zero revocation policy in place. This issue can allow previously issued=
tokens to remain valid for refreshing sessions and accessing user informat= ion even after an administrator has attempted to invalidate them. =C3=A2=E2= =80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81= =C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80= =9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3= =A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D= =C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2= =E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2= =81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2= =80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81= =C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80= =9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3= =A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D= =C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2= =E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2= =81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2= =80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81= =C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80= =9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3= =A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D= =C2=81=C3=A2=E2=80=9D=C2=81=C3=A2=E2=80=9D=C2=81</td>
<td>2026-07-31</td>
<td>4.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18218" target=3D= "_blank" rel=3D"noopener">CVE-2026-18218</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Certificate System 10</td>

<td>A flaw was found in Dogtag PKI's ACME responder where the web.xml secur= ity constraints use exact URL pattern matching for admin-only enable/disabl=
e endpoints. By appending a trailing slash to the URL, an unauthenticated a= ttacker can bypass the Tomcat authentication constraint while RESTEasy stil=
l routes the request to the handler, allowing unauthorized toggling of the = ACME service state including persistent denial of service.</td> <td>2026-07-28</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18047" target=3D= "_blank" rel=3D"noopener">CVE-2026-18047</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Certificate System 10</td>

<td>A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 chall= enge validator accepts IP address literals as dns identifiers and follows H= TTP redirects without validating that the target is a public address. An un= authenticated ACME account holder can exploit this to perform server-side r= equest forgery (SSRF), making the Dogtag server send HTTP GET requests to i= nternal network services. With the InMemory database backend, the response = body of internal targets is disclosed to the attacker through the ACME chal= lenge error.</td>
<td>2026-07-30</td>
<td>5.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18369" target=3D= "_blank" rel=3D"noopener">CVE-2026-18369</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>

<td>A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A=
remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` func= tion by sending a specially crafted request. This bypasses a critical bound=
s check, which can lead to the `pmproxy` service crashing, causing a Denial=
of Service (DoS). Additionally, this flaw may enable the leakage of sensit= ive information from the system's memory.</td>
<td>2026-07-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16530" target=3D= "_blank" rel=3D"noopener">CVE-2026-16530</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>

<td>A flaw was found in ansible-collection-redhat-leapp. An attacker with p= rivileged write access to a managed node's Leapp report content can manipul= ate it. When an operator runs a specific remediation task, this manipulated=
report can cause the Ansible controller to read its own local files and co=
py them to the managed node. This vulnerability leads to information disclo= sure, potentially exposing sensitive controller-side data such as private k= eys or credentials.</td>
<td>2026-07-30</td>
<td>6.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-68562" target=3D= "_blank" rel=3D"noopener">CVE-2026-68562</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>

<td>An unauthenticated remote attacker can exploit a path traversal vulnera= bility in the PCP pmproxy logger servlet using a crafted hostname. This all= ows arbitrary file and directory creation, potentially leading to a denial =
of service.</td>
<td>2026-07-30</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16531" target=3D= "_blank" rel=3D"noopener">CVE-2026-16531</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>

<td>An out-of-bounds read flaw was found in Samba's Kerberos Key Distributi=
on Center's (KDC) password change (kpasswd) service. When processing malfor= med ASN.1-encoded Kerberos password change request, Samba server miscalcula= tes the structure size and attempts to read up to six bytes beyond the end =
of the allocated buffer. While this out-of-bounds read typically results in=
a harmless decryption failure, if the read hits unmapped memory, it causes=
the KDC process to crash. An authenticated attacker can send a specially c= rafted kpasswd request containing malformed ASN.1 data to trigger the out-o= f-bounds read, which may cause the KDC process to terminate, resulting in a=
denial of service.</td>
<td>2026-07-30</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58216" target=3D= "_blank" rel=3D"noopener">CVE-2026-58216</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>

<td>A flaw was found in Samba's internal DNS server where unauthenticated T= KEY registration requests were added to the TKEY name cache before being re= jected. A remote, unauthenticated attacker can exploit this behavior by sen= ding a large number of TKEY requests with arbitrary names, exhausting the c= ache and evicting legitimate TKEY entries. This can prevent legitimate TSIG=
authentication for signed DNS queries, resulting in a denial of service.</=

<td>2026-07-30</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58218" target=3D= "_blank" rel=3D"noopener">CVE-2026-58218</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>

<td>A flaw was found in ansible-collection-redhat-leapp. When a remediation=
task is executed with elevated privileges and the `leapp_old_postgresql_da= ta` option is selected, a PostgreSQL data backup archive is created with in= secure permissions. This allows a local non-root user on the managed node t=
o read sensitive archived PostgreSQL data, leading to information disclosur= e.</td>
<td>2026-07-30</td>
<td>5.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-68563" target=3D= "_blank" rel=3D"noopener">CVE-2026-68563</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Hardened Images</td>
<td>A flaw was found in the GNU Binutils (Binary Utilities) linker. This vu= lnerability, a heap-buffer-overflow read (CWE-125), occurs when the linker = processes a specially crafted 32-bit XCOFF (Extended Common Object File For= mat) object file. An attacker could exploit this by providing a malicious f= ile, leading to an out-of-bounds read of memory. This can result in informa= tion disclosure, potentially revealing sensitive heap data, and a Denial of=
Service (DoS) due to the linker crashing.</td>
<td>2026-07-27</td>
<td>5.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15003" target=3D= "_blank" rel=3D"noopener">CVE-2026-15003</a></td>
</tr>

<td class=3D"vendor-product">remix-run--react-router</td>
<td>React Router is a router for React. In versions 6.4.0 through 7.17.0, i=
f application code was written in a way that allows attacker-supplied input=
to overwrite certain aspects of errors caught by the SSR process, then it = was possible for an attacker to trigger unexpected constructor execution on=
the client, which would in turn trigger an outbound network request. This =
is only possible with very specific (and unlikely) application-layer code. = Note that this does not impact an application if it is using Declarative Mo= de. It only impacts Framework Mode and Data Mode applications that perform = manual SSR/hydration. This issue has been fixed in version 7.18.0.</td> <td>2026-07-27</td>
<td>6.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53666" target=3D= "_blank" rel=3D"noopener">CVE-2026-53666</a></td>
</tr>

<td class=3D"vendor-product">remix-run--react-router</td>
<td>React Router is a router for React. In versions 7.11.0 through 7.17.0, = the RSCErrorHandler is missing protocol validation, allowing for redirects = from untrusted sources. This issue is a follow up to CVE-2026-53667, and on=
ly affects consuming applications if they are using the unstable RSC APIs. = This issue has been fixed in version 7.18.0.</td>
<td>2026-07-27</td>
<td>6.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53667" target=3D= "_blank" rel=3D"noopener">CVE-2026-53667</a></td>
</tr>

<td class=3D"vendor-product">remix-run--react-router</td>
<td>React Router is a router for React. In versions 6.30.2 through 6.30.4 a=
nd 7.9.6 through 7.12.0, applications that allow open redirects are vulnera= ble to XSS. An attacker could craft a malicious link that redirects users t=
o an unexpected external site or that exploits an XSS vector.This issue has=
been fixed in version 7.13.0.</td>
<td>2026-07-27</td>
<td>6.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53668" target=3D= "_blank" rel=3D"noopener">CVE-2026-53668</a></td>
</tr>

<td class=3D"vendor-product">Roxnor--FundEngine</td>
<td>Subscriber Broken Access Control in FundEngine &lt;=3D 1.7.8 versions.<=

<td>2026-07-27</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59560" target=3D= "_blank" rel=3D"noopener">CVE-2026-59560</a></td>
</tr>

<td class=3D"vendor-product">rubengc--GamiPress Gamification plugin to rewa=
rd points, achievements, badges &amp; ranks in WordPress</td>
<td>The GamiPress - Gamification plugin to reward points, achievements, bad= ges &amp; ranks in WordPress plugin for WordPress is vulnerable to Stored C= ross-Site Scripting via 'heading_size' Shortcode Attribute in all versions =
up to, and including, 7.9.9.1 due to insufficient input sanitization and ou= tput escaping. This makes it possible for authenticated attackers, with con= tributor-level access and above, to inject arbitrary web scripts in pages t= hat will execute whenever a user accesses an injected page. The wp_kses_pos=
t filter applied at post save does not neutralize this payload because only=
the inert shortcode text is stored in post_content; the dangerous HTML is = synthesized at render time by the shortcode handler, entirely bypassing sav= e-time sanitization.</td>
<td>2026-07-28</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15730" target=3D= "_blank" rel=3D"noopener">CVE-2026-15730</a></td>
</tr>

<td class=3D"vendor-product">rubengc--GamiPress Gamification plugin to rewa=
rd points, achievements, badges &amp; ranks in WordPress</td>
<td>The GamiPress - Gamification plugin to reward points, achievements, bad= ges &amp; ranks in WordPress plugin for WordPress is vulnerable to Stored C= ross-Site Scripting via 'heading_size' Shortcode Attribute in 'gamipress_ac= hievement' in all versions up to, and including, 7.9.9.1 due to insufficien=
t input sanitization and output escaping. This makes it possible for authen= ticated attackers, with contributor-level access and above, to inject arbit= rary web scripts in pages that will execute whenever a user accesses an inj= ected page. WordPress save-time wp_kses_post does not neutralize this paylo=
ad because the injected value is stored inside a shortcode attribute rather=
than as a raw HTML tag, and is only emitted into HTML at render time witho=
ut escaping.</td>
<td>2026-08-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16090" target=3D= "_blank" rel=3D"noopener">CVE-2026-16090</a></td>
</tr>

<td class=3D"vendor-product">rubengc--GamiPress Gamification plugin to rewa=
rd points, achievements, badges &amp; ranks in WordPress</td>
<td>The GamiPress - Gamification plugin to reward points, achievements, bad= ges &amp; ranks in WordPress plugin for WordPress is vulnerable to Stored C= ross-Site Scripting via the 'gamipress_rank' Shortcode in all versions up t=
o, and including, 7.9.9.1 due to insufficient input sanitization and output=
escaping. This makes it possible for authenticated attackers, with contrib= utor-level access and above, to inject arbitrary web scripts in pages that = will execute whenever a user accesses an injected page.</td>

<td>2026-08-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16091" target=3D= "_blank" rel=3D"noopener">CVE-2026-16091</a></td>
</tr>

<td class=3D"vendor-product">s9y--Serendipity</td>
<td>Serendipity before 2.6.1 contains an open redirect vulnerability in exi= t.php that allows unauthenticated attackers to redirect users to arbitrary = external sites by supplying a malicious Base64-encoded url parameter when t=
he Track Exits plugin is configured with commentredirection set to s9y. Att= ackers can craft trusted-looking URLs leveraging the legitimate blog domain=
to conduct phishing, deliver malware, or bypass URL reputation filters.</t=

<td>2026-07-31</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67350" target=3D= "_blank" rel=3D"noopener">CVE-2026-67350</a></td>
</tr>

<td class=3D"vendor-product">saadiqbal--Gutena Forms Contact Form, Survey F= orm, Feedback Form, Booking Form, and Custom Form Builder</td>
<td>The Gutena Forms - Contact Form, Survey Form, Feedback Form, Booking Fo= rm, and Custom Form Builder plugin for WordPress is vulnerable to authoriza= tion bypass in all versions up to, and including, 1.9.0. This is due to the=
plugin not properly verifying that a user is authorized to perform an acti= on. This makes it possible for unauthenticated attackers to modify the read= /unread status of or permanently trash arbitrary form submission entries be= longing to any form. The nonce issued by check_ajax_referer() does not func= tion as an authorization barrier because the nonce action 'gutena_Forms' is=
emitted to unauthenticated visitors via wp_localize_script() on any public=
page that contains a Gutena Forms block, making it freely obtainable by an= onymous attackers.</td>
<td>2026-08-01</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11995" target=3D= "_blank" rel=3D"noopener">CVE-2026-11995</a></td>
</tr>

<td class=3D"vendor-product">SAP_SE--SAP NetWeaver Application Server for A= BAP</td>
<td>SAP NetWeaver Application Server for ABAP and ABAP Platform writes sens= itive session identifier information into a diagnostic trace when the trace=
is activated by a privileged user. An attacker with access to the resultin=
g trace data could obtain identifiers that allow impersonation of legitimat=
e users during their validity period.=C2=A0This leads to high impact on con= fidentiality. Integrity and availability are not impacted.</td> <td>2026-07-28</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58246" target=3D= "_blank" rel=3D"noopener">CVE-2026-58246</a></td>
</tr>

<td class=3D"vendor-product">Sayontan Sinha--Photonic Gallery &amp; Lightbo=
x for Flickr, SmugMug &amp; Others</td>
<td>Contributor Cross Site Scripting (XSS) in Photonic Gallery &amp; Lightb=
ox for Flickr, SmugMug &amp; Others &lt;=3D 3.33 versions.</td> <td>2026-07-27</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66434" target=3D= "_blank" rel=3D"noopener">CVE-2026-66434</a></td>
</tr>

<td class=3D"vendor-product">sdelements--lets-chat</td>
<td>Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerabilit=
y that allows authenticated attackers to crash the server by supplying a va= lid 24-character hex string room parameter that matches no document in the = database. Attackers can send a crafted GET /messages request causing an unc= aught TypeError in an asynchronous Mongoose callback that terminates the No= de.js server process, with the same defect reachable through multiple code = paths including the socket.io interface.</td>
<td>2026-07-28</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66749" target=3D= "_blank" rel=3D"noopener">CVE-2026-66749</a></td>
</tr>

<td class=3D"vendor-product">sdelements--lets-chat</td>
<td>Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulne= rability that allows any authenticated user to archive any room on the serv=
er by sending a DELETE request to the rooms handler without ownership verif= ication. Attackers can enumerate room IDs via the rooms listing endpoint an=
d permanently archive private or password-protected rooms they cannot acces=
s, with no application-level recovery path requiring direct database interv= ention to restore.</td>
<td>2026-07-28</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66751" target=3D= "_blank" rel=3D"noopener">CVE-2026-66751</a></td>
</tr>

<td class=3D"vendor-product">sdelements--lets-chat</td>
<td>Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnera= bility that allows authenticated attackers to download file attachments fro=
m private and password-protected rooms they are not a member of by exploiti=
ng missing room membership checks in the file retrieval route. Attackers ca=
n enumerate adjacent MongoDB ObjectIds derived from a known file ID to reco= ver files uploaded by other users, as the GET /files/:id/:name route in app= /controllers/files.js only enforces login authentication without consulting=
room membership or the Room.canJoin check.</td>
<td>2026-07-28</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66750" target=3D= "_blank" rel=3D"noopener">CVE-2026-66750</a></td>
</tr>

<td class=3D"vendor-product">sendpulse--SendPulse Email Marketing Newslette= r</td>
<td>The SendPulse Email Marketing Newsletter plugin for WordPress is vulner= able to Stored Cross-Site Scripting via _sp_form_code Post Meta in all vers= ions up to, and including, 2.2.5 due to insufficient input sanitization and=
output escaping. This makes it possible for authenticated attackers, with = contributor-level access and above, to inject arbitrary web scripts in page=
s that will execute whenever a user accesses an injected page. Exploitation=
requires the attacker to create a sendpulse_form post containing a benign = SendPulse loader script tag alongside arbitrary HTML (e.g., an img onerror = payload), which bypasses the allow-list check and executes in the browser o=
f any user - including administrators - who previews or views a page render= ing the [sendpulse-form] shortcode.</td>
<td>2026-08-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13362" target=3D= "_blank" rel=3D"noopener">CVE-2026-13362</a></td>
</tr>

<td class=3D"vendor-product">ShapedPlugin LLC--Location Weather</td> <td>Contributor Cross Site Scripting (XSS) in Location Weather &lt;=3D 3.0.=
6 versions.</td>
<td>2026-07-27</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66433" target=3D= "_blank" rel=3D"noopener">CVE-2026-66433</a></td>
</tr>

<td class=3D"vendor-product">Shufflehound--Gillion</td>
<td>Unauthenticated Broken Access Control in Gillion &lt;=3D 4.13 versions.= </td>
<td>2026-07-27</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66477" target=3D= "_blank" rel=3D"noopener">CVE-2026-66477</a></td>
</tr>

<td class=3D"vendor-product">softaculous--SpeedyCache Cache, Optimization, = Performance</td>
<td>The SpeedyCache plugin for WordPress is vulnerable to Arbitrary File Re=
ad via Path Traversal in all versions up to, and including, 1.3.8. This is = due to a mismatch between CSS URL validation (which allows query strings li=
ke `.css?...`) and path resolution (which strips query strings), combined w= ith no validation that the resolved file is actually a CSS file. This makes=
it possible for authenticated attackers, with Administrator-level access a=
nd above, to read arbitrary files from the server (including `wp-config.php=
` and `/etc/passwd`) by injecting crafted `&lt;link&gt;` tags into page con= tent, with the file contents written to publicly accessible cache files.</t=

<td>2026-07-28</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5114" target=3D"= _blank" rel=3D"noopener">CVE-2026-5114</a></td>
</tr>

<td class=3D"vendor-product">Spring--Spring Tools for Eclipse</td>
<td>Spring Tools for Eclipse stores the Spring Boot DevTools remote secret = (spring.devtools.remote.secret) as a plain string attribute on the "Spring = Boot DevTools Client" launch configuration. Eclipse persists launch configu= ration attributes as cleartext XML, either to workspace metadata or, if the=
user marks the configuration as a shared file, directly into the project t= ree where it can be committed to version control. This secret is the sole c= redential protecting the DevTools remote restart/reload endpoint, which acc= epts and executes arbitrary class bytes on the target application. Anyone a= ble to read the .launch file (via filesystem access, a workspace backup, or=
a shared VCS repository) can extract the secret and use it to achieve remo=
te code execution against the associated Spring Boot application. Affected = Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier</=

<td>2026-07-30</td>
<td>4.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59327" target=3D= "_blank" rel=3D"noopener">CVE-2026-59327</a></td>
</tr>

<td class=3D"vendor-product">Spring--Spring Tools for Eclipse</td>
<td>Spring Tools for Eclipse renders Spring Boot starter wizard dependency = tooltips in a native embedded browser (SWT Browser) with JavaScript enabled=
. Using untrusted and compromised Initializr endpoints for the Spring Boot = starter wizard can result in arbitrary script execution inside the embedded=
browser when a developer hovers a dependency checkbox in the New Spring St= arter Project wizard. Impact is limited to in-IDE UI spoofing and outbound = network beaconing rather than full code execution. Affected Spring Products=
and Versions: Spring Tools for Eclipse: 5.2.0 and earlier</td> <td>2026-07-30</td>
<td>4.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59328" target=3D= "_blank" rel=3D"noopener">CVE-2026-59328</a></td>
</tr>

<td class=3D"vendor-product">stellarwp--Kadence Blocks Page Builder Toolkit=
for Gutenberg Editor</td>
<td>The Kadence Blocks - Page Builder Toolkit for Gutenberg Editor plugin f=
or WordPress is vulnerable to Stored Cross-Site Scripting via Identity Bloc=
k Inner Image Content in all versions up to, and including, 3.7.8.1 due to = insufficient input sanitization and output escaping. This makes it possible=
for authenticated attackers, with contributor-level access and above, to i= nject arbitrary web scripts in pages that will execute whenever a user acce= sses an injected page. This vulnerability is only triggerable when the bloc= k's urlTransparent attribute is set to a non-empty value, as this is a requ= ired precondition for the vulnerable code path in build_html() to be reache= d.</td>
<td>2026-08-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18062" target=3D= "_blank" rel=3D"noopener">CVE-2026-18062</a></td>
</tr>

<td class=3D"vendor-product">stellarwp--Kadence Blocks Page Builder Toolkit=
for Gutenberg Editor</td>
<td>The Kadence Blocks - Page Builder Toolkit for Gutenberg Editor plugin f=
or WordPress is vulnerable to Stored Cross-Site Scripting via 'toggleIcon' = Block Attribute in all versions up to, and including, 3.7.8 due to insuffic= ient input sanitization and output escaping. This makes it possible for aut= henticated attackers, with contributor-level access and above, to inject ar= bitrary web scripts in pages that will execute whenever a user accesses an = injected page.</td>
<td>2026-08-01</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18435" target=3D= "_blank" rel=3D"noopener">CVE-2026-18435</a></td>
</tr>

<td class=3D"vendor-product">stiofansisland--Payment forms, Buy now buttons=
, and Invoicing System | GetPaid</td>
<td>The Payment forms, Buy now buttons, and Invoicing System | GetPaid plug=
in for WordPress is vulnerable to Local File Inclusion in all versions up t=
o, and including, 2.8.56 via the getpaid_payment_form_element function. Thi=
s makes it possible for authenticated attackers, with administrator-level a= ccess and above, to include and execute arbitrary .php files on the server,=
allowing the execution of any PHP code in those files. This can be used to=
bypass access controls, obtain sensitive data, or achieve code execution i=
n cases where .php file types can be uploaded and included.</td> <td>2026-08-01</td>
<td>6.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17605" target=3D= "_blank" rel=3D"noopener">CVE-2026-17605</a></td>
</tr>

<td class=3D"vendor-product">strangerstudios--Paid Memberships Pro Content = Restriction, User Registration, &amp; Paid Subscriptions</td>
<td>The Paid Memberships Pro - Content Restriction, User Registration, &amp=
; Paid Subscriptions plugin for WordPress is vulnerable to Stored Cross-Sit=
e Scripting via Readonly User Field via [pmpro_member_profile_edit] Shortco=
de in all versions up to, and including, 3.8.1 due to insufficient input sa= nitization and output escaping. This makes it possible for authenticated at= tackers, with subscriber-level access and above, to inject arbitrary web sc= ripts in pages that will execute whenever a user accesses an injected page.= </td>
<td>2026-07-28</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15016" target=3D= "_blank" rel=3D"noopener">CVE-2026-15016</a></td>
</tr>

<td class=3D"vendor-product">stylemix--MasterStudy LMS WordPress Plugin for=
Online Courses and Education</td>
<td>The MasterStudy LMS WordPress Plugin - for Online Courses and Education=
plugin for WordPress is vulnerable to Insecure Direct Object Reference in = all versions up to, and including, 3.7.14. This is due to the `stm_lms_dele= te_cover()` function lacking ownership validation on the `file_id` paramete=
r before passing it to `wp_delete_attachment()`. This makes it possible for=
authenticated attackers, with Instructor-level access and above, to delete=
arbitrary attachments belonging to any user by enumerating sequential atta= chment IDs.</td>
<td>2026-07-29</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5060" target=3D"= _blank" rel=3D"noopener">CVE-2026-5060</a></td>
</tr>

<td class=3D"vendor-product">StylemixThemes--MasterStudy LMS</td> <td>Insufficient Verification of Data Authenticity vulnerability in Stylemi= xThemes MasterStudy LMS allows Manipulating User State. This issue affects = MasterStudy LMS: from n/a through 3.7.39.</td>
<td>2026-07-31</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28145" target=3D= "_blank" rel=3D"noopener">CVE-2026-28145</a></td>
</tr>

<td class=3D"vendor-product">superplanehq--superplane</td>
<td>SuperPlane before 0.30.0 contains an SMTP header injection vulnerabilit=
y that allows unauthenticated attackers to inject arbitrary SMTP headers by=
including CRLF sequences in the event payload title field delivered via we= bhook. Attackers can manipulate the unsanitized title field passed to the S= MTP DATA command to add Bcc recipients for content exfiltration, forge the = From address to bypass SPF and DKIM checks, or inject Content-Type and MIME=
boundary headers to corrupt message bodies for phishing.</td> <td>2026-07-28</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57511" target=3D= "_blank" rel=3D"noopener">CVE-2026-57511</a></td>
</tr>

<td class=3D"vendor-product">svarshavchik--Courier IMAP</td>
<td>Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow au= thenticated IMAP users to crash the imapd process via deeply nested parenth= esized SEARCH queries. The SEARCH command parser (alloc_search_key in searc= hinfo.C) recursively descends on nested parenthesized groups through a mutu=
al recursion chain with alloc_search_andlist() and alloc_search_notkey(), w= ith no depth limit. Courier IMAP has no overall command line length limit, = making exploitation trivial. A single IMAP command with ~2500 nested parent= heses overflows the 8MB default stack, causing SIGSEGV.</td> <td>2026-07-29</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67194" target=3D= "_blank" rel=3D"noopener">CVE-2026-67194</a></td>
</tr>

<td class=3D"vendor-product">Syed Balkhi--Easy Digital Downloads</td> <td>Administrator Arbitrary File Deletion in Easy Digital Downloads &lt;=3D=
3.6.9 versions.</td>
<td>2026-07-27</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66476" target=3D= "_blank" rel=3D"noopener">CVE-2026-66476</a></td>
</tr>

<td class=3D"vendor-product">Sylius--MolliePlugin</td>
<td>Sylius Mollie Plugin provides Mollie payment integration for Sylius app= lications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_= locale}/thank-you PageRedirectController::thankYouAction and GET /{_locale}= /get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential o= rderId values without ownership or session checks, exposing order tokenValu=
e values that can be used with GET /{_locale}/register-after-checkout/{toke= nValue} to view customer first name, last name, and email. This issue is fi= xed in 2.2.8, 3.2.4, and 3.3.1.</td>
<td>2026-07-30</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-68501" target=3D= "_blank" rel=3D"noopener">CVE-2026-68501</a></td>
</tr>

<td class=3D"vendor-product">Systerel--S2OPC</td>
<td>Improper validity period check for root issuer certificate in CycloneCr= ypto cryptographic wrapper of S2OPC allows a certificate issued by this roo=
t issuer to be considered trusted</td>
<td>2026-07-29</td>
<td>5.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18257" target=3D= "_blank" rel=3D"noopener">CVE-2026-18257</a></td>
</tr>

<td class=3D"vendor-product">Tanium--Patch</td>
<td>Tanium addressed a SQL injection vulnerability in Patch.</td> <td>2026-07-28</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11391" target=3D= "_blank" rel=3D"noopener">CVE-2026-11391</a></td>
</tr>

<td class=3D"vendor-product">taskbuilder--Taskbuilder Project Management &a= mp; Task Management Tool With Kanban Board</td>
<td>The Taskbuilder - Project Management &amp; Task Management Tool With Ka= nban Board plugin for WordPress is vulnerable to SQL Injection via the 'wpp= m_proj_filter' parameter in versions up to, and including, 5.0.9. This is d=
ue to insufficient escaping on the user-supplied parameter and the lack of = sufficient preparation on the existing SQL query - the value is re-read at = line 144 using only sanitize_text_field() (overwriting the earlier absint()=
result), then concatenated into the SQL WHERE clause as an unquoted numeri=
c operand using only esc_sql(), which does not protect against injection in=
that context, and finally string-interpolated into the $wpdb-&gt;prepare()=
format string, bypassing parameterization entirely. This makes it possible=
for authenticated attackers, with subscriber-level access and above, to ap= pend additional SQL queries into already existing queries that can be used =
to extract sensitive information from the database.</td>
<td>2026-07-28</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15267" target=3D= "_blank" rel=3D"noopener">CVE-2026-15267</a></td>
</tr>

<td class=3D"vendor-product">Themeisle--Feedzy</td>
<td>Contributor Server Side Request Forgery (SSRF) in Feedzy &lt;=3D 5.2.4 = versions.</td>
<td>2026-07-27</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66437" target=3D= "_blank" rel=3D"noopener">CVE-2026-66437</a></td>
</tr>

<td class=3D"vendor-product">Themeisle--Orbit Fox by ThemeIsle</td>
<td>Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle &lt;=3D 3.0=
.7 versions.</td>
<td>2026-07-27</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65563" target=3D= "_blank" rel=3D"noopener">CVE-2026-65563</a></td>
</tr>

<td class=3D"vendor-product">Themeum--Kirki</td>
<td>Editor Arbitrary File Deletion in Kirki &lt;=3D 6.0.13 versions.</td> <td>2026-07-27</td>
<td>6.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65436" target=3D= "_blank" rel=3D"noopener">CVE-2026-65436</a></td>
</tr>

<td class=3D"vendor-product">themeum--Kirki Freeform Page Builder, Website = Builder &amp; Customizer</td>
<td>The Kirki - Freeform Page Builder, Website Builder &amp; Customizer plu= gin for WordPress is vulnerable to Path Traversal (Zip Slip) in all version=
s up to, and including, 6.0.13 via the extract_zip_file function. This make=
s it possible for authenticated attackers, with custom-level access and abo= ve, to write arbitrary files on the server, which can allow for remote code=
execution. The install_app, update_app, and get_kirki_template_from_zip co=
de paths accept a user-supplied app src value to construct the download URL=
, and no sanitization is applied to prevent a crafted ZIP from being fetche=
d and extracted with path-traversing entry names that escape the intended d= estination directory.</td>
<td>2026-08-01</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15601" target=3D= "_blank" rel=3D"noopener">CVE-2026-15601</a></td>
</tr>

<td class=3D"vendor-product">themeum--Tutor LMS eLearning and online course=
solution</td>
<td>The Tutor LMS - eLearning and online course solution plugin for WordPre=
ss is vulnerable to generic SQL Injection via the 'coupon_code' parameter i=
n all versions up to, and including, 4.0.1 due to insufficient escaping on = the user supplied parameter and lack of sufficient preparation on the exist= ing SQL query. This makes it possible for authenticated attackers, with adm= inistrator-level access and above, to append additional SQL queries into al= ready existing queries that can be used to extract sensitive information fr=
om the database.</td>
<td>2026-07-28</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15444" target=3D= "_blank" rel=3D"noopener">CVE-2026-15444</a></td>
</tr>

<td class=3D"vendor-product">themewant--RT Mega Menu Mega Menu Builder for = Elementor &amp; Gutenberg</td>
<td>Subscriber Cross Site Scripting (XSS) in RT Mega Menu - Mega Menu Build=
er for Elementor &amp;amp; Gutenberg &lt;=3D 1.5.1 versions.</td> <td>2026-07-27</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59559" target=3D= "_blank" rel=3D"noopener">CVE-2026-59559</a></td>
</tr>

<td class=3D"vendor-product">themewant--RT Mega Menu Mega Menu Builder for = Elementor &amp; Gutenberg</td>
<td>Subscriber Broken Access Control in RT Mega Menu - Mega Menu Builder fo=
r Elementor &amp;amp; Gutenberg &lt;=3D 1.5.1 versions.</td> <td>2026-07-27</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65433" target=3D= "_blank" rel=3D"noopener">CVE-2026-65433</a></td>
</tr>

<td class=3D"vendor-product">THEWP Digital Solutions--News Theme V8</td>

<td>Improper neutralization of input during web page generation ('cross-sit=
e scripting') vulnerability in THEWP Digital Solutions News Theme V8 allows=
Reflected XSS. This issue affects News Theme V8: through 16.06.2026.</td> <td>2026-07-28</td>
<td>6.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8167" target=3D"= _blank" rel=3D"noopener">CVE-2026-8167</a></td>
</tr>

<td class=3D"vendor-product">thorsten--phpMyFAQ</td>
<td>phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in = GroupController::updateMembers() that allows administrators with only group= -management permissions to join privileged groups without verification of r= equired rights. Attackers can add themselves to pre-existing groups holding=
user-management rights and immediately inherit those permissions to modify=
or delete user accounts.</td>
<td>2026-07-27</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66399" target=3D= "_blank" rel=3D"noopener">CVE-2026-66399</a></td>
</tr>

<td class=3D"vendor-product">Three Learning--Koollab LMS</td>
<td>An authentication bypass vulnerability in Koollab LMS allowed an unauth= enticated attacker to take over any account, including administrator accoun= ts, by supplying a valid user UUID without providing primary credentials vi=
a the 2FA validation endpoint.</td>
<td>2026-07-29</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63238" target=3D= "_blank" rel=3D"noopener">CVE-2026-63238</a></td>
</tr>

<td class=3D"vendor-product">Three Learning--Koollab LMS</td>
<td>A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed a=
n attacker to access shared multi-tenant S3 buckets and SQS queues, exposin=
g sensitive data and enabling malicious content injection, job manipulation=
, or email interception.</td>
<td>2026-07-29</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63239" target=3D= "_blank" rel=3D"noopener">CVE-2026-63239</a></td>
</tr>

<td class=3D"vendor-product">Three Learning--Koollab LMS</td>
<td>A TOTP two-factor authentication bypass vulnerability in Koollab LMS al= lowed an attacker to supply a client-controlled seed to generate a matching=
one-time password and bypass the second authentication factor, potentially=
enabling unauthorised access to administrator accounts.</td> <td>2026-07-29</td>
<td>4.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63237" target=3D= "_blank" rel=3D"noopener">CVE-2026-63237</a></td>
</tr>

<td class=3D"vendor-product">Three Learning--Koollab LMS</td>
<td>An information disclosure vulnerability in Koollab LMS allowed an authe= nticated learner to obtain correct quiz answers from the course status endp= oint without completing the assessment legitimately, compromising the integ= rity of assessments.</td>
<td>2026-07-29</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63240" target=3D= "_blank" rel=3D"noopener">CVE-2026-63240</a></td>
</tr>

<td class=3D"vendor-product">Three Learning--Koollab LMS</td>
<td>A business logic vulnerability in Koollab LMS allowed an authenticated = learner to set their lesson completion status to completed via the SCORM co= mmit endpoint without viewing the lesson material, compromising training an=
d completion records.</td>
<td>2026-07-29</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63242" target=3D= "_blank" rel=3D"noopener">CVE-2026-63242</a></td>
</tr>

<td class=3D"vendor-product">Thrive Themes Coupon--Thrive Leads Version</td=

<td>Unauthenticated Broken Access Control in Thrive Leads Version &lt;=3D 1= 0.9.2 versions.</td>
<td>2026-07-27</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65435" target=3D= "_blank" rel=3D"noopener">CVE-2026-65435</a></td>
</tr>

<td class=3D"vendor-product">tigroumeow--Media Cleaner: Clean your WordPres= s!</td>
<td>The Media Cleaner: Clean your WordPress! plugin for WordPress is vulner= able to Server-Side Request Forgery in all versions up to, and including, 7= .0.3. This is due to the `get_urls_from_html()` function using `DOMDocument= ::loadHTMLFile()` to fetch iframe source URLs with an insufficient hostname=
validation check that relies on a substring match against the site's serve=
r name. This makes it possible for authenticated attackers, with Administra= tor-level access and above, to make web requests to arbitrary locations ori= ginating from the web application, which can be used to query and interact = with internal services.</td>
<td>2026-07-28</td>
<td>4.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-4912" target=3D"= _blank" rel=3D"noopener">CVE-2026-4912</a></td>
</tr>

<td class=3D"vendor-product">Tim Strifler--Exclusive Addons Elementor</td> <td>Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor &= lt;=3D 2.8.0 versions.</td>
<td>2026-07-27</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66438" target=3D= "_blank" rel=3D"noopener">CVE-2026-66438</a></td>
</tr>

<td class=3D"vendor-product">timstrifler--Exclusive Addons for Elementor</t=

<td>The Exclusive Addons for Elementor plugin for WordPress is vulnerable t=
o Stored Cross-Site Scripting via the ' exad_infobox_image' parameter in al=
l versions up to, and including, 2.7.9.8 due to insufficient input sanitiza= tion and output escaping. This makes it possible for authenticated attacker=
s, with Contributor-level access and above, to inject arbitrary web scripts=
in pages that will execute whenever a user accesses an injected page.</td> <td>2026-08-02</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12231" target=3D= "_blank" rel=3D"noopener">CVE-2026-12231</a></td>
</tr>

<td class=3D"vendor-product">tiny-http--tiny-http</td>
<td>tiny-http through 0.12.0 contains an HTTP request smuggling vulnerabili=
ty that allows remote attackers to desynchronize request framing by sending=
a Transfer-Encoding header with any value, including non-chunked codings, = which causes the library to unconditionally apply chunk-decoding and discar=
d Content-Length. Attackers can exploit the discrepancy between tiny_http's=
improper Transfer-Encoding parsing and a correctly-implemented front-end p= roxy to produce two distinct interpretations of a single byte stream, enabl= ing request smuggling, and can additionally send non-chunked bodies with no= n-chunked Transfer-Encoding values to cause failed body reads that tie up c= onnections and consume worker threads without signaling errors to clients.<=

<td>2026-07-28</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66752" target=3D= "_blank" rel=3D"noopener">CVE-2026-66752</a></td>
</tr>

<td class=3D"vendor-product">tomaka--rouille</td>
<td>Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnera= bility that allows remote attackers to inject arbitrary response headers by=
embedding carriage return (0x0D) or line feed (0x0A) bytes into attacker-c= ontrolled input. Attackers can exploit percent-decoded query parameters ref= lected into response headers or inject bare LF characters into Cookie heade=
r values that are interpolated directly into Set-Cookie response headers, e= nabling cache poisoning, session fixation, and security header override att= acks such as bypassing CSP or CORS policies.</td>
<td>2026-07-28</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66746" target=3D= "_blank" rel=3D"noopener">CVE-2026-66746</a></td>
</tr>

<td class=3D"vendor-product">tomaka--rouille</td>
<td>Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerabilit=
y in the Request::remove_prefix function that allows remote unauthenticated=
attackers to crash the server by sending a crafted percent-encoded URL. At= tackers can send a request whose decoded path matches a configured prefix w= hile the raw percent-encoded path does not, causing the assert! to fail and=
triggering either a 500 error or full process termination depending on the=
panic configuration.</td>
<td>2026-07-28</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66754" target=3D= "_blank" rel=3D"noopener">CVE-2026-66754</a></td>
</tr>

<td class=3D"vendor-product">tomaka--rouille</td>
<td>Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerab= ility that allows remote attackers to desynchronize HTTP message boundaries=
by exploiting improper header forwarding in the proxy implementation. The = proxy in src/proxy.rs forwards the client's Transfer-Encoding header to ups= tream backends unchanged while transmitting a body already de-chunked by ti= ny_http, enabling CL.TE desynchronization attacks where attackers control w= here the backend believes the request body ends.</td>
<td>2026-07-28</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67181" target=3D= "_blank" rel=3D"noopener">CVE-2026-67181</a></td>
</tr>

<td class=3D"vendor-product">Tychesoftwares--Abandoned Cart Lite for WooCom= merce</td>
<td>Shop manager Cross Site Scripting (XSS) in Abandoned Cart Lite for WooC= ommerce &lt;=3D 6.8.0 versions.</td>
<td>2026-07-27</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65557" target=3D= "_blank" rel=3D"noopener">CVE-2026-65557</a></td>
</tr>

<td class=3D"vendor-product">uhop--node-re2</td>
<td>re2 provides Node.js bindings for Google's RE2 regular expression engin=
e. Prior to 1.25.2, re2's String.prototype.match implementation with a glob=
al RE2 pattern that can match the empty string fails to advance its native = matching cursor in lib/match.cc, causing an infinite loop and unbounded nat= ive memory growth that blocks the event loop and can exhaust host memory. T= his issue is fixed in 1.25.2.</td>
<td>2026-07-30</td>
<td>6.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-68499" target=3D= "_blank" rel=3D"noopener">CVE-2026-68499</a></td>
</tr>

<td class=3D"vendor-product">uhop--node-re2</td>
<td>re2 provides Node.js bindings for Google's RE2 regular expression engin=
e. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length o=
f a subject but uses it as a UTF-16 code-unit offset in exec, test, match, = replace, and split, allowing an attacker-influenced lastIndex on a non-ASCI=
I subject to trigger an out-of-bounds heap read and an uncatchable process = crash, with limited heap information disclosure in some cases. This issue i=
s fixed in 1.25.2.</td>
<td>2026-07-30</td>
<td>5.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67550" target=3D= "_blank" rel=3D"noopener">CVE-2026-67550</a></td>
</tr>

<td class=3D"vendor-product">undici--undici</td>
<td>undici's cache interceptor mishandles optional whitespace placed around=
the equals sign of a qualified no-cache or private Cache-Control directive=
. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.=
0, the parser either drops the directive or stores a field name with litera=
l quote characters, so the cache decision fails to recognize the qualificat= ion and the response is stored. In shared-cache mode, this lets a response = containing one user's authenticated data be served from cache to a later ca= ller, including an unauthenticated one, when both requests resolve to the s= ame cache key. It affects applications that enable the cache interceptor in=
shared mode, forward Authorization headers upstream, and receive cacheable=
responses with qualified directives padded with whitespace around the equa=
ls sign. This is the whitespace-around-equals variant that the fix for CVE-= 2026-9678 did not normalize, and it is fixed in undici 7.29.0 and 8.9.0.</t=

<td>2026-07-29</td>
<td>5.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14643" target=3D= "_blank" rel=3D"noopener">CVE-2026-14643</a></td>
</tr>

<td class=3D"vendor-product">undici--undici</td>
<td>undici does not validate the type property of a duck-typed blob-like re= quest body before using it as the Content-Type header on the HTTP/1.1 dispa= tcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.= 0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like = body (via request, stream, pipeline, or dispatch) whose type is derived fro=
m untrusted input allows an attacker to inject CRLF sequences and append ar= bitrary HTTP headers, potentially smuggling a second request past the upstr= eam. Native Blob objects are safe because their constructor strips CRLF fro=
m the type, and fetch is unaffected because it validates headers, but ecosy= stem libraries that build duck-typed blob shapes from user input can reach = the vulnerable path. This is the same defect class as CVE-2022-35948 and CV= E-2026-1527, on a header sink that the earlier fixes did not cover. The iss=
ue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.</td>
<td>2026-07-29</td>
<td>4.2</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15157" target=3D= "_blank" rel=3D"noopener">CVE-2026-15157</a></td>
</tr>

<td class=3D"vendor-product">undici--undici</td>
<td>undici's retry interceptor can deliver a response whose body length doe=
s not match the Content-Length header exposed to the application after a re= try or resume of a partial response. In undici before 6.28.0, from 7.0.0 up=
to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty=
upstream can return a partial response with a mismatched framing header, c= lose the socket early, and have the retry interceptor assemble a body of a = different length while the original Content-Length stays attached. Applicat= ions that use the retry interceptor and forward upstream headers and bodies=
downstream, such as proxies or gateways, may then emit an invalid HTTP res= ponse with a stale Content-Length, leading to downstream response desynchro= nization, connection hangs, or response corruption. Exploitation requires t=
he retry interceptor enabled, an upstream returning a mismatched partial re= sponse, and a downstream forwarder that does not remove or recalculate Cont= ent-Length. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.</td> <td>2026-07-29</td>
<td>4.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16728" target=3D= "_blank" rel=3D"noopener">CVE-2026-16728</a></td>
</tr>

<td class=3D"vendor-product">undici--undici</td>
<td>undici's setCookie function does not fully sanitize cookie attributes. =
In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up =
to before 8.9.0, a domain value is not checked for semicolons and entries i=
n the unparsed array are not sanitized, so attacker-influenced input can in= ject additional cookie attributes. For example, a domain value containing a=
semicolon can append attributes such as SameSite, and an unparsed entry ca=
n inject attributes such as HttpOnly, without the caller setting them. Appl= ications that pass user-controlled input to these fields, such as multi-ten= ant or reverse-proxy servers that scope session cookies to a tenant-supplie=
d domain, can have SameSite CSRF protections bypassed, or the Secure, HttpO= nly, and SameSite attributes forced, stripped, or overridden. The issue is = fixed in undici 6.28.0, 7.29.0, and 8.9.0.</td>
<td>2026-07-29</td>
<td>4.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16729" target=3D= "_blank" rel=3D"noopener">CVE-2026-16729</a></td>
</tr>

<td class=3D"vendor-product">unitedbyai--droidclaw</td>
<td>A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Aff= ected by this issue is some unknown functionality of the file server/src/ro= utes/goals.ts of the component Unsigned Scheduled Callback. This manipulati=
on causes authorization bypass. Remote exploitation of the attack is possib= le. The attack is considered to have high complexity. The exploitation is k= nown to be difficult. The exploit has been made available to the public and=
could be used for attacks. The project was informed of the problem early t= hrough an issue report but has not responded yet.</td>
<td>2026-07-27</td>
<td>5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17531" target=3D= "_blank" rel=3D"noopener">CVE-2026-17531</a></td>
</tr>

<td class=3D"vendor-product">Vacron--VIN-DS783E-E6</td>
<td>VIN-DS783E-E6 developed by Vacron has an Arbitrary File Read vulnerabil= ity, allowing authenticated remote attackers to exploit Relative Path Trave= rsal to download arbitrary system files.</td>
<td>2026-07-29</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18192" target=3D= "_blank" rel=3D"noopener">CVE-2026-18192</a></td>
</tr>

<td class=3D"vendor-product">Veeam--Service Provider Console</td>
<td>Improper handling of the returnUrl parameter in the Forgot Password fun= ction of Veeam Service Provider Console allows an unauthenticated attacker =
to control the domain of the generated password reset link. When the target=
ed user clicks the link delivered by email, the reset code is transmitted t=
o an attacker-controlled host, allowing the attacker to take over the accou= nt.</td>
<td>2026-07-30</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64635" target=3D= "_blank" rel=3D"noopener">CVE-2026-64635</a></td>
</tr>

<td class=3D"vendor-product">vendurehq--vendure</td>
<td>Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channe=
l authorization bypass vulnerability in stock-location.service.ts and asset= .service.ts update methods that allows channel-scoped administrators to mod= ify other tenants' data. Attackers can supply global IDs of StockLocation o=
r Asset entities from different channels to overwrite inventory locations o=
r catalog assets belonging to other tenants without proper channel isolatio=
n validation.</td>
<td>2026-07-30</td>
<td>6.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67347" target=3D= "_blank" rel=3D"noopener">CVE-2026-67347</a></td>
</tr>

<td class=3D"vendor-product">veraPDF--veraPDF-validation</td>
<td>veraPDF validation model is an implementation of the veraPDF validation=
model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains =
an XML External Entity vulnerability in PDFAValidator.validate(...) and GFP= DAcroForm.getdynamicRender(), where default DocumentBuilderFactory parsing =
of rich-text annotation or form-field values and XFA configurations in untr= usted PDFs can allow local file disclosure and outbound network requests. T= his issue is fixed in versions 1.30.2 and 1.31.71.</td>
<td>2026-07-29</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54082" target=3D= "_blank" rel=3D"noopener">CVE-2026-54082</a></td>
</tr>

<td class=3D"vendor-product">Visual Composer--Visual Composer Website Build= er</td>
<td>Contributor Broken Access Control in Visual Composer Website Builder &l= t;=3D 45.15.0 versions.</td>
<td>2026-07-27</td>
<td>5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65568" target=3D= "_blank" rel=3D"noopener">CVE-2026-65568</a></td>
</tr>

<td class=3D"vendor-product">Watchfire--BC550</td>
<td>The affected=C2=A0Watchfire Controller Software=C2=A0contains self-sign=
ed hard-coded RSA private keys and corresponding X.509 certificates used fo=
r authenticating and encrypting HTTPS/TLS connections to the controller's b= uilt-in web management interface. These keys are embedded in plaintext with=
in the application patch binaries in the firmware directly from Watchfire's=
Remote Support filestore.</td>
<td>2026-07-30</td>
<td>5.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5846" target=3D"= _blank" rel=3D"noopener">CVE-2026-5846</a></td>
</tr>

<td class=3D"vendor-product">wazuh--wazuh</td>
<td>Wazuh 5.0.0-beta1 (fixed in 5.0.0-beta3) does not validate or override = the cluster_name and cluster_node fields in inventory-sync Start FlatBuffer=
messages, while validating only the agentid against the authenticated agen=
t identity. This allows a low-privileged enrolled agent to spoof cluster at= tribution in indexed inventory and vulnerability documents by forging wazuh= .cluster.name values and influencing the document _id prefix, potentially t= ampering with inventory records or, in shared-indexer multi-cluster deploym= ents, poisoning another cluster's records when numeric agent IDs collide.</=

<td>2026-08-01</td>
<td>6.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67307" target=3D= "_blank" rel=3D"noopener">CVE-2026-67307</a></td>
</tr>

<td class=3D"vendor-product">wedevs--StoreGrowth Upsell, BOGO, Quick View, = Direct Checkout &amp; Side Cart for WooCommerce</td>
<td>The Storegrowth Sales Booster plugin for WordPress is vulnerable to Mis= sing Authorization in versions up to and including 2.1.0. This is due to a = missing capability check on the bogo_category_msg_create() AJAX handler, wh= ich is registered for both authenticated (wp_ajax_) and unauthenticated (wp= _ajax_nopriv_) users and only validates a nonce ('ajd_protected') that is e= mitted publicly via wp_localize_script() on every frontend page through fro= nt_scripts() . This makes it possible for unauthenticated attackers to modi=
fy the plugin's BOGO category-message configuration stored in the spsg_bogo= _general_settings option by reading the nonce from any public page and POST= ing attacker-controlled data to admin-ajax.</td>
<td>2026-07-28</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13110" target=3D= "_blank" rel=3D"noopener">CVE-2026-13110</a></td>
</tr>

<td class=3D"vendor-product">wedevs--StoreGrowth Upsell, BOGO, Quick View, = Direct Checkout &amp; Side Cart for WooCommerce</td>
<td>The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, D= irect Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to=
authorization bypass in all versions up to, and including, 2.1.0. This is = due to the plugin not properly verifying that a user is authorized to perfo=
rm an action. This makes it possible for unauthenticated attackers to overw= rite the spsg_popup_products option with arbitrary attacker-controlled data=
. The 'ajd_protected' nonce used as the sole gate is exposed to unauthentic= ated visitors on every frontend page through the BoGo module's wp_localize_= script call, rendering it ineffective as an authorization barrier.</td> <td>2026-07-28</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15411" target=3D= "_blank" rel=3D"noopener">CVE-2026-15411</a></td>
</tr>

<td class=3D"vendor-product">westerndeal--GSheetConnector CF7 Google Sheets=
Connector</td>
<td>The GSheetConnector - CF7 Google Sheets Connector with Real-Time Sync p= lugin for WordPress is vulnerable to generic SQL Injection via the 's' para= meter in all versions up to, and including, 5.2.1 due to insufficient escap= ing on the user supplied parameter and lack of sufficient preparation on th=
e existing SQL query. This makes it possible for authenticated attackers, w= ith administrator-level access and above, to append additional SQL queries = into already existing queries that can be used to extract sensitive informa= tion from the database. wp_unslash() strips magic-quote protection and sani= tize_text_field() does not escape SQL metacharacters, leaving single quotes=
and other SQL metacharacters intact before the value is interpolated into = the query.</td>
<td>2026-08-01</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16614" target=3D= "_blank" rel=3D"noopener">CVE-2026-16614</a></td>
</tr>

<td class=3D"vendor-product">withastro--astro</td>
<td>Astro is a web framework for content-driven websites. In versions 1.0.0=
through 4.0.18, the source.title and enclosure.type item fields in package= s/astro-rss/src/index.ts are interpolated directly into XML template string=
s without XML-character escaping before being parsed by fast-xml-parser. Bo=
th fields are validated only as z.string(), placing no restriction on XML s= pecial characters. An attacker who controls these values can inject arbitra=
ry XML into the generated RSS feed: a value containing " can break out of a=
n attribute (as with enclosure.type), and a value containing &lt;/source&gt=
; can close an element early and inject additional nodes (as with source.ti= tle). This corrupts feed structure, injects false metadata (for example, a = fake &lt;link&gt; pointing to a malicious URL), and can cause feed readers =
to misparse or display attacker-controlled content. In SSR mode (output: 's= erver'), the poisoned feed is served on every request to all subscribers. T= his issue has been fixed in version 4.0.19.</td>
<td>2026-07-27</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59728" target=3D= "_blank" rel=3D"noopener">CVE-2026-59728</a></td>
</tr>

<td class=3D"vendor-product">woocommerce--WooCommerce PayPal Payments</td> <td>The WooCommerce PayPal Payments plugin for WordPress is vulnerable to S= ensitive Information Disclosure due to an Insecure Direct Object Reference =
in all versions up to, and including, 3.3.2 via the `enqueue_paypal_insight= s_script_on_order_received()` function due to missing validation on a user = controlled key. This makes it possible for unauthenticated attackers to obt= ain sensitive order information including order keys, which can then be lev= eraged to access full customer billing details (name, email, phone, address=
) via the WooCommerce Store API within a 10-minute grace period after order=
creation.</td>
<td>2026-08-01</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-14073" target=3D= "_blank" rel=3D"noopener">CVE-2025-14073</a></td>
</tr>

<td class=3D"vendor-product">WP Chill--Gallery PhotoBlocks</td>
<td>Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks &lt;=3D 1= .3.3 versions.</td>
<td>2026-07-27</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66448" target=3D= "_blank" rel=3D"noopener">CVE-2026-66448</a></td>
</tr>

<td class=3D"vendor-product">wp-lab--WP-Lister Lite for eBay</td>
<td>The WP-Lister Lite for eBay plugin for WordPress is vulnerable to gener=
ic SQL Injection via the 'orderby' parameter in all versions up to, and inc= luding, 3.8.8 due to insufficient escaping on the user supplied parameter a=
nd lack of sufficient preparation on the existing SQL query. This makes it = possible for authenticated attackers, with administrator-level access and a= bove, to append additional SQL queries into already existing queries that c=
an be used to extract sensitive information from the database.</td> <td>2026-07-29</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11973" target=3D= "_blank" rel=3D"noopener">CVE-2026-11973</a></td>
</tr>

<td class=3D"vendor-product">WPCenter--AffiliateX</td>
<td>Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX &lt;=
=3D 2.3.5 versions.</td>
<td>2026-07-27</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65558" target=3D= "_blank" rel=3D"noopener">CVE-2026-65558</a></td>
</tr>

<td class=3D"vendor-product">wpclever--WPC Badge Management for WooCommerce= </td>
<td>The WPC Badge Management for WooCommerce plugin for WordPress is vulner= able to Stored Cross-Site Scripting via the 'text' attribute of the `wpcbm_= best_seller` shortcode in all versions up to, and including, 3.1.6 due to i= nsufficient input sanitization and output escaping on user supplied attribu= tes. This makes it possible for authenticated attackers, with Contributor-l= evel access and above, to inject arbitrary web scripts in pages that will e= xecute whenever a user accesses an injected page.</td>
<td>2026-07-29</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7436" target=3D"= _blank" rel=3D"noopener">CVE-2026-7436</a></td>
</tr>

<td class=3D"vendor-product">WPDeveloper--BetterDocs</td>
<td>Contributor Cross Site Scripting (XSS) in BetterDocs &lt;=3D 4.6.2 vers= ions.</td>
<td>2026-07-27</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65562" target=3D= "_blank" rel=3D"noopener">CVE-2026-65562</a></td>
</tr>

<td class=3D"vendor-product">wpeverest--PDFDraft Drag &amp; Drop PDF Builde=
r, PDF Viewer, Embed &amp; Download PDF, Certificate &amp; Invoice Designer= </td>
<td>The PDFDraft - Drag &amp; Drop PDF Builder, PDF Viewer, Embed &amp; Dow= nload PDF, Certificate &amp; Invoice Designer plugin for WordPress is vulne= rable to unauthorized access of data due to a missing capability check on t=
he serveTemplatePdfAjax() function and the serveTemplatePdf() REST route (w= hich is registered with `permission_callback =3D&gt; '__return_true'`) in v= ersions up to, and including, 1.1.0. This makes it possible for unauthentic= ated attackers to download stored template PDFs - which may contain custome=
r PII, invoice, order, and certificate data - by requesting the publicly re= gistered admin-ajax action `pdfdraft_embed_pdf` or the REST endpoint `/wp-j= son/pdfdraft/v1/embed-pdf/templates/{slug}/pdf` with a known or guessable d= esign slug, bypassing the plugin's own .</td>
<td>2026-07-28</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12124" target=3D= "_blank" rel=3D"noopener">CVE-2026-12124</a></td>
</tr>

<td class=3D"vendor-product">wplakeorg--Advanced Views Display Custom Field=
s (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, = Elementor, Divi, Beaver</td>
<td>The Advanced Views - Display Custom Fields (ACF, Pods, MetaBox), Posts,=
CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver plugin=
for WordPress is vulnerable to Sensitive Information Exposure in all versi= ons up to, and including, 3.9.1 via the register_rest_routes. This makes it=
possible for authenticated attackers, with subscriber-level access and abo= ve, to extract sensitive admin-authored editor content - including template=
markup, CSS code, JavaScript code, and PHP controller variables - for any = Layout or Post Selection post on the site.</td>
<td>2026-08-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17580" target=3D= "_blank" rel=3D"noopener">CVE-2026-17580</a></td>
</tr>

<td class=3D"vendor-product">wplegalpages--WPLP Cookie Consent Cookie Banne=
r &amp; Consent Management for GDPR, CCPA &amp; Google Consent Mode</td> <td>The Cookie Banner for GDPR / CCPA - WPLP Cookie Consent plugin for Word= Press is vulnerable to Cross-Site Request Forgery in all versions up to, an=
d including, 4.3.7. This is due to missing or incorrect nonce validation on=
the process_bulk_action function. This makes it possible for unauthenticat=
ed attackers to permanently delete or forcibly resolve arbitrary GDPR data = request records stored in the wpl_data_req table via a forged request grant=
ed they can trick a site administrator into performing an action such as cl= icking on a link.</td>
<td>2026-07-28</td>
<td>4.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15136" target=3D= "_blank" rel=3D"noopener">CVE-2026-15136</a></td>
</tr>

<td class=3D"vendor-product">wpmanageninja--Fluent Forms Customizable Conta=
ct Forms, Survey, Quiz, &amp; Conversational Form Builder</td>
<td>The Fluent Forms - Customizable Contact Forms, Survey, Quiz, &amp; Conv= ersational Form Builder plugin for WordPress is vulnerable to Reflected Cro= ss-Site Scripting via 'param' in all versions up to, and including, 6.2.8 d=
ue to insufficient input sanitization and output escaping. This makes it po= ssible for unauthenticated attackers to inject arbitrary web scripts in pag=
es that execute if they can successfully trick a user into performing an ac= tion such as clicking on a link.</td>
<td>2026-08-01</td>
<td>6.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17571" target=3D= "_blank" rel=3D"noopener">CVE-2026-17571</a></td>
</tr>

<td class=3D"vendor-product">wpmanageninja--Fluent Forms Customizable Conta=
ct Forms, Survey, Quiz, &amp; Conversational Form Builder</td>
<td>The Fluent Forms - Customizable Contact Forms, Survey, Quiz, &amp; Conv= ersational Form Builder plugin for WordPress is vulnerable to Insecure Dire=
ct Object Reference in all versions up to, and including, 6.2.8 via the 'tr= ansaction' parameter due to missing validation on a user controlled key. Th=
is makes it possible for unauthenticated attackers to brute-force valid tra= nsaction hashes and view sensitive payment receipt data including customer = name, email address, billing address, order items, payment method, and paym= ent status belonging to other users. Because submission ID, form ID, and tr= ansaction creation time are either observable or guessable by an attacker, = the effective brute-force space is bounded to approximately 900 candidates = per second per (submission, form) pair, making exploitation practical witho=
ut any prior authentication or account.</td>
<td>2026-07-31</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17567" target=3D= "_blank" rel=3D"noopener">CVE-2026-17567</a></td>
</tr>

<td class=3D"vendor-product">wpvividplugins--WPvivid Backup, Migration &amp=
; Staging</td>
<td>The WPvivid Backup &amp; Migration plugin for WordPress is vulnerable t=
o SQL Injection via the export_data parameter in versions up to, and includ= ing, 0.9.131. This is due to insufficient escaping on the user supplied par= ameter and lack of sufficient preparation on the existing SQL query. The va= lues are received in prepare_export_post(), passed through sanitize_text_fi= eld() and stripslashes(), JSON-decoded, and the attacker-controlled JSON ob= ject keys are collected as $posts_ids without integer casting. They are sto= red in the export task options and later joined with commas and interpolate=
d directly into a `WHERE ID IN (...)` clause inside a $wpdb-&gt;get_results=
() call in export_post_to_xml() (unquoted, numeric context), with no $wpdb-= &gt;prepare() or esc_sql(). This makes it possible for authenticated attack= ers, with Administrator-level access and above, to append additional SQL qu= eries into already existing queries that can be used to extract sensitive i= nformation from the database.</td>
<td>2026-08-01</td>
<td>4.9</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17555" target=3D= "_blank" rel=3D"noopener">CVE-2026-17555</a></td>
</tr>

<td class=3D"vendor-product">wpxpo--WowStore Store Builder &amp; Product Bl= ocks for WooCommerce</td>
<td>The WowStore - Store Builder &amp; Product Blocks for WooCommerce plugi=
n for WordPress is vulnerable to Stored Cross-Site Scripting via 'filterMob= ileText' Block Attribute in all versions up to, and including, 4.4.24 due t=
o insufficient input sanitization and output escaping. This makes it possib=
le for authenticated attackers, with contributor-level access and above, to=
inject arbitrary web scripts in pages that will execute whenever a user ac= cesses an injected page. The save-time wp_kses_post sanitization is ineffec= tive because the payload is stored inside a Gutenberg block delimiter comme=
nt as JSON, which wp_kses_post preserves, allowing an attribute-breakout st= ring to survive to the server-side render_callback.</td>
<td>2026-07-29</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17161" target=3D= "_blank" rel=3D"noopener">CVE-2026-17161</a></td>
</tr>

<td class=3D"vendor-product">wpxpo--WowStore Store Builder &amp; Product Bl= ocks for WooCommerce</td>
<td>The WowStore - Store Builder &amp; Product Blocks for WooCommerce plugi=
n for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPo= stId' Block Attribute in all versions up to, and including, 4.4.24 due to i= nsufficient input sanitization and output escaping. This makes it possible = for authenticated attackers, with contributor-level access and above, to in= ject arbitrary web scripts in pages that will execute whenever a user acces= ses an injected page.</td>
<td>2026-07-29</td>
<td>6.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17162" target=3D= "_blank" rel=3D"noopener">CVE-2026-17162</a></td>
</tr>

<td class=3D"vendor-product">xdan--jodit</td>
<td>Jodit Editor is a WYSIWYG editor with a built-in file browser &amp; ima=
ge editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to us=
e isDangerousUrl to normalize javascript: href values before checking the s= cheme, allowing case variants, control-byte prefixes, and embedded tabs or = newlines to bypass filtering and execute attacker-controlled script when a = victim clicks a stored link rendered by an application. This issue is fixed=
in version 4.12.31.</td>
<td>2026-07-31</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62324" target=3D= "_blank" rel=3D"noopener">CVE-2026-62324</a></td>
</tr>

<td class=3D"vendor-product">Xlight--Xlight FTP Server</td>
<td>Xlight FTP Server before 3.9.5 contains an information disclosure vulne= rability that allows unauthenticated attackers to obtain the server's curre=
nt GetTickCount() value by sending a USER command with a username ending in=
the :adm suffix. Attackers can trigger the admin protocol path within the = standard FTP listener pre-authentication to leak timing information from th=
e FTP 331 response without requiring a separate port or configuration chang= e.</td>
<td>2026-07-29</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67193" target=3D= "_blank" rel=3D"noopener">CVE-2026-67193</a></td>
</tr>

<td class=3D"vendor-product">YayCommerce--YayPricing</td>
<td>Subscriber Broken Access Control in YayPricing &lt;=3D 3.5.6 versions.<=

<td>2026-07-27</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66442" target=3D= "_blank" rel=3D"noopener">CVE-2026-66442</a></td>
</tr>

<td class=3D"vendor-product">yoomoney--Kassa WooCommerce</td>
<td>Subscriber Sensitive Data Exposure in =C3=90=C2=AEKassa =C3=90=C2=B4=C3= =90=C2=BB=C3=91=C2=8F WooCommerce &lt;=3D 2.16.1 versions.</td> <td>2026-07-27</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65434" target=3D= "_blank" rel=3D"noopener">CVE-2026-65434</a></td>
</tr>

<td class=3D"vendor-product">zephyrproject--zephyr</td>
<td>The userspace verifier z_vrfy_log_filter_set() for the log_filter_set s= yscall in subsys/logging/log_mgmt.c performed a signed comparison against t=
he int16_t src_id parameter: src_id &lt; (int16_t)log_src_cnt_get(domain_id=
). Any negative value for src_id (e.g. -1) trivially satisfied this check a=
nd was forwarded into z_impl_log_filter_set, where it propagated to filter_= set() and ultimately to get_dynamic_filter(), which uses source_id as an un= signed index into the linker-section array &amp;TYPE_SECTION_START(log_dyna= mic)[source_id].filters. After implicit conversion through uint32_t, an int= 16_t -1 becomes 0xFFFFFFFF, indexing log_dynamic far out of bounds and caus= ing the kernel to perform an OOB read and an OOB read-modify-write (LOG_FIL= TER_SLOT_GET/SET) against memory adjacent to the log_dynamic section. The w= ritten value is a constrained 3-bit log level slot within the targeted 32-b=
it word, but the target address is attacker-chosen (a small negative offset=
from log_dynamic) and the write occurs in supervisor mode following a sysc= all from an unprivileged user thread, providing a kernel memory-corruption =
/ privilege-escalation primitive. The defect is reachable on any build with=
CONFIG_USERSPACE=3Dy and CONFIG_LOG_RUNTIME_FILTERING=3Dy. Present from Ze= phyr v3.3.0 through v4.4.1. The fix replaces the signed bound check with an=
unsigned comparison: (uint32_t)src_id &lt; log_src_cnt_get(domain_id), whi=
ch correctly rejects negative inputs.</td>
<td>2026-07-27</td>
<td>6.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10682" target=3D= "_blank" rel=3D"noopener">CVE-2026-10682</a></td>
</tr>

<td class=3D"vendor-product">zephyrproject--zephyr</td>
<td>Zephyr's Bluetooth host declares a GATT characteristic as two consecuti=
ve attributes: a Characteristic Declaration whose permission is hard-coded =
to BT_GATT_PERM_READ, and a Characteristic Value attribute that carries the=
application-specified security permissions (e.g. BT_GATT_PERM_READ_ENCRYPT=
/ READ_AUTHEN / READ_LESC). The public notify and indicate APIs explicitly=
accept either attribute, and passing the declaration is the documented, co= mmon idiom. Before sending each notification or indication, the host re-che= cks link security with bt_gatt_check_perm() against params-&gt;attr in gatt= _notify(), gatt_indicate(), and gatt_notify_multiple_verify_params() (subsy= s/bluetooth/host/gatt.c). When the application passed the Characteristic De= claration attribute, the host correctly redirected the value handle but lef=
t params-&gt;attr pointing at the declaration, so the security check evalua= ted the declaration's permissions (no security required) instead of the val= ue's. As a result the encryption/authentication/LESC requirement configured=
on the characteristic value was skipped. The Notify-Multiple path addition= ally used a mask that omitted the LE Secure Connections requirement. A remo=
te peer triggers the disclosure by connecting (optionally without pairing o=
r encryption) and writing the Client Characteristic Configuration descripto=
r to enable notifications or indications, causing the server to emit the pr= otected value over a link that has not reached the required security level.=
The impact is information disclosure / access-control bypass for character= istic values the application intended to expose only over a secured link; e= xposure depends on the application declaring encrypt/authen-required notify= /indicate characteristics and on the CCC being writable at a lower security=
tier. There is no memory-safety or availability impact. The fix adds bt_ga= tt_attr_resolve_value(), which maps a declaration attribute to the followin=
g value attribute before the permission check, and switches the Notify-Mult= iple path to the full BT_GATT_PERM_READ_ENCRYPT_MASK so the LESC requiremen=
t is also enforced.</td>
<td>2026-08-01</td>
<td>6.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-2411" target=3D"= _blank" rel=3D"noopener">CVE-2026-2411</a></td>
</tr>

<td class=3D"vendor-product">zephyrproject--zephyr</td>
<td>Zephyr's IPv6 forwarding path re-sent routed unicast packets without ev=
er decrementing the IPv6 hop limit. Both routing branches of ipv6_route_pac= ket() (subsys/net/ip) were affected: the explicit-route path (net_route_pac= ket()) and the on-link cross-interface path (net_route_packet_if()). Each s=
et the packet forwarding flag and called net_send_data() with the hop limit=
untouched and no expiry check. Per RFC 8200 the hop-limit decrement is the=
mechanism that bounds packet lifetime and terminates routing loops; withou=
t it, a device acting as an IPv6 router relays looping packets indefinitely=
. An on-path attacker who can induce or exploit a transient L3 loop turns i=
t into a permanent forwarding storm, causing CPU/bandwidth resource exhaust= ion (availability DoS) on the forwarder and adjacent links; path-discovery = and loop diagnostics that rely on hop-limit expiry are also defeated. Affec= ted configurations. In every affected release the forwarding path is reache=
d via CONFIG_NET_ROUTE (enabled by default when CONFIG_NET_IPV6_NBR_CACHE i=
s set), together with CONFIG_NET_ROUTING for cross-interface routing. Note = that CONFIG_NET_IPV6_FORWARDING and CONFIG_NET_IPV4_FORWARDING - which appe=
ar in the fix and in this advisory's evidence notes - were introduced after=
v4.4.0, when the routing options were split and renamed; they do not exist=
in any affected release. When auditing a v4.4.1-or-earlier configuration, = look for CONFIG_NET_ROUTE and CONFIG_NET_ROUTING. IPv4 is not affected in a=
ny release. The IPv4 forwarding path (net_route_ipv4_packet() in route_ipv4= .c) was added after v4.4.0 and has never shipped in a release. Its TTL decr= ement and IPv4 header-checksum recomputation landed on main as part of the = same fix, so the evidence notes below discuss it, but no released version i=
s reachable by way of IPv4. Affected releases are v1.8.0 through v4.4.1: v1= .8.0 introduced net_route_packet() and v2.2.0 added net_route_packet_if(), = and neither decremented the hop limit. v4.3.1 carries the explicit-route fi=
x but not the on-link one, so it is affected as well. Fixed on main by 7d8f= 1afa7345 (explicit-route path) and 589eadc74efa (on-link path).</td> <td>2026-07-31</td>
<td>5.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10686" target=3D= "_blank" rel=3D"noopener">CVE-2026-10686</a></td>
</tr>

<td class=3D"vendor-product">zephyrproject--zephyr</td>
<td>The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsys/net/lib/d= hcpv4/dhcpv4.c indexes a static 8-element const char * name table after a f= aulty bounds check. The guard used msg_type &lt;=3D sizeof(name) instead of=
msg_type &lt;=3D ARRAY_SIZE(name); sizeof returns the byte size of the poi= nter array (32 on 32-bit, 64 on 64-bit targets) rather than the element cou=
nt of 8, so message-type values from 9 up to that byte size pass the check = and cause name[msg_type - 1] to read past the end of the array. The msg_typ=
e value originates from the DHCP MESSAGE TYPE option, which is read as an u= nchecked raw byte from a received packet (net_pkt_read_u8) and passed unmod= ified into the lookup. A DHCP server, or any host able to inject a spoofed = DHCP reply onto the client's link, can therefore drive the index out of bou= nds. The out-of-range slot yields a garbage const char * that is then deref= erenced by a %s log conversion. The lookup is reached only from a debug log=
statement (NET_DBG / LOG_DBG), so the out-of-bounds read is triggerable on=
ly when the DHCPv4 log module is built at DEBUG level (CONFIG_NET_DHCPV4_LO= G_LEVEL_DBG), which is not the default configuration. When that condition h= olds, the result is an out-of-bounds read and a wild-pointer dereference: m= ost likely a crash of the DHCP client (denial of service) and potentially d= isclosure of an adjacent pointer's contents through the log output. The fix=
replaces sizeof with ARRAY_SIZE, restoring the correct 1..8 acceptance win= dow.</td>
<td>2026-08-01</td>
<td>5.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10773" target=3D= "_blank" rel=3D"noopener">CVE-2026-10773</a></td>
</tr>

<td class=3D"vendor-product">ZJONSSON--node-unzipper</td>
<td>A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. = Affected by this vulnerability is the function Extract of the file lib/extr= act.js. This manipulation causes path traversal. The attack requires local = access. The exploit has been publicly disclosed and may be utilized. The pr= oject was informed of the problem early through an issue report but has not=
responded yet.</td>
<td>2026-07-27</td>
<td>5.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17514" target=3D= "_blank" rel=3D"noopener">CVE-2026-17514</a></td>
</tr>
</tbody>
</table>
<p><a href=3D"#top">Back to top</a></p>
</div>
<div id=3D"low_v">
<h2 id=3D"low_v_title">Low Vulnerabilities</h2>
<table class=3D"table no-tablesaw" style=3D"table-layout: fixed; width: 100= %;" border=3D"1" summary=3D"Low Vulnerabilities">
<thead>

<th class=3D"vendor-product" style=3D"width: 24%;" scope=3D"col">
<span class=3D"primary-vendor">Primary</span><br><span class=3D"primary-ven= dor">Vendor</span> -- Product</th>
<th style=3D"width: 44%;" scope=3D"col">Description</th>
<th style=3D"width: 10%;" scope=3D"col">Published</th>
<th style=3D"width: 8%;" scope=3D"col">CVSS Score</th>
<th style=3D"width: 7%;" scope=3D"col">Source Info</th>
</tr>
</thead>
<tbody>

<td class=3D"vendor-product">Apache Software Foundation--Apache Traffic Ser= ver</td>
<td>The Apache Traffic Server multiplexer plugin overruns its chunk-decode = buffer on upstream input, enabling denial of service. This issue affects Ap= ache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, f= rom 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.=
15 or 10.1.4, which fix the issue.</td>
<td>2026-07-29</td>
<td>3.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58187" target=3D= "_blank" rel=3D"noopener">CVE-2026-58187</a></td>
</tr>

<td class=3D"vendor-product">better-auth--better-auth</td>
<td>better-auth versions before 1.6.11 fail to delete cached sessions when = removing users via admin, anonymous, or SCIM endpoints when secondaryStorag=
e is configured and storeSessionInDatabase is false. Attackers can reuse de= leted user session tokens to maintain authentication for up to seven days a= fter account deletion.</td>
<td>2026-08-01</td>
<td>3.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67334" target=3D= "_blank" rel=3D"noopener">CVE-2026-67334</a></td>
</tr>

<td class=3D"vendor-product">contao--contao</td>
<td>Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authe= nticated backend user who can access one job can request an attachment iden= tifier containing ../ segments and make the job attachment download endpoin=
t read a file from another job directory inside var/job-attachments. The co= ntroller authorizes only the jobUuid route parameter. The later attachment = lookup joins that authorized job UUID with the attacker-controlled identifi= er, then passes the combined path to the virtual filesystem. VirtualFilesys= tem::resolve() canonicalizes the whole path and only rejects paths that esc= ape the filesystem mount, so authorized-job/../victim-job/debug_log.csv bec= omes victim-job/debug_log.csv. This is a cross-job authorization bypass for=
known job attachment paths. It is not a practical brute-force against unkn= own jobs because job directories are UUID v4 values.</td>
<td>2026-07-31</td>
<td>3.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55825" target=3D= "_blank" rel=3D"noopener">CVE-2026-55825</a></td>
</tr>

<td class=3D"vendor-product">contao--contao</td>
<td>Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0= -RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS = feed URLs from FeedReaderController::getResponse() to feedIo-&gt;read() wit= hout scheme or private-address validation, allowing a backend user with mod= ule-edit permissions to make the server request internal network services, = loopback addresses, or cloud metadata endpoints. In core-bundle/src/Control= ler/FrontendModule/FeedReaderController.php, the getResponse() function ite= rates over the configured feed URLs and passes each one directly to the HTT=
P client (via $this-&gt;feedIo-&gt;read($url, new Feed())) with no validati= on, while the DCA field definition for rss_feed in tl_module.php carries no=
URL scheme or host validation and the HTTP client is wired as @psr18.http_= client (Symfony HttpClient) with no SSRF protection configured, since NoPri= vateNetworkHttpClient is not used. This issue is fixed in versions 5.3.48.<=

<td>2026-07-31</td>
<td>3.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57232" target=3D= "_blank" rel=3D"noopener">CVE-2026-57232</a></td>
</tr>

<td class=3D"vendor-product">contao--contao</td>
<td>Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.= 7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts=
. Contao's crawler tries to prevent confidential HTTP client options from b= eing sent to external domains by creating a scoped client: full options for=
root page origins, cleaned options for everything else. The cleaner remove=
s Cookie and Authorization headers, but it removes the non-Symfony option n= ames basic_auth and bearer_auth instead of Symfony HttpClient's real auth_b= asic and auth_bearer options. When contao.crawl.default_http_client_options=
contains Basic or Bearer authentication for a protected staging/production=
site, those credentials remain in the "clean" client used for external lin=
ks or configured additional URIs. An attacker who can get an external URL c= rawled, for example through a link on a crawled page while the broken-link = checker is enabled, can receive the crawler credentials. This issue has bee=
n fixed in versions 5.3.47 and 5.7.7.</td>
<td>2026-07-31</td>
<td>2.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55824" target=3D= "_blank" rel=3D"noopener">CVE-2026-55824</a></td>
</tr>

<td class=3D"vendor-product">EShare--ESharePro</td>
<td>Successful exploitation of this vulnerability could allow an attacker w= ith local network access to bypass the application's rate-limiting mechanis=
m, enabling brute-forcing of the screen-sharing code and potentially displa= ying harmful content on the affected screen.</td>
<td>2026-07-28</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55977" target=3D= "_blank" rel=3D"noopener">CVE-2026-55977</a></td>
</tr>

<td class=3D"vendor-product">FreeRDP--FreeRDP</td>
<td>FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability=
in the UVC H.264 extension-unit parser that fails to validate descriptor l= ength before accessing the GUID field. A local attacker with a malicious US=
B video camera can trigger a heap read beyond allocated bounds during camer=
a stream setup, causing denial of service.</td>
<td>2026-08-01</td>
<td>2.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66401" target=3D= "_blank" rel=3D"noopener">CVE-2026-66401</a></td>
</tr>

<td class=3D"vendor-product">ggml-org--whisper.cpp</td>
<td>A vulnerability has been found in ggml-org whisper.cpp 1.8.4-58. This i= mpacts the function log_mel_spectrogram of the file src/whisper.cpp. The ma= nipulation leads to out-of-bounds read. The attack needs to be performed lo= cally. The pull request to fix this issue awaits acceptance.</td>

<td>2026-07-27</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17512" target=3D= "_blank" rel=3D"noopener">CVE-2026-17512</a></td>
</tr>

<td class=3D"vendor-product">ggml-org--whisper.cpp</td>
<td>A vulnerability was found in ggml-org whisper.cpp 95ea8f9b. Affected is=
the function ggml_ftype_to_ggml_type of the file ggml/src/ggml.c. The mani= pulation of the argument ftype results in reachable assertion. The attack r= equires a local approach. The project was informed of the problem early thr= ough an issue report but has not responded yet.</td>
<td>2026-07-27</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17513" target=3D= "_blank" rel=3D"noopener">CVE-2026-17513</a></td>
</tr>

<td class=3D"vendor-product">GitLab--GitLab</td>
<td>GitLab has remediated an issue in GitLab CE/EE affecting all versions f= rom 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that und=
er certain conditions could have allowed an authenticated user with develop= er-role permissions to commit changes to a project after being removed as a=
member, due to improper authorization checks on merge request collaboratio=
n settings.</td>
<td>2026-07-29</td>
<td>3.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-14562" target=3D= "_blank" rel=3D"noopener">CVE-2025-14562</a></td>
</tr>

<td class=3D"vendor-product">HCL Software--HCL iControl</td>
<td>HCL iControl was affected by Information Exposure Through Verbose Clien= t-Side API Error Messages vulnerabilities. It involves application displays=
raw server/API error messages to users instead of generic error messages a=
nd exposes internal endpoint names, request parameters, error codes, and au= thentication status</td>
<td>2026-07-31</td>
<td>3.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56568" target=3D= "_blank" rel=3D"noopener">CVE-2026-56568</a></td>
</tr>

<td class=3D"vendor-product">HCL Software--HCL iControl</td>
<td>HCL iControl was affected by Auto complete Enabled vulnerabilities. It = involves expose sensitive information such as: Valid usernames, Email addre= sses used for login, Account identifiers If the system is accessed from sha= red environments, attackers may enumerate valid usernames through browser s= uggestions.</td>
<td>2026-07-31</td>
<td>3.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56570" target=3D= "_blank" rel=3D"noopener">CVE-2026-56570</a></td>
</tr>

<td class=3D"vendor-product">HCL Software--HCL iControl</td>
<td>HCL iControl was affected by Improper Error Handling vulnerabilities. I=
t involves Out of memory, null pointer exceptions, system call failure, dat= abase unavailable, network timeout, and hundreds of other common conditions=
can cause errors to be generated.</td>
<td>2026-07-31</td>
<td>3.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56571" target=3D= "_blank" rel=3D"noopener">CVE-2026-56571</a></td>
</tr>

<td class=3D"vendor-product">HCLSoftware--Connections</td>
<td>HCL Connections is vulnerable to information disclosure which could all=
ow a user to obtain sensitive information they are not entitled to, caused =
by improper handling of request data.they are not entitled to, caused by im= proper handling of request data.</td>
<td>2026-07-27</td>
<td>3.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56537" target=3D= "_blank" rel=3D"noopener">CVE-2026-56537</a></td>
</tr>

<td class=3D"vendor-product">HCLSoftware--Connections</td>
<td>An endpoint in HCL Connections is vulnerable to information disclosure.=
In certain scenarios this might lead to disclosing sensitive information t=
o unauthorized users.</td>
<td>2026-07-27</td>
<td>3.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56538" target=3D= "_blank" rel=3D"noopener">CVE-2026-56538</a></td>
</tr>

<td class=3D"vendor-product">IBM--WebSphere Application Server - Liberty</t=

<td>IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is=
vulnerable to cross-site request forgery which could allow an attacker to = execute malicious and unauthorized actions transmitted from a user that the=
website trusts.</td>
<td>2026-07-29</td>
<td>3.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-2482" target=3D"= _blank" rel=3D"noopener">CVE-2026-2482</a></td>
</tr>

<td class=3D"vendor-product">koxudaxi--datamodel-code-generator</td> <td>datamodel-code-generator generates Python data models from schema defin= itions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reus=
es Authorization, Cookie, and Proxy-Authorization headers when following cr= oss-origin redirects while fetching remote schemas, allowing credentials sc= oped to one schema host to be leaked to another redirect target. This issue=
is fixed in version 0.63.0.</td>
<td>2026-07-28</td>
<td>3.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55403" target=3D= "_blank" rel=3D"noopener">CVE-2026-55403</a></td>
</tr>

<td class=3D"vendor-product">papra-hq--papra</td>
<td>Papra is a minimalistic document management and archiving platform. Pri=
or to version 26.5.0, Papra's webhook delivery system contains an SSRF prot= ection bypass that allows any authenticated organisation member to cause th=
e server to make HTTP requests to internal addresses - loopback, link-local=
, and RFC-1918 ranges. The SSRF protection validates the registered webhook=
URL but ignores redirect destinations. The HTTP client (ofetch) follows 3x=
x responses automatically, and the redirect target is never checked against=
the blocklist. An attacker registers a webhook pointing to an attacker-con= trolled server, which redirects incoming POSTs to any internal address. Exp= loitation was confirmed by live test against the official Docker image. The=
fix is a single-line change to the webhook HTTP client. This issue has bee=
n patched in version 26.5.0.</td>
<td>2026-07-27</td>
<td>3.5</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48051" target=3D= "_blank" rel=3D"noopener">CVE-2026-48051</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Build of Keycloak</td>
<td>A flaw was found in the keycloak-services component of Keycloak, which = provides identity and access management services. The issue occurs when a r= ealm administrator uses a wildcard domain (like *.example.com) to restrict = which hosts can register or update clients. Due to improper validation, the=
system accepts any hostname that ends with the specified domain suffix, ev=
en if it is not a legitimate subdomain. An attacker who can control the rev= erse DNS of their connection can bypass these host-based restrictions, pote= ntially allowing unauthorized client modifications.</td>

<td>2026-07-31</td>
<td>3.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18206" target=3D= "_blank" rel=3D"noopener">CVE-2026-18206</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Build of Keycloak</td>
<td>A flaw was found in the keycloak-services component of Keycloak, which = handles OpenID Connect (OIDC) authentication flows. The issue occurs becaus=
e the security check designed to prevent HTTP parameter pollution only insp= ects the query portion of a redirect URL and ignores the fragment portion. = When a client is configured with a wildcard redirect URI, an attacker can u=
se this to inject duplicate security parameters into the login response. If=
a client application is not configured correctly, it might trust the attac= ker's injected data instead of the real security information from Keycloak,=
leading to session fixation or account confusion.</td>

<td>2026-07-31</td>
<td>3.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18209" target=3D= "_blank" rel=3D"noopener">CVE-2026-18209</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Build of Keycloak</td>
<td>A flaw was found in the SAML protocol implementation of Keycloak, an op= en-source identity and access management solution. The issue occurs when Ke= ycloak handles SAML authentication requests using the HTTP-Redirect binding=
. If a client is configured with a wildcard redirect URL, an attacker can c= raft a request that includes malicious parameters. When a user authenticate=
s, Keycloak appends its legitimate response to the attacker's parameters. T= his can cause some service providers to process the attacker's data instead=
of the real login information, potentially leading to a user being logged = into the wrong account.</td>
<td>2026-07-31</td>
<td>3.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18217" target=3D= "_blank" rel=3D"noopener">CVE-2026-18217</a></td>
</tr>

<td class=3D"vendor-product">Red Hat--Red Hat Enterprise Linux 10</td>

<td>A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-b= ounds read of 4 bytes can occur when parsing FLAC audio stream headers embe= dded in a Matroska or WebM container file. The vulnerability is triggered b=
y a boundary check that does not account for the full size of the data bein=
g copied, allowing a small read past the end of the allocated buffer. An at= tacker could exploit this by crafting a malicious Matroska or WebM file and=
tricking a user into opening it, potentially leaking a small amount of adj= acent heap memory.</td>
<td>2026-07-28</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17072" target=3D= "_blank" rel=3D"noopener">CVE-2026-17072</a></td>
</tr>

<td class=3D"vendor-product">sigstore--sigstore-go</td>
<td>sigstore-go is a Go library for Sigstore signing and verification. Prio=
r to 1.2.1, sigstore-go does not check a bundle signing timestamp against t=
he validity window of an ExpiringKey wrapping a self-managed long-lived sig= ning key without a certificate, which can allow an attacker holding expired=
key material to sign accepted bundles. This issue is fixed in version 1.2.= 1.</td>
<td>2026-07-31</td>
<td>3.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54787" target=3D= "_blank" rel=3D"noopener">CVE-2026-54787</a></td>
</tr>

<td class=3D"vendor-product">Spring--Spring Tools for Eclipse</td>
<td>The Spring Boot language server logs the raw value of the https_proxy/H= TTPS_PROXY/http_proxy/HTTP_PROXY environment variable at INFO level wheneve=
r it creates an outbound HTTP client and no explicit http.proxy workspace s= etting is configured. Corporate proxy URLs frequently embed Basic-auth cred= entials in the form http://user:pass@proxy:8080, and the language server wr= ites this value to its log file without any redaction. Since language serve=
r log files are often attached to bug reports or are readable by other loca=
l users/processes, this can result in disclosure of proxy credentials. Affe= cted Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earl= ier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier</td> <td>2026-07-30</td>
<td>3.3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59326" target=3D= "_blank" rel=3D"noopener">CVE-2026-59326</a></td>
</tr>

<td class=3D"vendor-product">Three Learning--Koollab LMS</td>
<td>An improper access control vulnerability in Koollab LMS allowed an unau= thenticated attacker to forcibly terminate the session of any user given th= eir email address via the login kickout endpoint, resulting in a denial of = service.</td>
<td>2026-07-29</td>
<td>3.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63235" target=3D= "_blank" rel=3D"noopener">CVE-2026-63235</a></td>
</tr>

<td class=3D"vendor-product">Three Learning--Koollab LMS</td>
<td>An improper access control vulnerability in Koollab LMS allowed an unau= thenticated attacker to read another user's name, internal identifier, scor= es, lesson status, lesson position, and cached lesson state via the SCORM A=
PI endpoint.</td>
<td>2026-07-29</td>
<td>3.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63236" target=3D= "_blank" rel=3D"noopener">CVE-2026-63236</a></td>
</tr>

<td class=3D"vendor-product">Three Learning--Koollab LMS</td>
<td>An insecure direct object reference vulnerability in Koollab LMS allowe=
d an authenticated user to query the course completion progress of any othe=
r user without authorisation, disclosing private learning progress informat= ion.</td>
<td>2026-07-29</td>
<td>3.1</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63241" target=3D= "_blank" rel=3D"noopener">CVE-2026-63241</a></td>
</tr>

<td class=3D"vendor-product">Three Learning--Koollab LMS</td>
<td>An unrestricted image upload vulnerability in Koollab LMS allowed an au= thenticated attacker to upload malicious content disguised as an image file=
via the feedback mail registration endpoint, potentially enabling further = attacks on the server.</td>
<td>2026-07-29</td>
<td>2.6</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63228" target=3D= "_blank" rel=3D"noopener">CVE-2026-63228</a></td>
</tr>

<td class=3D"vendor-product">tiny-http--tiny-http</td>
<td>tiny-http through 0.12.0 contains an HTTP header injection vulnerabilit=
y that allows attackers to inject carriage return (0x0D) and line feed (0x0=
A) bytes into HTTP header values on both request and response sides due to = insufficient validation in header parsing and serialization. Attackers can = exploit this injection primitive to perform response splitting, cache poiso= ning, session fixation via Set-Cookie injection, security header override, = and request smuggling against line-feed-tolerant backends.</td> <td>2026-07-28</td>
<td>3.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66753" target=3D= "_blank" rel=3D"noopener">CVE-2026-66753</a></td>
</tr>

<td class=3D"vendor-product">TryGhost--Ghost-CLI</td>
<td>Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allo=
ws unauthenticated remote attackers to bypass rate-limiting controls by man= ipulating the X-Forwarded-For header through a misconfigured Nginx configur= ation. Attackers can append attacker-controlled values to the header chain = using the $proxy_add_x_forwarded_for directive to present an arbitrary IP a= ddress, circumventing Ghost's rate-limiting mechanisms on self-hosted insta= nces.</td>
<td>2026-07-31</td>
<td>3.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-25552" target=3D= "_blank" rel=3D"noopener">CVE-2026-25552</a></td>
</tr>

<td class=3D"vendor-product">VMware--Cloud Foundation</td>
<td>VMware ESX contains an insufficient logging vulnerability.=C2=A0A malic= ious administrator could exploit this issue to perform certain operations w= ithout them being logged.</td>
<td>2026-07-30</td>
<td>2.7</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-41709" target=3D= "_blank" rel=3D"noopener">CVE-2026-41709</a></td>
</tr>

<td class=3D"vendor-product">zephyrproject--zephyr</td>
<td>In subsys/debug/coredump/coredump_shell.c, print_coredump_hdr() used th=
e 16-bit tgt_code field of a stored Zephyr coredump header directly as an i= ndex into coredump_target_code2str[], a fixed 7-element array of string poi= nters, with no bounds check. A stored coredump whose tgt_code is &gt;=3D 7 = causes an out-of-bounds read of a char* up to ~64K entries past the array; = that value is passed as the %s argument to shell_print, which dereferences = and walks it as a string. The result is either disclosure of device memory = contents to the shell user or a crash when the out-of-bounds pointer is unm= apped. The defect is reached via the coredump print shell command (cmd_core= dump_print_stored_dump -&gt; pretty_print_coredump -&gt; parse_and_print_co= redump -&gt; print_coredump_hdr). The tgt_code field is device-generated an=
d in-range during normal crash handling, so triggering requires local shell=
access plus the ability to stage or corrupt the stored coredump in the fla= sh/in-memory backend. Introduced in v4.2.0 (commit 13abd7fe730) and present=
through v4.4.0; fixed by clamping out-of-range codes to the 'unknown' (ind=
ex 0) entry.</td>
<td>2026-07-29</td>
<td>3</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10684" target=3D= "_blank" rel=3D"noopener">CVE-2026-10684</a></td>
</tr>

<td class=3D"vendor-product">zephyrproject--zephyr</td>
<td>In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating =
in target/slave mode, the rx_full interrupt handler gates the write_request= ed() callback on dw-&gt;state !=3D CMD_SEND, and dw-&gt;state is only reset=
to READY on a STOP interrupt. The START_DET interrupt, whose handler in i2= c_dw_slave_read_clear_intr_bits() would reset the state on every (re)START,=
was never added to the enabled interrupt mask in i2c_dw_slave_register(), =
so that recovery path was dead code. As a result, if the STOP interrupt is = lost (bus glitch/reset, or a concurrent master driving STOP) or the bus mas= ter issues a legal WRITE-repeated-START-WRITE sequence with the same direct= ion, the driver remains in CMD_SEND permanently and never invokes write_req= uested() again for the life of the target. An I2C master on the same physic=
al bus can deliberately trigger this, causing the I2C target function to ma= lfunction for all subsequent write transactions and desynchronizing consume=
r framing state (e.g. MCTP-over-I2C), a recoverable-by-reset denial of serv= ice of the target peripheral. The fix unmasks START_DET so the state is res=
et at every bus (re)START. Impact is availability-only over a local board-l= evel bus; no memory corruption results in the in-tree consumer, whose per-b= yte buffer write is independently bounds-checked.</td>
<td>2026-07-27</td>
<td>2.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10683" target=3D= "_blank" rel=3D"noopener">CVE-2026-10683</a></td>
</tr>

<td class=3D"vendor-product">zephyrproject--zephyr</td>
<td>Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key = slot on every subnet-key teardown. In subsys/bluetooth/mesh/subnet.c, net_k= eys_create() imports the Private Beacon Key into a PSA key slot under CONFI= G_BT_MESH_PRIV_BEACONS (enabled by default), but subnet_keys_destroy() guar= ded the matching psa_destroy_key() with CONFIG_BT_MESH_V1d1. That Kconfig s= ymbol was removed when explicit Mesh 1.0.1 support was dropped, so the dest= roy branch became permanently dead code and the import is never balanced by=
a destroy. The imbalanced teardown is reached every time subnet keys are d= estroyed: deleting a subnet (Config Server NetKey Delete), completing a Key=
Refresh Procedure (which retires the old key set), and resetting/re-provis= ioning the node. The over-the-air triggers are processed only under the nod= e's device key, so they are exercisable by the provisioner or network admin= istrator that owns the node, reachable over the Bluetooth Mesh network. Wit=
h the default CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT of 16, repeated add/delete =
or key-refresh cycles exhaust the shared PSA key-slot pool after roughly a = dozen rounds. Once exhausted, bt_mesh_private_beacon_key() and thus subnet = creation fail: the node can no longer add subnets or complete key refresh, = and other PSA crypto consumers on the device may be starved, until the devi=
ce is rebooted. The fix aligns the destroy guard with the import guard (CON= FIG_BT_MESH_PRIV_BEACONS) so each slot is freed.</td>
<td>2026-08-02</td>
<td>2.4</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10774" target=3D= "_blank" rel=3D"noopener">CVE-2026-10774</a></td>
</tr>

<td class=3D"vendor-product">ZTE--Blade A75 5G</td>
<td>The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity with=
in ZTE File Manager is designed to preview compressed files. Third-party ap= plications can launch this Activity and supply arbitrary file paths (e.g., = content://zte.com.cn.filer.fileprovider/root_path), enabling file access wi=
th the privilege level of ZTE File Manager. This allows unrooted devices to=
read files under certain system directories such as /data/data and /data/l= ocal/tmp. If access restrictions do not block untrusted applications, addit= ional directories may also be accessible.</td>
<td>2026-07-27</td>
<td>1.8</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-40000" target=3D= "_blank" rel=3D"noopener">CVE-2026-40000</a></td>
</tr>
</tbody>
</table>
<p><a href=3D"#top">Back to top</a></p>
</div>
<p>WPBot</p>
<div id=3D"snya_v">
<h2 id=3D"snya_v_title">Severity Not Yet Assigned</h2>
<table id=3D"table_severity_not_yet_assigned" class=3D"table no-tablesaw" s= tyle=3D"table-layout: fixed; width: 100%;" border=3D"1" summary=3D"Severity=
Not Yet Assigned">
<thead>

<th class=3D"vendor-product" style=3D"width: 24%;" scope=3D"col">
<span class=3D"primary-vendor">Primary</span><br><span class=3D"primary-ven= dor">Vendor</span> -- Product</th>
<th style=3D"width: 44%;" scope=3D"col">Description</th>
<th style=3D"width: 10%;" scope=3D"col">Published</th>
<th style=3D"width: 8%;" scope=3D"col">CVSS Score</th>
<th style=3D"width: 7%;" scope=3D"col">Source Info</th>
</tr>
</thead>
<tbody>

<td class=3D"vendor-product">1Panel-dev--MaxKB</td>
<td>MaxKB is an open-source AI assistant for enterprise. In versions 2.0.0 = through 2.10.4-lts, UpdateStoreTool.update_tool passes caller-supplied down= load_url and download_callback_url values to requests.get without equivalen=
t trusted-host and redirect validation, allowing an authenticated workspace=
user to make the server request internal, loopback, link-local, or cloud m= etadata URLs. A fix is present on the v2 branch but has not yet been includ=
ed in a published release.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64870" target=3D= "_blank" rel=3D"noopener">CVE-2026-64870</a></td>
</tr>

<td class=3D"vendor-product">7-Zip--7-Zip</td>
<td>7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution=
Vulnerability. This vulnerability allows remote attackers to execute arbit= rary code on affected installations of 7-Zip. User interaction is required =
to exploit this vulnerability in that the target must visit a malicious pag=
e or open a malicious file. The specific flaw exists within the processing =
of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a=
heap-based buffer. An attacker can leverage this vulnerability to execute = code in the context of the current process. Was ZDI-CAN-30169.</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14266" target=3D= "_blank" rel=3D"noopener">CVE-2026-14266</a></td>
</tr>

<td class=3D"vendor-product">Academy LMS--Academy LMS</td>
<td>The Academy LMS WordPress plugin through 3.8.2 does not restrict access=
to quiz attempt records to their owner, allowing any authenticated user wi=
th subscriber-level access and above (enrolled in any single course) to rea=
d every user's quiz attempts across the whole site, including personal data=
such as IP addresses, names, registration dates and quiz results.</td> <td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12376" target=3D= "_blank" rel=3D"noopener">CVE-2026-12376</a></td>
</tr>

<td class=3D"vendor-product">activepieces--activepieces</td>
<td>Activepieces is an open source AI workflow automation platform. Prior t=
o 0.84.0, an unsanitized path segment in the Code piece sandbox can let an = authenticated flow author reach read-write cached flow and code files belon= ging to other tenants on the same worker, exposing embedded data and allowi=
ng modified code to execute on a victim tenant's next flow run. This issue =
is fixed in version 0.84.0.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48499" target=3D= "_blank" rel=3D"noopener">CVE-2026-48499</a></td>
</tr>

<td class=3D"vendor-product">AcyMailing--AcyMailing</td>
<td>## Summary</td>
<td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14920" target=3D= "_blank" rel=3D"noopener">CVE-2026-14920</a></td>
</tr>

<td class=3D"vendor-product">Admin Columns for ACF Fields--Admin Columns fo=
r ACF Fields</td>
<td>The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does no=
t escape Advanced Custom Fields values before outputting them in the WordPr= ess admin list-table columns, allowing users with contributor-level access =
or above to store a payload that executes as JavaScript in the session of h= igher-privileged users who view the affected post-list screen.</td> <td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15262" target=3D= "_blank" rel=3D"noopener">CVE-2026-15262</a></td>
</tr>

<td class=3D"vendor-product">Advanced Ads--Advanced Ads</td>
<td>The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and e= scape a shortcode parameter before outputting it in the page, allowing user=
s with the Contributor role and above to inject arbitrary web scripts that = execute when the affected content is viewed, including by higher-privileged=
users.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10082" target=3D= "_blank" rel=3D"noopener">CVE-2026-10082</a></td>
</tr>

<td class=3D"vendor-product">AI ChatBot for WooCommerce--AI ChatBot for Woo= Commerce</td>
<td>The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not p= erform any authorization or nonce check on one of its AJAX actions, allowin=
g unauthenticated users to abuse the site owner's stored third-party API ke=
y to send requests billed to the owner's account and, when an optional feat= ure is enabled, to retrieve indexed knowledge-base content.</td>

<td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15241" target=3D= "_blank" rel=3D"noopener">CVE-2026-15241</a></td>
</tr>

<td class=3D"vendor-product">aimy-extensions.com--Aimy Captcha-Less Form Gu= ard plugin for Joomla</td>
<td>Joomla Extension - aimy-extensions.com - RCE via PHP object injection i=
n Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PH=
P objection injection and thereby remote code execution.</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65883" target=3D= "_blank" rel=3D"noopener">CVE-2026-65883</a></td>
</tr>

<td class=3D"vendor-product">aio-libs--aiohttp</td>
<td>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and=
Python. Prior to 3.14.2, the WebSocket client accepts and decompresses fra= mes with the RSV1 bit set even when the permessage-deflate extension was no=
t negotiated, allowing a malicious server to cause unexpected CPU and memor=
y consumption. This issue is fixed in version 3.14.2.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59881" target=3D= "_blank" rel=3D"noopener">CVE-2026-59881</a></td>
</tr>

<td class=3D"vendor-product">allinurl--goaccess</td>
<td>GoAccess is a real-time web log analyzer and interactive viewer that ru=
ns in a terminal in *nix systems or through the browser. In version 1.10.2,=
parse_browser assumes the matched browser token begins with Opera and move=
s a trailing version substring to match plus five, allowing a crafted User-= Agent in a processed access log to write one to four attacker-influenced by= tes beyond the heap allocation and corrupt or crash GoAccess. This issue is=
fixed in version 1.11.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54715" target=3D= "_blank" rel=3D"noopener">CVE-2026-54715</a></td>
</tr>

<td class=3D"vendor-product">allinurl--goaccess</td>
<td>GoAccess is a real-time web log analyzer and interactive viewer that ru=
ns in a terminal in *nix systems or through the browser. Prior to version 1= .11, the built-in WebSocket server narrows a 64-bit extended frame length i= nto the signed 32-bit WSFrame.payloadlen field before enforcing the maximum=
frame size, allowing an unauthenticated remote client to bypass the guard = and force an approximately 18-exabyte allocation request that terminates th=
e process. This issue is fixed in version 1.11.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55768" target=3D= "_blank" rel=3D"noopener">CVE-2026-55768</a></td>
</tr>

<td class=3D"vendor-product">allinurl--goaccess</td>
<td>GoAccess is a real-time web log analyzer and interactive viewer that ru=
ns in a terminal in *nix systems or through the browser. Prior to 1.11, the=
parse_ios() function uses an attacker-controlled keyword-to-OS offset as b= oth the source offset and copy length for memmove, allowing a crafted User-= Agent in a processed access log to read up to approximately 4 KB beyond the=
heap allocation and conditionally crash GoAccess. This issue is fixed in v= ersion 1.11.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55777" target=3D= "_blank" rel=3D"noopener">CVE-2026-55777</a></td>
</tr>

<td class=3D"vendor-product">Animation Addons for Elementor--Animation Addo=
ns for Elementor</td>
<td>The Animation Addons for Elementor WordPress plugin before 2.7.0 does n=
ot sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed u= pload types, allowing users with the upload_files capability (Author and ab= ove) to upload files containing malicious JavaScript, leading to Stored Cro= ss-Site Scripting.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13330" target=3D= "_blank" rel=3D"noopener">CVE-2026-13330</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache ActiveMQ AM= QP</td>
<td>Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache=
ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer that can reac=
h an exposed AMQP NIO connector can trigger denial-of-service behavior by s= ending a frame size value. This cause the NIO threads to die and if done ra= pidly enough can lead to exhaustion of the NIO thread pool denying service =
to other connections. This issue affects Apache ActiveMQ AMQP: before 5.19.=
9, from 6.0.0 before 6.2.8; Apache ActiveMQ: before 5.19.9, from 6.0.0 befo=
re 6.2.8; Apache ActiveMQ All: before 5.19.9, from 6.0.0 before 6.2.8. User=
s are recommended to upgrade to version 5.19.9, 6.2.8, or 6.3.0 which fixes=
the issue.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59878" target=3D= "_blank" rel=3D"noopener">CVE-2026-59878</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache ActiveMQ Br= oker</td>
<td>Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache = ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypa=
ss a per-destination write ACL by sending to an ActiveMQ temporary composit=
e destination whose physical name is a comma-separated composite of real qu= eues.=C2=A0This allows publishing messages to any of the destinations in th=
e list without proper write ACL permissions because the authorization check=
is bypassed due to the composite destination being marked as temporary. Th=
is issue affects Apache ActiveMQ Broker: before 5.19.9, from 6.0.0 before 6= .2.8; Apache ActiveMQ All: before 5.19.9, from 6.0.0 before 6.2.8; Apache A= ctiveMQ: before 5.19.9, from 6.0.0 before 6.2.8. Users are recommended to u= pgrade to version 5.19.9, 6.2.8 or 6.3.0, which fixes the issue.</td> <td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-61487" target=3D= "_blank" rel=3D"noopener">CVE-2026-61487</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Airflow FAB=
provider</td>
<td>The FAB auth manager's Azure AD OAuth login defaulted `verify_signature= =3DFalse` when decoding the ID token, so an attacker able to present a forg=
ed or unsigned (`alg:none`) ID token to the OAuth callback could bypass aut= hentication and log in as an arbitrary user, including one holding the Admi=
n role (CWE-347). Deployments running the FAB auth manager with the Azure A=
D OAuth login path under its default configuration are affected; the Authen= tik path already defaulted to `True`. This issue affects `apache-airflow-pr= oviders-fab` before 3.7.3. Users are advised to upgrade to `apache-airflow-= providers-fab` 3.7.3, which defaults `verify_signature=3DTrue`.</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59243" target=3D= "_blank" rel=3D"noopener">CVE-2026-59243</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Atlas</td> <td>Description: Missing Authorization=C2=A0in Apache Atlas. A missing auth= orization vulnerability in Apache Atlas's admin endpoints allows any authen= ticated user, regardless of their assigned role, to perform administrative = operations. Affect Version: This issue affects Apache Atlas: from 0.8 throu=
gh 2.5.0. Mitigation: Users are recommended to upgrade to version 2.6.0, wh= ich fixes the issue.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50622" target=3D= "_blank" rel=3D"noopener">CVE-2026-50622</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Axis2/Java<=

<td>Deserialization of Untrusted Data (CWE-502) in the Tribes-based cluster= ing component =C2=A0in Apache Software Foundation Apache Axis2/Java through=
2.0.0 on Apache Tomcat =C2=A0(only when Tribes clustering is enabled, whic=
h is off by default) allows an =C2=A0unauthenticated remote attacker with n= etwork access to the clustering port to =C2=A0execute arbitrary code via a = crafted serialized Java object delivered to the cluster =C2=A0channel and d= eserialized in =C2=A0org.apache.axis2.clustering.tribes.Axis2ChannelListene= r#messageReceived. Users are =C2=A0recommended to upgrade to version 2.0.1,=
which fixes this issue by removing the =C2=A0clustering feature entirely.<=

<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66713" target=3D= "_blank" rel=3D"noopener">CVE-2026-66713</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache HttpCompone= nts Client</td>
<td>HttpClient based on the classic i/o model fails to correctly release th=
e underlying connection back to the connection manager if it encounters an = invalid or unsupported `Content-Encoding` header value in the response mess= age.=C2=A0Please note this defect does not affect HttpClient based on the a= sync i/o model. This issue affects Apache HttpComponents Client: from 5.0-a= lpha1 through 5.6.2.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64607" target=3D= "_blank" rel=3D"noopener">CVE-2026-64607</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache JSPWiki</td=

<td>Debug Messages Revealing Unnecessary Information in Apache JSPWiki up t=
o 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes t= his issue.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28811" target=3D= "_blank" rel=3D"noopener">CVE-2026-28811</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache JSPWiki</td=

<td>UserManager lack of checks allows impersonation in Apache JSPWiki up to=
2.12.3 which may allow attackers to escalate privileges. Users are recomme= nded to upgrade to version 2.12.4 or newer which fixes this issue.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28812" target=3D= "_blank" rel=3D"noopener">CVE-2026-28812</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache JSPWiki</td=

<td>Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which le= ads to csrf vulnerabilities. Users are recommended to upgrade to version 2.= 12.4, which fixes this issue.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28813" target=3D= "_blank" rel=3D"noopener">CVE-2026-28813</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache JSPWiki</td=

<td>Arbitrary Wiki Markup rendering due to lack of authentication in Apache=
JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JS= PWiki variables. Users are recommended to upgrade to version 2.12.4 or 3.0.=
0, which fixes this issue.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28814" target=3D= "_blank" rel=3D"noopener">CVE-2026-28814</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache JSPWiki</td=

<td>A carefully crafted editing request could trigger an XSS vulnerability =
on Apache JSPWiki when parsing errors on the markdown renderer, which could=
allow the attacker to execute javascript in the victim's browser and get s= ome sensitive information about the victim. This issue affects Apache JSPWi= ki: through 2.12.3. Users are recommended to upgrade to version 2.12.4, whi=
ch fixes the issue.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48910" target=3D= "_blank" rel=3D"noopener">CVE-2026-48910</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Kyuubi</td> <td>Kyuubi Engine UI proxy accepts a host and port from the request path an=
d proxies HTTP requests to that destination.=C2=A0A remote requester with n= etwork access to the proxy can cause the Kyuubi server to send HTTP request=
s to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior. T= his issue affects Apache Kyuubi: from 1.8.0 before 1.12.0. Users are recomm= ended to upgrade to version 1.12.0, which disables the proxy by default.=C2= =A0To restore proxied Engine UI, set kyuubi.frontend.rest.engine.ui.proxy.e= nabled=3Dtrue and configure allowed target hosts with kyuubi.frontend.rest.= engine.ui.proxy.hosts.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-23904" target=3D= "_blank" rel=3D"noopener">CVE-2026-23904</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Kyuubi</td> <td>Apache Kyuubi REST batch multipart upload handling uses the client-supp= lied multipart filename when creating a temporary uploaded resource. A remo=
te attacker who can access the REST batch upload endpoint can provide path = traversal sequences in the filename and cause the Kyuubi server process to = write controlled content outside the intended upload directory, subject to = filesystem permissions. This issue affects Apache Kyuubi: from 1.7.0 throug=
h 1.11.1. Users are recommended to upgrade to version 1.12.0, which fixes t=
he issue.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52680" target=3D= "_blank" rel=3D"noopener">CVE-2026-52680</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Kyuubi</td> <td>The security fix for CVE-2025-66518 is incomplete.=C2=A0Any client who = can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass=
server-side config=C2=A0kyuubi.session.local.dir.allowlist via unprefixed = Spark config aliases. This issue affects Apache Kyuubi: from 1.6.0 before 1= .12.0. Users are recommended to upgrade to version 1.12.0, which fixes the = issue.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62391" target=3D= "_blank" rel=3D"noopener">CVE-2026-62391</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Superset</t=

<td>An Improper Authorization vulnerability exists in Apache Superset allow= ing an authenticated user with permissions to update charts to modify dashb= oards they do not own. When updating a chart's properties via the REST API,=
a user can provide a list of dashboard IDs (dashboards) to associate the c= hart with. The validation logic in the UpdateChartCommand failed to verify = that the user had write permissions for the target dashboards specified in = the request body. This issue affects Apache Superset: before 6.0.0. Users a=
re recommended to upgrade to version 6.0.0, which fixes the issue.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-23981" target=3D= "_blank" rel=3D"noopener">CVE-2026-23981</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Superset</t=

<td>A Regular Expression Denial of Service (ReDoS) vulnerability exists in = Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located =
in the sql_parse.py component, specifically within the SQL_REGEX used for p= arsing SQL statements in the sqlparse library integration. The affected reg= ular expression contains overlapping disjunctions that share a common outer=
quantifier. An authenticated attacker can exploit this by sending a malici= ously crafted input string (specifically a long sequence of backslashes or = similar characters) to endpoints that process SQL queries This issue affect=
s Apache Superset: before 6.0.0. Users are recommended to upgrade to versio=
n 6.0.0, which fixes the issue.=C2=A0 Workarounds: =C3=A2=E2=80=94=C2=8F WA=
F Rules: Implement Web Application Firewall (WAF) rules to detect and block=
requests containing excessively long sequences of backslashes or suspiciou=
s repeated patterns in the queries.extras.where parameter. =C3=A2=E2=80=94= =C2=8F Rate Limiting: Ensure strict rate limiting is applied to the /api/v1= /chart/data endpoint to reduce the impact of potential attacks.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-23985" target=3D= "_blank" rel=3D"noopener">CVE-2026-23985</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Thrift</td> <td>Improper Handling of Highly Compressed Data (Data Amplification) vulner= ability in Apache Thrift Python bindings. This issue affects Apache Thrift:=
before 0.24.0. Users are recommended to upgrade to version 0.24.0, which f= ixes the issue.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-41608" target=3D= "_blank" rel=3D"noopener">CVE-2026-41608</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Thrift</td> <td>Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in=
Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache = Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, = which fixes the issue.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43871" target=3D= "_blank" rel=3D"noopener">CVE-2026-43871</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Thrift</td> <td>Allocation of Resources Without Limits or Throttling vulnerability in A= pache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 b= efore 0.24.0. Users are recommended to upgrade to version 0.24.0, which fix=
es the issue.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-45112" target=3D= "_blank" rel=3D"noopener">CVE-2026-45112</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Thrift</td> <td>Improper Validation of Certificate with Host Mismatch vulnerability in = Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.2= 4.0. Users are recommended to upgrade to version 0.24.0, which fixes the is= sue.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48144" target=3D= "_blank" rel=3D"noopener">CVE-2026-48144</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Thrift</td> <td>Improper Validation of Certificate with Host Mismatch vulnerability in = Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0=
. Users are recommended to upgrade to version 0.24.0, which fixes the issue= .</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48145" target=3D= "_blank" rel=3D"noopener">CVE-2026-48145</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Thrift</td> <td>Improper Handling of Highly Compressed Data (Data Amplification) vulner= ability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This is= sue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade =
to version 0.24.0, which fixes the issue.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48586" target=3D= "_blank" rel=3D"noopener">CVE-2026-48586</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Thrift</td> <td>Inefficient Algorithmic Complexity, Allocation of Resources Without Lim= its or Throttling vulnerability in Apache Thrift Node.js bindings. This iss=
ue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade t=
o version 0.24.0, which fixes the issue.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55968" target=3D= "_blank" rel=3D"noopener">CVE-2026-55968</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Thrift</td> <td>Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_gl= ib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift:=
before 0.24.0. Users are recommended to upgrade to version 0.24.0, which f= ixes the issue.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55969" target=3D= "_blank" rel=3D"noopener">CVE-2026-55969</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Thrift</td> <td>Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issu=
e affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to=
version 0.24.0, which fixes the issue.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55970" target=3D= "_blank" rel=3D"noopener">CVE-2026-55970</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Thrift</td> <td>Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings.=
This issue affects Apache Thrift: before 0.24.0. Users are recommended to = upgrade to version 0.24.0, which fixes the issue.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55971" target=3D= "_blank" rel=3D"noopener">CVE-2026-55971</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Thrift</td> <td>Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This=
issue affects Apache Thrift: before 0.24.0. Users are recommended to upgra=
de to version 0.24.0, which fixes the issue.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58023" target=3D= "_blank" rel=3D"noopener">CVE-2026-58023</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Thrift</td> <td>Allocation of Resources Without Limits or Throttling vulnerability in A= pache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0=
. Users are recommended to upgrade to version 0.24.0, which fixes the issue= .</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58389" target=3D= "_blank" rel=3D"noopener">CVE-2026-58389</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Thrift</td> <td>Improper Validation of Specified Quantity in Input, Out-of-bounds Read = vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thri= ft: before 0.24.0. Users are recommended to upgrade to version 0.24.0, whic=
h fixes the issue.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58662" target=3D= "_blank" rel=3D"noopener">CVE-2026-58662</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Tika</td> <td>Relative Path Traversal in the ISA-Tab parser in Apache Software Founda= tion Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attac= ker who can place files in a directory that the application subsequently pa= rses to read arbitrary files accessible to the Tika process and have their = contents emitted into the extracted text output, via a "Study Assay File Na= me" value in the ISA-Tab investigation file that traverses outside the data= set directory. Users are recommended to upgrade to version 3.3.2 or 4.0.0-b= eta-1, which fixes this issue.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66755" target=3D= "_blank" rel=3D"noopener">CVE-2026-66755</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Tika</td> <td>Improper Protection of Alternate Path vulnerability in Apache Tika. Thi=
s issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users = are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue.<=

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66756" target=3D= "_blank" rel=3D"noopener">CVE-2026-66756</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Tomcat</td> <td>Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebS= ocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 throu=
gh 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. User=
s who have followed the security guidance to remove the examples web applic= ation are not affected by this issue. Users are recommended to remove the e= xamples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.12=
1 (when released), which fix the issue.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66299" target=3D= "_blank" rel=3D"noopener">CVE-2026-66299</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Wicket</td> <td>Improper Neutralization of Input During Web Page Generation ('Cross-sit=
e Scripting') vulnerability in Apache Wicket. This issue affects Apache Wic= ket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recom= mended to upgrade to version 10.10.0, which fixes the issue.</td>

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66390" target=3D= "_blank" rel=3D"noopener">CVE-2026-66390</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Wicket</td> <td>Use of Insufficiently Random Values, Protection Mechanism Failure vulne= rability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 thr= ough 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade t=
o version 10.10.0, which fixes the issue.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66391" target=3D= "_blank" rel=3D"noopener">CVE-2026-66391</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Zeppelin</t=

<td>Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The=
default CORS configuration allowed cross-origin state-changing requests an=
d accepted text/plain request bodies, allowing an attacker who lures an aut= henticated user to a =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0malicious site to per= form actions on the user's behalf through REST and WebSocket endpoints. Thi=
s issue affects Apache Zeppelin versions 0.6.0 through 0.12.0. Users are re= commended to upgrade to version 0.12.1, which fixes this issue.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44613" target=3D= "_blank" rel=3D"noopener">CVE-2026-44613</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Zeppelin</t=

<td>Path traversal vulnerability in Apache Zeppelin. When FileSystemNoteboo= kRepo is configured, an authenticated attacker with permission to rename a = note, or access to folder operations, could supply traversal segments in no=
te or folder paths. =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0Zeppelin composed the=
se values into filesystem paths using the server's filesystem or Hadoop ide= ntity without ensuring that the result remained under the configured notebo=
ok directory. This could allow notebook files or directories to be moved, = =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0written, or deleted outside the notebook r= oot. This issue affects Apache Zeppelin versions 0.9.0 through 0.12.0. User=
s are recommended to upgrade to version 0.12.1, which fixes this issue.</td=

<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44615" target=3D= "_blank" rel=3D"noopener">CVE-2026-44615</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Zeppelin</t=

<td>LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRe= alm constructed LDAP search filters without escaping user-controlled input,=
allowing an authenticated attacker to inject LDAP filter syntax through th=
e user-search endpoint =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0and potentially ex= pose directory information. The role-lookup path was also affected after su= ccessful LDAP authentication. This issue affects Apache Zeppelin versions 0= .6.0 through 0.12.0. Users are recommended to upgrade to version 0.12.1, wh= ich =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0fixes this issue.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44616" target=3D= "_blank" rel=3D"noopener">CVE-2026-44616</a></td>
</tr>

<td class=3D"vendor-product">Apache Software Foundation--Apache Zeppelin</t=

<td>LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used = RFC 4514 distinguished-name escaping when constructing LDAP search filters = instead of RFC 4515 filter escaping, leaving special filter characters insu= fficiently escaped. =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0This is an incomplete=
fix of CVE-2024-31867. This issue affects Apache Zeppelin versions 0.11.1,=
0.11.2, and 0.12.0. Users are recommended to upgrade to version 0.12.1, wh= ich fixes this issue.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44617" target=3D= "_blank" rel=3D"noopener">CVE-2026-44617</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A use after free issue was addressed with improved memory management. T= his issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6=
, watchOS 26.6. An app may be able to cause unexpected system termination.<=

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28928" target=3D= "_blank" rel=3D"noopener">CVE-2026-28928</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A buffer overflow was addressed with improved bounds checking. This iss=
ue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watch=
OS 26.6. Connecting to a malicious NFS server may lead to kernel memory cor= ruption.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28931" target=3D= "_blank" rel=3D"noopener">CVE-2026-28931</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An integer overflow was addressed with improved input validation. This = issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Son= oma 14.8.8, macOS Tahoe 26.6, watchOS 26.6. A malicious app may be able to = break out of its sandbox.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28973" target=3D= "_blank" rel=3D"noopener">CVE-2026-28973</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8,=
macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a mal= iciously crafted audio file may corrupt process memory.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43673" target=3D= "_blank" rel=3D"noopener">CVE-2026-43673</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A memory corruption issue was addressed with improved memory handling. = This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macO=
S Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. = Processing a maliciously crafted video file may lead to unexpected app term= ination.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43711" target=3D= "_blank" rel=3D"noopener">CVE-2026-43711</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>The issue was addressed with improved input sanitization. This issue is=
fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8= .8, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. A malicious app may be a= ble to access protected user data.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43714" target=3D= "_blank" rel=3D"noopener">CVE-2026-43714</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A path handling issue was addressed with improved validation. This issu=
e is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma = 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app ma=
y be able to gain root privileges.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43723" target=3D= "_blank" rel=3D"noopener">CVE-2026-43723</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tv=
OS 26.6, visionOS 26.6. Processing a maliciously crafted image may corrupt = process memory.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43729" target=3D= "_blank" rel=3D"noopener">CVE-2026-43729</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A permissions issue was addressed with additional restrictions. This is= sue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visi= onOS 26.6, watchOS 26.6. An app may be able to fingerprint the user.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43730" target=3D= "_blank" rel=3D"noopener">CVE-2026-43730</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6. Pr= ocessing a maliciously crafted image may corrupt process memory.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43733" target=3D= "_blank" rel=3D"noopener">CVE-2026-43733</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An out-of-bounds write issue was addressed with improved bounds checkin=
g. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS = 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected s= ystem termination.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43739" target=3D= "_blank" rel=3D"noopener">CVE-2026-43739</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An out-of-bounds write issue was addressed with improved bounds checkin=
g. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, m= acOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.=
6. Processing an audio stream in a maliciously crafted media file may termi= nate the process.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43744" target=3D= "_blank" rel=3D"noopener">CVE-2026-43744</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An out-of-bounds read was addressed with improved bounds checking. This=
issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS So= noma 14.8.8, macOS Tahoe 26.6. An attacker with physical access to a locked=
device may be able to view sensitive user information.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43753" target=3D= "_blank" rel=3D"noopener">CVE-2026-43753</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An integer overflow was addressed with improved input validation. This = issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Son= oma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An ap=
p may be able to cause unexpected system termination.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43769" target=3D= "_blank" rel=3D"noopener">CVE-2026-43769</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A buffer overflow was addressed with improved bounds checking. This iss=
ue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe = 26.6. Processing a maliciously crafted file may lead to unexpected app term= ination or arbitrary code execution.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43776" target=3D= "_blank" rel=3D"noopener">CVE-2026-43776</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A use after free issue was addressed with improved memory management. T= his issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS=
Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A=
n app may be able to cause unexpected system termination or corrupt kernel = memory.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43778" target=3D= "_blank" rel=3D"noopener">CVE-2026-43778</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An integer overflow was addressed with improved input validation. This = issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Son= oma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Proce= ssing a maliciously crafted texture may lead to unexpected app termination.= </td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43780" target=3D= "_blank" rel=3D"noopener">CVE-2026-43780</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>This issue was addressed with improved data protection. This issue is f= ixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8=
, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be a= ble to access sensitive user data.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43796" target=3D= "_blank" rel=3D"noopener">CVE-2026-43796</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>This issue was addressed with improved checks. This issue is fixed in i=
OS 26.6 and iPadOS 26.6, macOS Tahoe 26.6. An app may be able to access inf= ormation about a user's contacts.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43797" target=3D= "_blank" rel=3D"noopener">CVE-2026-43797</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A use after free issue was addressed with improved memory management. T= his issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS=
Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A=
n app may be able to cause unexpected system termination.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43799" target=3D= "_blank" rel=3D"noopener">CVE-2026-43799</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An information disclosure issue was addressed by removing the vulnerabl=
e code. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, = tvOS 26.6, watchOS 26.6. An app may be able to access sensitive user data.<=

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43800" target=3D= "_blank" rel=3D"noopener">CVE-2026-43800</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>This issue was addressed with improved checks. This issue is fixed in i=
OS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS T= ahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to ac= cess sensitive user data.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43801" target=3D= "_blank" rel=3D"noopener">CVE-2026-43801</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An out-of-bounds write issue was addressed with improved bounds checkin=
g. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, m= acOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.=
6. A remote attacker may be able to cause unexpected system termination.</t=

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43803" target=3D= "_blank" rel=3D"noopener">CVE-2026-43803</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A race condition was addressed with improved state handling. This issue=
is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 1= 4.8.8, macOS Tahoe 26.6, watchOS 26.6. An app may be able to cause unexpect=
ed system termination or write kernel memory.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43805" target=3D= "_blank" rel=3D"noopener">CVE-2026-43805</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A buffer overflow was addressed with improved bounds checking. This iss=
ue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS So= noma 14.8.8, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A = malicious accessory may be able to cause unexpected app termination.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43807" target=3D= "_blank" rel=3D"noopener">CVE-2026-43807</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8,=
macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A remote user ma=
y be able to cause unexpected system termination or corrupt kernel memory.<=

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43810" target=3D= "_blank" rel=3D"noopener">CVE-2026-43810</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A race condition was addressed with improved checks. This issue is fixe=
d in iOS 26.6 and iPadOS 26.6. An app may be able to modify protected parts=
of the file system.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43811" target=3D= "_blank" rel=3D"noopener">CVE-2026-43811</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A use after free issue was addressed with improved memory management. T= his issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS=
Tahoe 26.6, tvOS 26.6, visionOS 26.6. An app may be able to cause unexpect=
ed system termination.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43812" target=3D= "_blank" rel=3D"noopener">CVE-2026-43812</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A validation issue was addressed with improved input sanitization. This=
issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, v= isionOS 26.6, watchOS 26.6. A maliciously crafted app may be able to bypass=
code signing enforcement.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43813" target=3D= "_blank" rel=3D"noopener">CVE-2026-43813</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A use after free issue was addressed with improved memory management. T= his issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6=
, watchOS 26.6. An app may be able to cause unexpected system termination.<=

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43814" target=3D= "_blank" rel=3D"noopener">CVE-2026-43814</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An out-of-bounds write issue was addressed with improved bounds checkin=
g. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS = 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected s= ystem termination.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43816" target=3D= "_blank" rel=3D"noopener">CVE-2026-43816</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An out-of-bounds read was addressed with improved bounds checking. This=
issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, v= isionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system t= ermination.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43817" target=3D= "_blank" rel=3D"noopener">CVE-2026-43817</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An integer overflow was addressed with improved input validation. This = issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Son= oma 14.8.8, macOS Tahoe 26.6. Processing a maliciously crafted image may le=
ad to arbitrary code execution.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43818" target=3D= "_blank" rel=3D"noopener">CVE-2026-43818</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A use after free issue was addressed with improved memory management. T= his issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS=
Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A=
n app may be able to cause unexpected system termination.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43822" target=3D= "_blank" rel=3D"noopener">CVE-2026-43822</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An out-of-bounds read was addressed with improved bounds checking. This=
issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS So= noma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An a=
pp may be able to cause a denial-of-service.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64692" target=3D= "_blank" rel=3D"noopener">CVE-2026-64692</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A type confusion issue was addressed with improved checks. This issue i=
s fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.= 8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a=
maliciously crafted image may lead to a denial-of-service.</td>

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64693" target=3D= "_blank" rel=3D"noopener">CVE-2026-64693</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A use after free issue was addressed with improved memory management. T= his issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS=
Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A=
n app may be able to cause unexpected system termination.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64700" target=3D= "_blank" rel=3D"noopener">CVE-2026-64700</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A permissions issue was addressed with improved validation. This issue =
is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14= .8.8, macOS Tahoe 26.6, visionOS 26.6. An app may be able to delete files f=
or which it does not have permission.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64707" target=3D= "_blank" rel=3D"noopener">CVE-2026-64707</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8,=
macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be ab=
le to disclose kernel memory.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64709" target=3D= "_blank" rel=3D"noopener">CVE-2026-64709</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>This issue was addressed with additional entitlement checks. This issue=
is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 1= 4.8.8, macOS Tahoe 26.6. An app may be able to leak sensitive user informat= ion.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64711" target=3D= "_blank" rel=3D"noopener">CVE-2026-64711</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8,=
macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a mal= iciously crafted image may corrupt process memory.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64716" target=3D= "_blank" rel=3D"noopener">CVE-2026-64716</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A race condition was addressed with improved state handling. This issue=
is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS=
26.6. An app may be able to cause unexpected system termination.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64720" target=3D= "_blank" rel=3D"noopener">CVE-2026-64720</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>This issue was addressed through improved state management. This issue =
is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14= .8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may =
be able to access sensitive user data.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64721" target=3D= "_blank" rel=3D"noopener">CVE-2026-64721</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A buffer overflow issue was addressed with improved memory handling. Th=
is issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS = Tahoe 26.6. Processing a 3D model may result in disclosure of process memor= y.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64722" target=3D= "_blank" rel=3D"noopener">CVE-2026-64722</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8,=
macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An attacker on t=
he local network may be able to cause a denial-of-service.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64724" target=3D= "_blank" rel=3D"noopener">CVE-2026-64724</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An out-of-bounds write issue was addressed with improved bounds checkin=
g. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, m= acOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.=
6. An app may be able to cause a denial-of-service.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64725" target=3D= "_blank" rel=3D"noopener">CVE-2026-64725</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6=
, watchOS 26.6. An attacker in physical proximity may be able to corrupt pr= ocess memory.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64726" target=3D= "_blank" rel=3D"noopener">CVE-2026-64726</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A use after free issue was addressed with improved memory management. T= his issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6=
, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected syste=
m termination.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64729" target=3D= "_blank" rel=3D"noopener">CVE-2026-64729</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>This issue was addressed through improved state management. This issue =
is fixed in iOS 26.6 and iPadOS 26.6. An attacker with physical access may =
be able to access sensitive user data during iPhone Mirroring.</td>

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64732" target=3D= "_blank" rel=3D"noopener">CVE-2026-64732</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>This issue was addressed with improved data protection. This issue is f= ixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.=
6, watchOS 26.6. An app may be able to fingerprint the user.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64733" target=3D= "_blank" rel=3D"noopener">CVE-2026-64733</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>The issue was addressed with improved checks. This issue is fixed in iO=
S 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Ta= hoe 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted con= tact may leak sensitive data.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64734" target=3D= "_blank" rel=3D"noopener">CVE-2026-64734</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An inconsistent user interface issue was addressed with improved state = management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia = 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, wa= tchOS 26.6. A remote attacker may be able to bypass network filters.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64735" target=3D= "_blank" rel=3D"noopener">CVE-2026-64735</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An out-of-bounds write issue was addressed with improved bounds checkin=
g. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, m= acOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.=
6. An attacker may be able to cause unexpected app termination.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64739" target=3D= "_blank" rel=3D"noopener">CVE-2026-64739</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A parsing issue in the handling of directory paths was addressed with i= mproved path validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, m= acOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6. A ma= licious app may be able to break out of its sandbox.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64740" target=3D= "_blank" rel=3D"noopener">CVE-2026-64740</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A permissions issue was addressed with additional restrictions. This is= sue is fixed in iOS 26.6 and iPadOS 26.6, tvOS 26.6, visionOS 26.6, watchOS=
26.6. An app may be able to read a persistent device identifier.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64741" target=3D= "_blank" rel=3D"noopener">CVE-2026-64741</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>This issue was addressed by using HTTPS when sending information over t=
he network. This issue is fixed in iOS 26.6 and iPadOS 26.6, tvOS 26.6, vis= ionOS 26.6, watchOS 26.6. An app may be able to access sensitive user data.= </td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64742" target=3D= "_blank" rel=3D"noopener">CVE-2026-64742</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An authorization issue was addressed with improved state management. Th=
is issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6,=
visionOS 26.6, watchOS 26.6. An app may be able to access sensitive user d= ata.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64743" target=3D= "_blank" rel=3D"noopener">CVE-2026-64743</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An authorization issue was addressed with improved validation. This iss=
ue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, w= atchOS 26.6. An app may be able to add contacts without user authorization.= </td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64746" target=3D= "_blank" rel=3D"noopener">CVE-2026-64746</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A buffer overflow was addressed with improved size validation. This iss=
ue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma=
14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app m=
ay be able to execute arbitrary code with kernel privileges.</td>

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64747" target=3D= "_blank" rel=3D"noopener">CVE-2026-64747</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, vi= sionOS 26.6. An app may be able to cause unexpected system termination or c= orrupt kernel memory.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64749" target=3D= "_blank" rel=3D"noopener">CVE-2026-64749</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A use after free issue was addressed with improved memory management. T= his issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6=
, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected syste=
m termination or write kernel memory.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64751" target=3D= "_blank" rel=3D"noopener">CVE-2026-64751</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An out-of-bounds write issue was addressed with improved bounds checkin=
g. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, m= acOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.=
6. Processing a maliciously crafted file may lead to a denial-of-service.</=

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64754" target=3D= "_blank" rel=3D"noopener">CVE-2026-64754</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An authorization issue was addressed with improved state management. Th=
is issue is fixed in iOS 26.6 and iPadOS 26.6. An app may be able to access=
sensitive user data.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64755" target=3D= "_blank" rel=3D"noopener">CVE-2026-64755</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>The issue was addressed with improved bounds checks. This issue is fixe=
d in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, = watchOS 26.6. Processing a maliciously crafted file may lead to unexpected = app termination.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64758" target=3D= "_blank" rel=3D"noopener">CVE-2026-64758</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An out-of-bounds write issue was addressed by removing the vulnerable c= ode. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8,=
macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 2= 6.6. Processing a maliciously crafted file may lead to unexpected app termi= nation or arbitrary code execution.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64763" target=3D= "_blank" rel=3D"noopener">CVE-2026-64763</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An out-of-bounds write issue was addressed with improved bounds checkin=
g. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, m= acOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.=
6. Processing a maliciously crafted file may lead to unexpected app termina= tion or arbitrary code execution.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64764" target=3D= "_blank" rel=3D"noopener">CVE-2026-64764</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An integer overflow was addressed with improved input validation. This = issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Son= oma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Proce= ssing a maliciously crafted file may lead to unexpected app termination or = arbitrary code execution.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64765" target=3D= "_blank" rel=3D"noopener">CVE-2026-64765</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An integer overflow was addressed with improved input validation. This = issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Son= oma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Proce= ssing a maliciously crafted file may lead to unexpected app termination or = arbitrary code execution.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64766" target=3D= "_blank" rel=3D"noopener">CVE-2026-64766</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An out-of-bounds read issue was addressed with improved input validatio=
n. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, m= acOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote at= tacker may cause an unexpected app termination.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64768" target=3D= "_blank" rel=3D"noopener">CVE-2026-64768</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An out-of-bounds write issue was addressed with improved bounds checkin=
g. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, m= acOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote at= tacker may be able to cause unexpected application termination or heap corr= uption.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64769" target=3D= "_blank" rel=3D"noopener">CVE-2026-64769</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An out-of-bounds write issue was addressed with improved bounds checkin=
g. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, m= acOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote at= tacker may be able to cause unexpected application termination or heap corr= uption.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64770" target=3D= "_blank" rel=3D"noopener">CVE-2026-64770</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A buffer overflow was addressed with improved bounds checking. This iss=
ue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe = 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unex= pected application termination or heap corruption.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64771" target=3D= "_blank" rel=3D"noopener">CVE-2026-64771</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An out-of-bounds write issue was addressed with improved input validati= on. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, = macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able t=
o cause unexpected application termination or heap corruption.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64772" target=3D= "_blank" rel=3D"noopener">CVE-2026-64772</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>An integer overflow was addressed with improved input validation. This = issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Son= oma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker m=
ay be able to cause unexpected application termination or heap corruption.<=

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64774" target=3D= "_blank" rel=3D"noopener">CVE-2026-64774</a></td>
</tr>

<td class=3D"vendor-product">Apple--iOS and iPadOS</td>
<td>A memory initialization issue was addressed with improved memory handli= ng. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, = macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26= .6. An app may be able to cause unexpected system termination.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64775" target=3D= "_blank" rel=3D"noopener">CVE-2026-64775</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>An information disclosure issue was addressed with improved privacy con= trols. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An=
app may be able to access sensitive user data.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-20672" target=3D= "_blank" rel=3D"noopener">CVE-2026-20672</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>The issue was addressed with improved checks. This issue is fixed in ma= cOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A maliciously crafted ZIP archive = may bypass Gatekeeper checks.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28849" target=3D= "_blank" rel=3D"noopener">CVE-2026-28849</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An attacker may be able t=
o cause unexpected system termination or read kernel memory.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28896" target=3D= "_blank" rel=3D"noopener">CVE-2026-28896</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A file quarantine bypass was addressed with additional checks. This iss=
ue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A maliciously cra= fted ZIP archive may bypass Gatekeeper checks.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28900" target=3D= "_blank" rel=3D"noopener">CVE-2026-28900</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be able t=
o corrupt memory of a system process.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28911" target=3D= "_blank" rel=3D"noopener">CVE-2026-28911</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A logic issue was addressed with improved restrictions. This issue is f= ixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A user may be able to eleva=
te privileges.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28912" target=3D= "_blank" rel=3D"noopener">CVE-2026-28912</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A race condition was addressed with improved state handling. This issue=
is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An app may be able =
to elevate privileges.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28926" target=3D= "_blank" rel=3D"noopener">CVE-2026-28926</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A logic issue existed resulting in memory corruption. This was addresse=
d with improved state management. This issue is fixed in macOS Sequoia 15.7= .8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause a de= nial of service.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28932" target=3D= "_blank" rel=3D"noopener">CVE-2026-28932</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A permissions issue was addressed with additional sandbox restrictions.=
This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Ta= hoe 26.6. An app may be able to bypass network restrictions.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28945" target=3D= "_blank" rel=3D"noopener">CVE-2026-28945</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A buffer overflow was addressed with improved bounds checking. This iss=
ue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6.=
Processing a maliciously crafted image may lead to arbitrary code executio= n.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28981" target=3D= "_blank" rel=3D"noopener">CVE-2026-28981</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A race condition was addressed with improved locking. This issue is fix=
ed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote=
user may be able to cause unexpected system termination or corrupt kernel = memory.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-28982" target=3D= "_blank" rel=3D"noopener">CVE-2026-28982</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Connect= ing to a malicious SMB server may lead to unexpected system termination.</t=

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-39873" target=3D= "_blank" rel=3D"noopener">CVE-2026-39873</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A permissions issue was addressed with additional restrictions. This is= sue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6=
. A malicious app may be able to gain root privileges.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-39874" target=3D= "_blank" rel=3D"noopener">CVE-2026-39874</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A permissions issue was addressed with additional restrictions. This is= sue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6=
. A malicious app may be able to gain root privileges.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-39875" target=3D= "_blank" rel=3D"noopener">CVE-2026-39875</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A memory corruption issue was addressed with improved memory handling. = This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An app ma=
y be able to disclose kernel memory.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-39877" target=3D= "_blank" rel=3D"noopener">CVE-2026-39877</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>This issue was addressed with additional entitlement checks. This issue=
is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A local attacker ma=
y be able to determine the legacy VNC password configured for Screen Sharin= g.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43665" target=3D= "_blank" rel=3D"noopener">CVE-2026-43665</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>An authorization issue was addressed with improved state management. Th=
is issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe=
26.6. A malicious application may be able to bypass Privacy preferences.</=

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43672" target=3D= "_blank" rel=3D"noopener">CVE-2026-43672</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A buffer overflow was addressed with improved bounds checking. This iss=
ue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6.=
A local user may be able to read kernel memory.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43681" target=3D= "_blank" rel=3D"noopener">CVE-2026-43681</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remot=
e user may be able to cause unexpected system termination or corrupt kernel=
memory.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43682" target=3D= "_blank" rel=3D"noopener">CVE-2026-43682</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A race condition was addressed with improved state handling. This issue=
is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A=
n app may be able to gain root privileges.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43693" target=3D= "_blank" rel=3D"noopener">CVE-2026-43693</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app = may be able to cause unexpected system termination or write kernel memory.<=

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43694" target=3D= "_blank" rel=3D"noopener">CVE-2026-43694</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>An injection issue was addressed with improved validation. This issue i=
s fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An app may be able to=
gain root privileges.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43698" target=3D= "_blank" rel=3D"noopener">CVE-2026-43698</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An atta= cker may be able to cause unexpected system termination or corrupt kernel m= emory.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43710" target=3D= "_blank" rel=3D"noopener">CVE-2026-43710</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>This issue was addressed through improved state management. This issue =
is fixed in macOS Tahoe 26.6. An attacker may be able to modify the state o=
f the Keychain.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43728" target=3D= "_blank" rel=3D"noopener">CVE-2026-43728</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. Processing a maliciously = crafted asset catalog may result in disclosure of process memory.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43738" target=3D= "_blank" rel=3D"noopener">CVE-2026-43738</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>An out-of-bounds read was addressed with improved bounds checking. This=
issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 2= 6.6. Parsing a maliciously crafted file may lead to an unexpected app termi= nation.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43747" target=3D= "_blank" rel=3D"noopener">CVE-2026-43747</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>An out-of-bounds write issue was addressed with improved bounds checkin=
g. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. An app ma=
y be able to cause unexpected system termination.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43748" target=3D= "_blank" rel=3D"noopener">CVE-2026-43748</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A parsing issue in the handling of directory paths was addressed with i= mproved path validation. This issue is fixed in macOS Sequoia 15.7.8, macOS=
Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to gain root privilege= s.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43749" target=3D= "_blank" rel=3D"noopener">CVE-2026-43749</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A buffer overflow was addressed with improved bounds checking. This iss=
ue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6.=
An app may be able to execute arbitrary code out of its sandbox or with ce= rtain elevated privileges.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43750" target=3D= "_blank" rel=3D"noopener">CVE-2026-43750</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>This issue was addressed with improved redaction of sensitive informati= on. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS=
Tahoe 26.6. An app may be able to leak sensitive kernel state.</td>

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43754" target=3D= "_blank" rel=3D"noopener">CVE-2026-43754</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A race condition was addressed with improved state management. This iss=
ue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to=
gain root privileges.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43755" target=3D= "_blank" rel=3D"noopener">CVE-2026-43755</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A logic issue was addressed with improved validation. This issue is fix=
ed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app m=
ay be able to access user-sensitive data.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43756" target=3D= "_blank" rel=3D"noopener">CVE-2026-43756</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>An out-of-bounds read was addressed with improved bounds checking. This=
issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 2= 6.6. An app may be able to cause unexpected system termination.</td>

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43757" target=3D= "_blank" rel=3D"noopener">CVE-2026-43757</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>An authorization issue was addressed with improved state management. Th=
is issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe=
26.6, watchOS 26.6. An app may be able to access sensitive user data.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43758" target=3D= "_blank" rel=3D"noopener">CVE-2026-43758</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>An authorization issue was addressed with improved state management. Th=
is issue is fixed in macOS Tahoe 26.6, watchOS 26.6. An app may be able to = access sensitive user data.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43759" target=3D= "_blank" rel=3D"noopener">CVE-2026-43759</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>An access issue was addressed with improved access restrictions. This i= ssue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able =
to access user-sensitive data.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43760" target=3D= "_blank" rel=3D"noopener">CVE-2026-43760</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A permissions issue was addressed by removing the vulnerable code. This=
issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 2= 6.6. An app may be able to read files outside of its sandbox.</td>

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43763" target=3D= "_blank" rel=3D"noopener">CVE-2026-43763</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>An integer overflow was addressed with improved input validation. This = issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26= .6. An app may be able to cause unexpected system termination.</td>

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43764" target=3D= "_blank" rel=3D"noopener">CVE-2026-43764</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>This issue was addressed with improved handling of symlinks. This issue=
is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A=
n app may be able to modify protected parts of the file system.</td>

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43765" target=3D= "_blank" rel=3D"noopener">CVE-2026-43765</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>An authorization issue was addressed with improved state management. Th=
is issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe=
26.6. An attacker with physical access to a locked device may be able to v= iew sensitive user information.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43766" target=3D= "_blank" rel=3D"noopener">CVE-2026-43766</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app = may be able to cause unexpected system termination.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43767" target=3D= "_blank" rel=3D"noopener">CVE-2026-43767</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app = may be able to cause unexpected system termination.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43768" target=3D= "_blank" rel=3D"noopener">CVE-2026-43768</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A race condition was addressed with additional validation. This issue i=
s fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvO=
S 26.6. An app may be able to access sensitive user data.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43770" target=3D= "_blank" rel=3D"noopener">CVE-2026-43770</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A stack overflow was addressed with improved input validation. This iss=
ue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6.=
An app may be able to cause a denial-of-service.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43771" target=3D= "_blank" rel=3D"noopener">CVE-2026-43771</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A path traversal issue was addressed with improved input validation. Th=
is issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe=
26.6. An app may be able to break out of its sandbox.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43772" target=3D= "_blank" rel=3D"noopener">CVE-2026-43772</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>An out-of-bounds read was addressed with improved bounds checking. This=
issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 2= 6.6. Mounting a maliciously crafted disk image may cause unexpected system = termination or corrupt kernel memory.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43773" target=3D= "_blank" rel=3D"noopener">CVE-2026-43773</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>An out-of-bounds read was addressed with improved bounds checking. This=
issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 2= 6.6. An app may be able to access sensitive user data.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43774" target=3D= "_blank" rel=3D"noopener">CVE-2026-43774</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>An authorization issue was addressed with improved state management. Th=
is issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. An app may be = able to access sensitive user data.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43775" target=3D= "_blank" rel=3D"noopener">CVE-2026-43775</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>This issue was addressed with improved input validation. This issue is = fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A rem= ote attacker may be able to cause a denial of service.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43777" target=3D= "_blank" rel=3D"noopener">CVE-2026-43777</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A logic issue was addressed with improved restrictions. This issue is f= ixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app=
may be able to intercept network connections intended for another process.= </td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43779" target=3D= "_blank" rel=3D"noopener">CVE-2026-43779</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A race condition was addressed with improved state handling. This issue=
is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A=
n app may be able to access sensitive user data.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43781" target=3D= "_blank" rel=3D"noopener">CVE-2026-43781</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>This issue was addressed with improved checks. This issue is fixed in m= acOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be a= ble to access sensitive user data.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43782" target=3D= "_blank" rel=3D"noopener">CVE-2026-43782</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>An issue existed in the handling of environment variables. This issue w=
as addressed with improved validation. This issue is fixed in macOS Sequoia=
15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause=
unexpected system termination.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43793" target=3D= "_blank" rel=3D"noopener">CVE-2026-43793</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>An out-of-bounds write issue was addressed with improved bounds checkin=
g. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS = Tahoe 26.6. An app may be able to cause unexpected system termination.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43802" target=3D= "_blank" rel=3D"noopener">CVE-2026-43802</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A denial of service issue was addressed by removing the vulnerable code=
. This issue is fixed in macOS Tahoe 26.6. A local attacker may be able to = cause a denial of service.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43806" target=3D= "_blank" rel=3D"noopener">CVE-2026-43806</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>An out-of-bounds read was addressed with improved bounds checking. This=
issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 2= 6.6. An app may be able to cause unexpected system termination.</td>

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43809" target=3D= "_blank" rel=3D"noopener">CVE-2026-43809</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>An access issue was addressed with additional sandbox restrictions. Thi=
s issue is fixed in macOS Tahoe 26.6. An app may be able to access sensitiv=
e user data.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43819" target=3D= "_blank" rel=3D"noopener">CVE-2026-43819</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A buffer overflow was addressed with improved size validation. This iss=
ue is fixed in macOS Tahoe 26.6. An app may be able to cause unexpected sys= tem termination.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64691" target=3D= "_blank" rel=3D"noopener">CVE-2026-64691</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>An integer overflow was addressed with improved input validation. This = issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26= .6. An app may be able to cause unexpected system termination.</td>

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64694" target=3D= "_blank" rel=3D"noopener">CVE-2026-64694</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remot=
e user may be able to cause unexpected system termination or corrupt kernel=
memory.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64695" target=3D= "_blank" rel=3D"noopener">CVE-2026-64695</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remot=
e user may be able to cause unexpected system termination or corrupt kernel=
memory.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64696" target=3D= "_blank" rel=3D"noopener">CVE-2026-64696</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app = may be able to cause unexpected system termination or corrupt kernel memory= .</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64697" target=3D= "_blank" rel=3D"noopener">CVE-2026-64697</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>The issue was addressed with improved memory handling. This issue is fi= xed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app = may be able to cause unexpected system termination or read kernel memory.</=

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64698" target=3D= "_blank" rel=3D"noopener">CVE-2026-64698</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A memory initialization issue was addressed with improved memory handli= ng. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS=
Tahoe 26.6. An app may be able to disclose kernel memory.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64699" target=3D= "_blank" rel=3D"noopener">CVE-2026-64699</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>An access issue was addressed with additional sandbox restrictions. Thi=
s issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe = 26.6. An app may be able to break out of its sandbox.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64702" target=3D= "_blank" rel=3D"noopener">CVE-2026-64702</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A use after free issue was addressed with improved memory management. T= his issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Taho=
e 26.6. An app may be able to cause a denial-of-service.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64703" target=3D= "_blank" rel=3D"noopener">CVE-2026-64703</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A type confusion issue was addressed with improved memory handling. Thi=
s issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe = 26.6. An app may be able to cause unexpected system termination.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64704" target=3D= "_blank" rel=3D"noopener">CVE-2026-64704</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A file quarantine bypass was addressed with additional checks. This iss=
ue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6.=
An app may bypass Gatekeeper checks.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64708" target=3D= "_blank" rel=3D"noopener">CVE-2026-64708</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A privacy issue was addressed by removing sensitive data. This issue is=
fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An a=
pp may be able to leak sensitive user information.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64710" target=3D= "_blank" rel=3D"noopener">CVE-2026-64710</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A logic issue was addressed with improved checks. This issue is fixed i=
n macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may b=
e able to access sensitive user data.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64723" target=3D= "_blank" rel=3D"noopener">CVE-2026-64723</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A type confusion issue was addressed with improved memory handling. Thi=
s issue is fixed in macOS Tahoe 26.6, tvOS 26.6. An app may be able to caus=
e unexpected system termination.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64727" target=3D= "_blank" rel=3D"noopener">CVE-2026-64727</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A path handling issue was addressed with improved validation. This issu=
e is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A malicious app may b=
e able to break out of its sandbox.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64731" target=3D= "_blank" rel=3D"noopener">CVE-2026-64731</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>An authorization issue was addressed with improved state management. Th=
is issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe=
26.6. A malicious app may be able to break out of its sandbox.</td>

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64737" target=3D= "_blank" rel=3D"noopener">CVE-2026-64737</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A permissions issue was addressed with additional restrictions. This is= sue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6=
. A malicious app may be able to break out of its sandbox.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64738" target=3D= "_blank" rel=3D"noopener">CVE-2026-64738</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>An information leakage was addressed with additional validation. This i= ssue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.=
6. An app may be able to disclose kernel memory.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64744" target=3D= "_blank" rel=3D"noopener">CVE-2026-64744</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>This issue was addressed with additional restrictions on the lock scree=
n. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A person = with physical access to a locked device may be able to access contacts and = photos.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64745" target=3D= "_blank" rel=3D"noopener">CVE-2026-64745</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>An out-of-bounds read was addressed with improved bounds checking. This=
issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 2= 6.6. An app may be able to cause unexpected system termination.</td>

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64762" target=3D= "_blank" rel=3D"noopener">CVE-2026-64762</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>A buffer overflow was addressed with improved bounds checking. This iss=
ue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6.=
A remote attacker may be able to cause unexpected system termination or co= rrupt kernel memory.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64767" target=3D= "_blank" rel=3D"noopener">CVE-2026-64767</a></td>
</tr>

<td class=3D"vendor-product">Apple--macOS</td>
<td>The issue was addressed with improved bounds checks. This issue is fixe=
d in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app ma=
y be able to disclose kernel memory.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64776" target=3D= "_blank" rel=3D"noopener">CVE-2026-64776</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>An authorization issue was addressed with improved state management. Th=
is issue is fixed in Safari 26.6, macOS Tahoe 26.6. An app may be able to a= ccess sensitive user data.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43792" target=3D= "_blank" rel=3D"noopener">CVE-2026-43792</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>This issue was addressed through improved state management. This issue =
is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, vision=
OS 26.6. Visiting a website may lead to an app denial-of-service.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43804" target=3D= "_blank" rel=3D"noopener">CVE-2026-43804</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>An access issue was addressed with improved access restrictions. This i= ssue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, t= vOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to read files out= side of its sandbox.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43821" target=3D= "_blank" rel=3D"noopener">CVE-2026-43821</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>This issue was addressed with improved checks. This issue is fixed in S= afari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS=
26.6, watchOS 26.6. Websites may know if the user has visited a given link= .</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64713" target=3D= "_blank" rel=3D"noopener">CVE-2026-64713</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>A use-after-free issue was addressed with improved memory management. T= his issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26= .6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted = web content may lead to an unexpected Safari crash.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64718" target=3D= "_blank" rel=3D"noopener">CVE-2026-64718</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>An out-of-bounds access issue was addressed with improved bounds checki= ng. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tah=
oe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously cra= fted web content may lead to an unexpected Safari crash.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64719" target=3D= "_blank" rel=3D"noopener">CVE-2026-64719</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>A permissions issue was addressed with improved validation. This issue =
is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 2= 6.6, visionOS 26.6, watchOS 26.6. Maliciously crafted web content may viola=
te iframe sandboxing policy.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64728" target=3D= "_blank" rel=3D"noopener">CVE-2026-64728</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>The issue was addressed with improved UI. This issue is fixed in Safari=
26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6=
, watchOS 26.6. Visiting a website that frames malicious content may lead t=
o UI spoofing.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64730" target=3D= "_blank" rel=3D"noopener">CVE-2026-64730</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>A memory corruption issue was addressed with improved state management.=
This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe = 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web conte=
nt may lead to an unexpected Safari crash.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64757" target=3D= "_blank" rel=3D"noopener">CVE-2026-64757</a></td>
</tr>

<td class=3D"vendor-product">Apple--Safari</td>
<td>A use-after-free issue was addressed with improved memory management. T= his issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26= .6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content=
may lead to an unexpected Safari crash.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64783" target=3D= "_blank" rel=3D"noopener">CVE-2026-64783</a></td>
</tr>

<td class=3D"vendor-product">Appointment Booking--Appointment Booking Plugi= n</td>
<td>The Appointment Booking Plugin WordPress plugin before 5.6.8 does not r= estrict which booking fields an unauthenticated visitor can set through its=
public booking funnel, allowing an unauthenticated user to assign a privil= eged booking field such as the approval status and thereby bypass the site'=
s booking approval workflow.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15250" target=3D= "_blank" rel=3D"noopener">CVE-2026-15250</a></td>
</tr>

<td class=3D"vendor-product">Asseco--proCertum SmartSign</td>
<td>proCertum SmartSign opens Certificate Practice Statement (CPS) URI with= out schema validation. An attacker can prepare arbitrary certificate with C=
PS URI pointing to a local executable file or any URL, sign a document with=
it, and send it to the victim.=C2=A0When the victim opens the document in = the application, the specified file will be executed (or webpage will be op= ened). This issue was fixed in version 9.4.3.90.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57916" target=3D= "_blank" rel=3D"noopener">CVE-2026-57916</a></td>
</tr>

<td class=3D"vendor-product">Asseco--proCertum SmartSign</td>
<td>proCertum SmartSign=C2=A0parses external XML entities from arbitrary cr= afted signature files, enabling SSRF and potentially allowing the reading o=
f local files, depending on the parser's configuration. The XML External En= tity (XXE) vulnerability is triggered simply by previewing a file in the fi=
le selection window, before the victim clicks "Open". This issue was fixed =
in version 9.4.3.90.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-57917" target=3D= "_blank" rel=3D"noopener">CVE-2026-57917</a></td>
</tr>

<td class=3D"vendor-product">ASUS--Armoury Crate</td>
<td>Concurrent Execution using Shared Resource with Improper Synchronizatio=
n ("Race Condition") in ASUS Armoury Crate allows a local user to execute a= rbitrary code with elevated privileges via a crafted file replacement. Refe=
r to the '=C2=A0Security Update for ASUS Armoury Crate=C2=A0' section on th=
e ASUS Security Advisory for more information.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16727" target=3D= "_blank" rel=3D"noopener">CVE-2026-16727</a></td>
</tr>

<td class=3D"vendor-product">ASUSTOR Inc.--ADM</td>
<td>A stored format string vulnerability was found in the FTP Backup on the=
ADM. The vulnerability occurs because user-controlled backup configuration=
data may be written into a task log and later processed through an unsafe = format string operation. An authenticated attacker can exploit this issue t=
o disclose memory information or cause denial of service of the affected CG=
I process. Affected products and versions include: from ADM 4.1.0 through A=
DM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18186" target=3D= "_blank" rel=3D"noopener">CVE-2026-18186</a></td>
</tr>

<td class=3D"vendor-product">ASUSTOR Inc.--ADM</td>
<td>A format string vulnerability was found in the Internal Backup on the A= DM. The vulnerability occurs because user-controlled task input may be incl= uded in an error response and processed through an unsafe format string ope= ration. An authenticated attacker can exploit this issue to disclose memory=
information or cause denial of service of the affected CGI process. Affect=
ed products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as = well as from ADM 5.0.0 through ADM 5.1.3.RI81.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18187" target=3D= "_blank" rel=3D"noopener">CVE-2026-18187</a></td>
</tr>

<td class=3D"vendor-product">ASUSTOR Inc.--ADM</td>
<td>A format string vulnerability was found in the Rsync Backup on the ADM.=
The vulnerability occurs because user-controlled rsync backup configuratio=
n or log data may be processed through an unsafe format string operation. A=
n authenticated attacker can exploit this issue to disclose memory informat= ion or cause denial of service of the affected backup component. Affected p= roducts and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well=
as from ADM 5.0.0 through ADM 5.1.3.RI81.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18188" target=3D= "_blank" rel=3D"noopener">CVE-2026-18188</a></td>
</tr>

<td class=3D"vendor-product">ASUSTOR Inc.--ADM</td>
<td>A format string vulnerability was found in the Notification OAuth setti= ngs of ADM. The vulnerability occurs because user-controlled notification c= onfiguration input may be processed through an unsafe format string operati= on. An authenticated administrator can exploit this issue to disclose memor=
y information or cause denial of service of the affected component. Affecte=
d products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as w= ell as from ADM 5.0.0 through ADM 5.1.3.RI81.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67244" target=3D= "_blank" rel=3D"noopener">CVE-2026-67244</a></td>
</tr>

<td class=3D"vendor-product">ASUSTOR Inc.--ADM</td>
<td>A path traversal vulnerability was found in the VPN Clients on the ADM.=
The vulnerability occurs because user-controlled certificate name input is=
not sufficiently validated before being used to construct the upload desti= nation path. An authenticated attacker can exploit this issue to write an u= ploaded certificate file outside the intended VPN certificate directory, su= bject to process privileges and filesystem permissions. Affected products a=
nd versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from = ADM 5.0.0 through ADM 5.1.3.RI81.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67245" target=3D= "_blank" rel=3D"noopener">CVE-2026-67245</a></td>
</tr>

<td class=3D"vendor-product">ASUSTOR Inc.--ADM</td>
<td>A path traversal vulnerability was found in the Wallpaper component of = ADM. The vulnerability occurs because user-controlled wallpaper path input =
is not sufficiently validated before being used for file access. An authent= icated attacker can exploit this issue to access or manipulate files outsid=
e the intended wallpaper directory, subject to user permissions and filesys= tem restrictions. Affected products and versions include: from ADM 4.1.0 th= rough ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67246" target=3D= "_blank" rel=3D"noopener">CVE-2026-67246</a></td>
</tr>

<td class=3D"vendor-product">ASUSTOR Inc.--ADM</td>
<td>A path traversal vulnerability was found in the IHM Log handling of ADM=
. The vulnerability occurs because user-controlled disk serial input is not=
sufficiently validated before being used to construct the path of an IHM l=
og database file. An authenticated attacker can exploit this issue to cause=
the affected component to access an unintended filesystem path or log data= base file. Affected products and versions include: from ADM 4.1.0 through A=
DM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67247" target=3D= "_blank" rel=3D"noopener">CVE-2026-67247</a></td>
</tr>

<td class=3D"vendor-product">ASUSTOR Inc.--ADM</td>
<td>A stack-based buffer overflow vulnerability was found in the File Explo= rer on the ADM. The vulnerability occurs because user-controlled input is n=
ot properly validated before being decoded and copied into a fixed-size sta=
ck buffer. An authenticated attacker can exploit this issue to cause denial=
of service of the affected CGI process. Further impact may be possible dep= ending on exploitability and runtime protections. Affected products and ver= sions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.= 0.0 through ADM 5.1.3.RI81.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67248" target=3D= "_blank" rel=3D"noopener">CVE-2026-67248</a></td>
</tr>

<td class=3D"vendor-product">AT&amp;T--Arris BGW210700</td>
<td>In firmware versions 2.7.7 and earlier, the Arris BGW210 700 gateway fa= ils to enforce any server side authentication on its /cgi-bin/*.ha manageme=
nt endpoints, relying solely on client side CSS/JavaScript gating that can =
be bypassed by any HTTP client. This allows unauthenticated attackers on th=
e LAN to read sensitive configuration data, modify persistent device settin= gs, or trigger backend diagnostic operations. The issue appears systemic ac= ross the CGI handler chain.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16771" target=3D= "_blank" rel=3D"noopener">CVE-2026-16771</a></td>
</tr>

<td class=3D"vendor-product">ATEN--Unizon</td>
<td>ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulner= ability. This vulnerability allows remote attackers to create a denial-of-s= ervice condition on affected installations of ATEN Unizon. Authentication i=
s not required to exploit this vulnerability. The specific flaw exists with=
in the RpcProvider class. The issue results from the lack of authentication=
prior to allowing access to functionality. An attacker can leverage this v= ulnerability to create a denial-of-service condition on the system. Was ZDI= -CAN-29041.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5057" target=3D"= _blank" rel=3D"noopener">CVE-2026-5057</a></td>
</tr>

<td class=3D"vendor-product">Autel--MaxiCharger AC Elite Home</td>
<td>Autel MaxiCharger AC Elite Home Software Update Improper Verification o=
f Cryptographic Signature Arbitrary Code Execution Vulnerability. This vuln= erability allows physically present attackers to execute arbitrary code on = affected installations of Autel MaxiCharger AC Elite Home EV chargers. Auth= entication is not required to exploit this vulnerability. The specific flaw=
exists within the handling of software updates. The issue results from the=
lack of proper validation of a user-supplied software update image. An att= acker can leverage this vulnerability to execute code in the context of the=
device. Was ZDI-CAN-29062.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13305" target=3D= "_blank" rel=3D"noopener">CVE-2026-13305</a></td>
</tr>

<td class=3D"vendor-product">Autel--MaxiCharger AC Elite Home</td>
<td>Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability=
. This vulnerability allows physically present attackers to bypass authenti= cation on affected installations of Autel MaxiCharger AC Elite Home EV char= gers. Authentication is not required to exploit this vulnerability. The spe= cific flaw exists within the exposed USB interface. The issue results from = the lack of authentication prior to allowing access to functionality. An at= tacker can leverage this vulnerability to bypass authentication on the syst= em. Was ZDI-CAN-29046.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13306" target=3D= "_blank" rel=3D"noopener">CVE-2026-13306</a></td>
</tr>

<td class=3D"vendor-product">Autel--MaxiCharger AC Elite Home</td>
<td>Autel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrar=
y Code Execution Vulnerability. This vulnerability allows physically presen=
t attackers to execute arbitrary code on affected installations of Autel Ma= xiCharger AC Elite Home EV chargers. Authentication is not required to expl= oit this vulnerability. The specific flaw exists within the handling of cus= tom USB packets. The issue results from the lack of proper validation of th=
e length of user-supplied data prior to copying it to a fixed-length, heap-= based buffer. An attacker can leverage this vulnerability to execute code i=
n the context of the device. Was ZDI-CAN-29048.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13307" target=3D= "_blank" rel=3D"noopener">CVE-2026-13307</a></td>
</tr>

<td class=3D"vendor-product">Autel--MaxiCharger AC Elite Home</td>
<td>Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Cod=
e Execution Vulnerability. This vulnerability allows remote attackers to ex= ecute arbitrary code on affected installations of Autel MaxiCharger AC Elit=
e Home EV chargers. Authentication is not required to exploit this vulnerab= ility. The specific flaw exists within the handling of WebSocket messages r= elated to the OCPP service. The issue results from the lack of proper valid= ation of user-supplied data, which can result in an integer underflow befor=
e allocating a buffer. An attacker can leverage this vulnerability to execu=
te code in the context of the device. Was ZDI-CAN-29113.</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13308" target=3D= "_blank" rel=3D"noopener">CVE-2026-13308</a></td>
</tr>

<td class=3D"vendor-product">Autel--MaxiCharger AC Elite Home</td>
<td>Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitra=
ry Code Execution Vulnerability. This vulnerability allows physically prese=
nt attackers to execute arbitrary code on affected installations of Autel M= axiCharger AC Elite Home EV chargers. Authentication is not required to exp= loit this vulnerability. The specific flaw exists within the handling of ca=
rd responses via the NFC interface. A crafted card response can trigger an = overflow of a fixed-length stack-based buffer. An attacker can leverage thi=
s vulnerability to execute code in the context of the device. Was ZDI-CAN-2= 9044.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13309" target=3D= "_blank" rel=3D"noopener">CVE-2026-13309</a></td>
</tr>

<td class=3D"vendor-product">authlib--joserfc</td>
<td>joserfc is a Python library that provides an implementation of several = JSON Object Signing and Encryption (JOSE) standards. in versions 1.7.1 and = prior, joserfc accepts JWTs with trailing padding (=3D=3D) which are not co= nforming to the JOSE specifications. This leads to malleability of the JWTs=
when consumed by joserfc. Depending on this application this might or not =
be an issue. This could lead to bypass of token revocation or anti-replay p= rotection when implemented as a deny list of tokens or a deny list of token=
hashes. Note that ECDSA JWS are always malleable because of the malleabili=
ty of ECDSA signatures (first test case in the code bellow). This makes a s= cheme which assumes that JWTs are not malleable brittle. However for other = signatures (or MAC) schemes it might make sense to assume non malleability =
of the token. This issue has been fixed in version 1.7.2.</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62995" target=3D= "_blank" rel=3D"noopener">CVE-2026-62995</a></td>
</tr>

<td class=3D"vendor-product">Authora--Authora : Easy login with mobile numb= er</td>
<td>The Authora : Easy login with mobile number WordPress plugin before 1.7=
.7 does not keep its one-time login code confidential, returning the code a=
nd a valid verification token in the response of an unauthenticated action,=
allowing unauthenticated attackers to log in as any user whose registered = mobile number they know (including administrators) or to create arbitrary a= ccounts.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14561" target=3D= "_blank" rel=3D"noopener">CVE-2026-14561</a></td>
</tr>

<td class=3D"vendor-product">axios--axios</td>
<td>axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 c= ontain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSO= N() and used internally when serializing FormData with Content-Type: applic= ation/json). When an application passes attacker-controlled FormData field = names, a field name with thousands of nested bracket-delimited segments cau= ses unbounded recursion in buildPath(), exhausting the JavaScript call stac=
k (RangeError: Maximum call stack size exceeded) and causing denial of serv= ice for that request, or process termination in applications without approp= riate error handling.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67312" target=3D= "_blank" rel=3D"noopener">CVE-2026-67312</a></td>
</tr>

<td class=3D"vendor-product">axios--axios</td>
<td>axios versions 0.28.0 and later contain uncontrolled recursion in formD= ataToJSON when processing FormData field names with deeply nested bracket s= egments. Attackers can supply FormData with field names containing thousand=
s of nested brackets to exhaust the JavaScript call stack and trigger Range= Error, causing request failure or process termination in applications that =
do not handle the exception.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67313" target=3D= "_blank" rel=3D"noopener">CVE-2026-67313</a></td>
</tr>

<td class=3D"vendor-product">axios--axios</td>
<td>axios versions &gt;=3D1.15.2 and &lt;1.18.0 contain prototype-pollution=
read-side gadgets in Basic auth subfield handling (lib/adapters/http.js an=
d lib/helpers/resolveConfig.js). When an application is already affected by=
a separate prototype-pollution primitive and makes an axios request with a=
n own auth object that omits the username and/or password properties, axios=
reads the inherited Object.prototype.username and Object.prototype.passwor=
d values and uses them to construct an outbound 'Authorization: Basic ...' = header. axios itself does not pollute prototypes. The practical impact is o= utbound request tampering: an attacker who controls the polluted prototype = values can inject attacker-chosen Basic auth credentials or replace an exis= ting Authorization header. Credential disclosure is only possible under add= itional application-specific conditions.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67314" target=3D= "_blank" rel=3D"noopener">CVE-2026-67314</a></td>
</tr>

<td class=3D"vendor-product">axios--axios</td>
<td>axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to re= cognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing req= uests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URL=
s to route requests through configured proxies, potentially exposing local = services when the proxy can reach the destination.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67315" target=3D= "_blank" rel=3D"noopener">CVE-2026-67315</a></td>
</tr>

<td class=3D"vendor-product">axios--axios</td>
<td>axios is vulnerable to read-side prototype-pollution gadgets that can a= lter request construction when Object.prototype has already been polluted b=
y a separate vulnerability or dependency. In the bodyless method aliases (a= xios.get(), axios.delete(), axios.head(), axios.options()), inherited data =
is read via (config || {}).data before config normalization, causing an att= acker-controlled body to be sent on requests that did not set one. Addition=
al low-level paths, only reachable when calling exported adapters/helpers (= e.g. lib/adapters/http.js, unsafe/helpers/resolveConfig.js) directly with p= lain configs and no own proxy or paramsSerializer, can inherit polluted pro=
xy values (routing requests through an attacker-controlled proxy) or params= Serializer values (attacker-controlled URL serialization). These low-level = gadgets do not reproduce through normal high-level axios calls on 1.15.2+. = The issue is fixed in axios 1.18.0 and 0.33.0.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67316" target=3D= "_blank" rel=3D"noopener">CVE-2026-67316</a></td>
</tr>

<td class=3D"vendor-product">axios--axios</td>
<td>axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WH= ATWG ReadableStream request bodies in the fetch adapter when Content-Length=
cannot be determined. Attackers can supply unknown-length stream data to b= ypass upload size limits and cause uncontrolled network egress or resource = exhaustion.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67317" target=3D= "_blank" rel=3D"noopener">CVE-2026-67317</a></td>
</tr>

<td class=3D"vendor-product">axios--axios</td>
<td>axios versions &gt;=3D1.13.0 (Node.js HTTP adapter) fail to enforce the=
configured maxBodyLength limit on streamed request bodies when requests ar=
e sent with httpVersion: 2. Because Node's HTTP/2 request API does not hono=
r the maxBodyLength option and axios's byte-counting stream wrapper is gate=
d on maxRedirects =3D=3D=3D 0, an attacker who controls a stream passed to = axios can cause the application to transmit outbound data exceeding the con= figured finite maxBodyLength. Impact is limited to resource consumption and=
policy bypass (excess egress, upstream quota consumption, limited availabi= lity); it does not enable code execution, credential disclosure, or request= -destination control. Calls using the default maxBodyLength: -1 and browser=
adapters are not affected.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67318" target=3D= "_blank" rel=3D"noopener">CVE-2026-67318</a></td>
</tr>

<td class=3D"vendor-product">axios--axios</td>
<td>axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited prope= rties from nested request option objects when the JavaScript process's Obje= ct.prototype has already been polluted by another component. While the top-= level merged config uses a null prototype, nested plain objects such as aut=
h and paramsSerializer are cloned into ordinary objects and read without ow= n-property checks. When an application passes placeholder nested objects su=
ch as auth: {} or paramsSerializer: {}, inherited username/password values = can cause silent injection of an Authorization: Basic header, and inherited=
encode/serialize values can alter query-string serialization (full seriali= zer replacement requires a function-valued pollution primitive). This is ex= ploitable only in the presence of pre-existing prototype pollution.</td> <td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67319" target=3D= "_blank" rel=3D"noopener">CVE-2026-67319</a></td>
</tr>

<td class=3D"vendor-product">axios--axios</td>
<td>axios in a Node.js deployment using the HTTP adapter can route requests=
through an attacker-controlled proxy. axios hardens merged request configu= ration by creating a null-prototype object, but request interceptors run af= ter the merge; a common immutable interceptor pattern such as {...config} o=
r Object.assign({}, config) converts the hardened config back into a regula=
r object. axios then dispatches that object without re-hardening it, and th=
e Node HTTP adapter reads config.proxy through the prototype chain. If an a= ttacker can pollute Object.prototype.proxy, affected requests can be routed=
through an attacker-controlled proxy. For plaintext HTTP requests, the pro=
xy can observe Authorization headers, Basic auth from config.auth, method, = absolute URL, Host, and request body, and can return its own response. This=
does not establish browser impact or HTTPS header/body disclosure under no= rmal TLS validation. Affected versions are &gt;=3D0.31.1 (fixed in 0.33.0) = and &gt;=3D1.15.2 (fixed in 1.18.0).</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67320" target=3D= "_blank" rel=3D"noopener">CVE-2026-67320</a></td>
</tr>

<td class=3D"vendor-product">axios--axios</td>
<td>axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an=
incomplete depth-limit bypass in toFormData.js when serializing objects wi=
th top-level keys ending in '{}'. Attackers who control object keys and nes= ted values passed to axios form or parameter serialization can trigger a Ra= ngeError from JSON.stringify, causing denial of service in the affected req= uest path.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67321" target=3D= "_blank" rel=3D"noopener">CVE-2026-67321</a></td>
</tr>

<td class=3D"vendor-product">Axway--SecureTransport</td>
<td>A Server-Side Template Injection (SSTI) vulnerability was identified in=
the mail template functionality of the Axway SecureTransport product in ve= rsion 5.5-20260326. This flaw allows an attacker with admin privileges to i= nject arbitrary Java code expressions, which are executed server-side when = the template is rendered (i.e., during email sending). Successful exploitat= ion of this flaw allows an attacker to execute arbitrary code on the server=
that results in full host compromise. This issue affects all Axway SecureT= ransport versions prior 5.5-20260528 update.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9177" target=3D"= _blank" rel=3D"noopener">CVE-2026-9177</a></td>
</tr>

<td class=3D"vendor-product">balbooa.com--Balbooa Forms component for Jooml= a</td>
<td>Joomla Extension - balbooa.com - Unauthenticated remote code execution =
in Balbooa Forms &lt; 2.4.3 - An insecure form processing logic allowed cod=
e execution for forms that include the signature field type.</td> <td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65880" target=3D= "_blank" rel=3D"noopener">CVE-2026-65880</a></td>
</tr>

<td class=3D"vendor-product">balbooa.com--Gridbox extension for Joomla</td> <td>Joomla Extension - balbooa.com - Privilege Escalation in Gridbox &lt; 2= .20.2 - The registration method allows users provided usergroup IDs, allowi=
ng unauthenticated actors to register new accounts with administrative perm= issions.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65884" target=3D= "_blank" rel=3D"noopener">CVE-2026-65884</a></td>
</tr>

<td class=3D"vendor-product">balbooa.com--Gridbox extension for Joomla</td> <td>Joomla Extension - balbooa.com - Authenticated arbitrary file upload in=
Gridbox &lt; 2.20.2 - File upload methods allows authenticated attackers t=
o upload arbitrary files. Turns into an authenticated RCE if combined with = CVE-2026-65884 as the required account can be created by the attacker.</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65885" target=3D= "_blank" rel=3D"noopener">CVE-2026-65885</a></td>
</tr>

<td class=3D"vendor-product">balbooa.com--Gridbox extension for Joomla</td> <td>Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in=
Gridbox &lt; 2.20.2 - The photo viewer allows unauthenticated attackers to=
view arbitrary files.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65886" target=3D= "_blank" rel=3D"noopener">CVE-2026-65886</a></td>
</tr>

<td class=3D"vendor-product">balbooa.com--Gridbox extension for Joomla</td> <td>Joomla Extension - balbooa.com - Unauthenticated arbitrary password res=
et in Gridbox &lt; 2.20.2 - The resetPassword method allows actors to reset=
any user password, allowing to login and act as these users - excluding su= per admins.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65887" target=3D= "_blank" rel=3D"noopener">CVE-2026-65887</a></td>
</tr>

<td class=3D"vendor-product">balbooa.com--Gridbox extension for Joomla</td> <td>Joomla Extension - balbooa.com - Account takeover vulnerability in Grid= box &lt; 2.20.2 - The socialLogin method allows actors to login as any give=
n user on the target site.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65888" target=3D= "_blank" rel=3D"noopener">CVE-2026-65888</a></td>
</tr>

<td class=3D"vendor-product">balbooa.com--Gridbox extension for Joomla</td> <td>Joomla Extension - balbooa.com - Unauthenticated recursive directory de= letion &lt; 2.20.2 - The generateNewApp method allows actors to recursively=
delete directories.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65889" target=3D= "_blank" rel=3D"noopener">CVE-2026-65889</a></td>
</tr>

<td class=3D"vendor-product">balbooa.com--Gridbox extension for Joomla</td> <td>Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridb=
ox &lt; 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inje=
ct SQL in queries.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65890" target=3D= "_blank" rel=3D"noopener">CVE-2026-65890</a></td>
</tr>

<td class=3D"vendor-product">balbooa.com--Gridbox extension for Joomla</td> <td>Joomla Extension - balbooa.com - Various CSRF vectors in the admin inte= rface in Gridbox &lt; 2.20.2</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65947" target=3D= "_blank" rel=3D"noopener">CVE-2026-65947</a></td>
</tr>

<td class=3D"vendor-product">balbooa.com--Gridbox extension for Joomla</td> <td>Joomla Extension - balbooa.com - Payment bypass in Gridbox &lt; 2.20.2<=

<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66488" target=3D= "_blank" rel=3D"noopener">CVE-2026-66488</a></td>
</tr>

<td class=3D"vendor-product">balbooa.com--Gridbox extension for Joomla</td> <td>Joomla Extension - balbooa.com - Various unauthenticated file system di= sclosure in Gridbox &lt; 2.20.2</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66489" target=3D= "_blank" rel=3D"noopener">CVE-2026-66489</a></td>
</tr>

<td class=3D"vendor-product">balbooa.com--Gridbox extension for Joomla</td> <td>Joomla Extension - balbooa.com - Stored cross-site scripting via a comm= ent avatar in Gridbox &lt; 2.20.2</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66490" target=3D= "_blank" rel=3D"noopener">CVE-2026-66490</a></td>
</tr>

<td class=3D"vendor-product">beaugunderson--ip-address</td>
<td>ip-address is a library for parsing and manipulating IPv4 and IPv6 addr= esses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF = through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.get= Type() classifies an address by matching it against a table of known IPv6 s= pecial-use prefixes, returning Global unicast when nothing matches. That ta= ble had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped=
address fell through to Global unicast; NAT64 addresses matched their own = NAT64 labels. The boolean checks isLoopback, isUnspecified, and isMulticast=
compared getType() against a fixed label and so returned false, while isLi= nkLocal and isULA checked only the native IPv6 ranges. The library already = exposed isMapped4() and to4(), but did not apply them inside these checks, =
so a mapped or NAT64 address was never normalized to its embedded IPv4 addr= ess before classification. For IPv4-mapped addresses the host OS routes to = the IPv4 stack, so the misclassification is reachable on any dual-stack hos=
t. For NAT64, the classification bypass is unconditional but end-to-end rea= chability additionally requires a NAT64/DNS64 gateway in the deployment net= work.This issue has been fixed in version 10.2.1.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54272" target=3D= "_blank" rel=3D"noopener">CVE-2026-54272</a></td>
</tr>

<td class=3D"vendor-product">better-auth--better-auth</td>
<td>better-auth versions greater than 1.3.34 and before 1.4.0 contain a vul= nerability in the multi-session plugin's /sign-out after-hook, which trusts=
raw multi-session cookies and forwards extracted values to internalAdapter= .deleteSessions without verifying the cookie signature (e.g., via getSigned= Cookie). An attacker can supply a forged _multi-* cookie to trigger deletio=
n of arbitrary session tokens.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71402" target=3D= "_blank" rel=3D"noopener">CVE-2025-71402</a></td>
</tr>

<td class=3D"vendor-product">better-auth--better-auth</td>
<td>better-auth versions after v0.0.2 and before 1.1.16 contain a reflected=
cross-site scripting (XSS) vulnerability on the /api/auth/error page, wher=
e the value of the 'error' URL parameter is reflected as HTML without prope=
r neutralization. An attacker who coerces a user into visiting a specially-= crafted URL can execute arbitrary JavaScript in the context of the user's b= rowser. The issue is fixed in version 1.1.16.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-71404" target=3D= "_blank" rel=3D"noopener">CVE-2025-71404</a></td>
</tr>

<td class=3D"vendor-product">Bit Form--Bit Form</td>
<td>The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its=
conversational-form display settings before rendering it on the public-fac= ing form, allowing high-privilege users (such as administrators, who do not=
hold the unfiltered_html capability on multisite) to store JavaScript that=
executes in the browser of any visitor who views the form.</td>

<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-15669" target=3D= "_blank" rel=3D"noopener">CVE-2025-15669</a></td>
</tr>

<td class=3D"vendor-product">Bit Form--Bit Form</td>
<td>The Bit Form WordPress plugin before 3.1.2 does not enforce a form's ac= tive/published status on its public form-submission handlers, allowing unau= thenticated users to submit entries to, and fire the configured workflows (= such as email notifications) of forms the site owner has deactivated or unp= ublished.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15054" target=3D= "_blank" rel=3D"noopener">CVE-2026-15054</a></td>
</tr>

<td class=3D"vendor-product">Black Duck--Coverity Connect</td>
<td>A Spring Security authentication and authorization bypass exists in Cov= erity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated ma= licious threat actor that can send a specially crafted HTTP request is able=
to bypass authentication and authorization controls on certain API endpoin=
ts to access data within Coverity.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8338" target=3D"= _blank" rel=3D"noopener">CVE-2026-8338</a></td>
</tr>

<td class=3D"vendor-product">Black Duck--Coverity Connect</td>
<td>A SQL injection vulnerability exists in the Coverity Connect SOAP API f=
or versions between 2024.6.0 and 2026.3.0 (inclusive). A malicious, authent= icated threat actor who sends a specially crafted payload can achieve full = read access to database contents and other unauthorized commands.</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8339" target=3D"= _blank" rel=3D"noopener">CVE-2026-8339</a></td>
</tr>

<td class=3D"vendor-product">BlackBerry--UEM</td>
<td>Improper Neutralization of Input During Web Page Generation vulnerabili=
ty in BlackBerry UEM Management Console of BlackBerry UEM allows Cross-Site=
Scripting (XSS). This issue affects UEM: 12.23.0 QF8 or earlier.</td> <td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18084" target=3D= "_blank" rel=3D"noopener">CVE-2026-18084</a></td>
</tr>

<td class=3D"vendor-product">BlackBerry--UEM</td>
<td>An Improper Input Validation in the BlackBerry UEM=C2=A0Management=C2= =A0Console=C2=A0of=C2=A0BlackBerry UEM=C2=A012.23.0 QF8 and earlier allows = Arbitrary File Download and Potential Denial of Service.</td> <td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18085" target=3D= "_blank" rel=3D"noopener">CVE-2026-18085</a></td>
</tr>

<td class=3D"vendor-product">Booking for Appointments and Events Calendar--= Booking for Appointments and Events Calendar</td>
<td>The Booking for Appointments and Events Calendar WordPress plugin befor=
e 2.4.4 does not restrict which fields can be written through its customer = import, allowing a user with the Amelia Manager role to modify arbitrary co= lumns of any stored user record by supplying them in the import request.</t=

<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14214" target=3D= "_blank" rel=3D"noopener">CVE-2026-14214</a></td>
</tr>

<td class=3D"vendor-product">bookingpress-appointment-booking-pro--bookingp= ress-appointment-booking-pro</td>
<td>The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 = does not correctly invoke its REST permission callback, leaving every route=
in one of its API namespaces reachable without authentication and allowing=
unauthenticated attackers to read customer booking data and modify other u= sers' bookings.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9830" target=3D"= _blank" rel=3D"noopener">CVE-2026-9830</a></td>
</tr>

<td class=3D"vendor-product">Brizy--Brizy</td>
<td>The Brizy WordPress plugin before 2.8.18 does not properly verify autho= rization on a request handler before returning post content, allowing users=
with the Contributor role or higher to read the content of arbitrary posts=
, including other users' private, pending, and draft posts.</td>

<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14195" target=3D= "_blank" rel=3D"noopener">CVE-2026-14195</a></td>
</tr>

<td class=3D"vendor-product">Buckaroo Woocommerce Payments Plugin--Buckaroo=
Woocommerce Payments Plugin</td>
<td>The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 = does not perform any capability check or nonce validation on an AJAX action=
that processes payment capture refunds, allowing any authenticated user, i= ncluding Subscribers, to trigger refunds against captured orders.</td> <td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13329" target=3D= "_blank" rel=3D"noopener">CVE-2026-13329</a></td>
</tr>

<td class=3D"vendor-product">BuddyPress--BuddyPress</td>
<td>The BuddyPress WordPress plugin before 14.5.0 does not properly enforce=
authorization on its private messaging endpoints, allowing any authenticat=
ed user (Subscriber+) to read, modify, or delete other users' private messa= ges.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8155" target=3D"= _blank" rel=3D"noopener">CVE-2026-8155</a></td>
</tr>

<td class=3D"vendor-product">Builderall for WordPress--Builderall for WordP= ress</td>
<td>The Builderall for WordPress plugin before 3.0.2 does not bind the stat=
e value of its public OAuth authentication routes to the initiating user se= ssion, allowing unauthenticated attackers to complete the connection flow a=
nd overwrite the stored third-party integration access token. A durable ove= rwrite requires the site to already be connected to a paid account.</td> <td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11882" target=3D= "_blank" rel=3D"noopener">CVE-2026-11882</a></td>
</tr>

<td class=3D"vendor-product">Calendar--Calendar</td>
<td>The Calendar WordPress plugin before 1.3.18 does not properly escape a = user-supplied event field before outputting it inside an HTML attribute on =
a public-facing page, allowing users with the Contributor role to inject ar= bitrary JavaScript that executes in the browser of anyone viewing the calen= dar.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14827" target=3D= "_blank" rel=3D"noopener">CVE-2026-14827</a></td>
</tr>

<td class=3D"vendor-product">CasfID Servicios Tecnolgicos--NFC Wristbands</=

<td>Use of an insecure cryptographic algorithm in the cashless payment syst=
em using NFC wristbands from CasfID Servicios Tecnol=C3=83=C2=B3gicos S.L.U=
. (version used at Resurrection Fest 2025), which employs cards based on MI= FARE Classic technology (FM11RF08S). The cryptographic weakness of the auth= entication algorithm allows an attacker to retrieve access keys using techn= iques known as Backdoored Nested Attack, read the wristband's entire conten= ts, and clone its credentials onto a compatible rewritable card. Exploitati=
on of this vulnerability could enable the impersonation of other attendees,=
the fraudulent use of the balance associated with their wristbands, and fi= nancial losses for both the affected users and the event organizers.</td> <td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-4648" target=3D"= _blank" rel=3D"noopener">CVE-2026-4648</a></td>
</tr>

<td class=3D"vendor-product">ccyl13--Pentestify</td>
<td>Server-Side Request Forgery in the PDF export component in maalfer Pent= estify before 1.1.0 allows authenticated users to cause outbound HTTP GET r= equests from the server to arbitrary attacker-chosen destinations via unval= idated URLs stored in the finding images field or the report client_logo fi= eld, which the server-side headless browser fetches while rendering the rep= ort.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59231" target=3D= "_blank" rel=3D"noopener">CVE-2026-59231</a></td>
</tr>

<td class=3D"vendor-product">CERT.PL--MWDB Core</td>
<td>MWDB Core versions &gt;=3D2.2.0 and &lt;2.19.0 contain a missing author= ization vulnerability in the Remote Instances proxy API. The proxy API does=
not verify authentication for incoming requests, allowing an unauthenticat=
ed remote attacker to send arbitrary requests to a remote MWDB instance usi=
ng the identity and permissions associated with the configured API key. Thi=
s can result in unauthorized actions being performed on the remote instance=
as if executed by the user whose API key was used to set up the remote ins= tance. The vulnerability is limited to deployments where Remote Instances h= ave been configured.This issue has been fixed in version=C2=A02.19.0</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66723" target=3D= "_blank" rel=3D"noopener">CVE-2026-66723</a></td>
</tr>

<td class=3D"vendor-product">CERT.PL--MWDB Core</td>
<td>MWDB Core versions &gt;=3D2.0.0 and &lt;2.19.0 contain a missing author= ization vulnerability in the deprecated config and blob upload endpoints. T= hese endpoints accept the undocumented POST method, which bypasses the capa= bility checks applied to the documented PUT method. This allows any authent= icated user without the adding_configs or adding_blobs capabilities to uplo=
ad config and text blob objects to the system. The impact is limited to add= ing new config and blob objects. This issue has been fixed in version 2.19.= 0</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66724" target=3D= "_blank" rel=3D"noopener">CVE-2026-66724</a></td>
</tr>

<td class=3D"vendor-product">Charitable--Charitable</td>
<td>The Charitable WordPress plugin before 1.8.5.3 does not sanitise and es= cape one of its campaign image text fields before outputting it in an HTML = attribute, allowing users with a high-privilege campaign-management role to=
perform Stored Cross-Site Scripting attacks that execute on the front-end = campaign page.</td>
<td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-15675" target=3D= "_blank" rel=3D"noopener">CVE-2025-15675</a></td>
</tr>

<td class=3D"vendor-product">Chat On --Chat On Desk Order Notifications</td=

<td>The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does=
not verify that the one-time password has been validated before processing=
a password-reset request, allowing unauthenticated attackers to reset the = password of arbitrary users, including administrators, and take over their = accounts when SMS one-time-password password reset is enabled.</td> <td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14309" target=3D= "_blank" rel=3D"noopener">CVE-2026-14309</a></td>
</tr>

<td class=3D"vendor-product">Check &amp; Log Email--Check &amp; Log Email</=

<td>The Check &amp; Log Email WordPress plugin before 2.0.15 does not prope= rly sanitize and escape parameters before using them in SQL queries, allowi=
ng users with administrator privileges to perform SQL injection attacks.</t=

<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14554" target=3D= "_blank" rel=3D"noopener">CVE-2026-14554</a></td>
</tr>

<td class=3D"vendor-product">Checkmk GmbH--Checkmk</td>
<td>Missing authorization in Checkmk &lt;2.5.0p10, &lt;2.4.0p35, &lt;2.3.0p= 49, and 2.2.0 (EOL) allows an authenticated user lacking the "Edit foreign = Reports" permission to modify reports owned by other users.</td> <td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15227" target=3D= "_blank" rel=3D"noopener">CVE-2026-15227</a></td>
</tr>

<td class=3D"vendor-product">Clever Mega Menu for Visual Composer--Clever M= ega Menu for Visual Composer</td>
<td>The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1=
does not perform a nonce or capability check in an AJAX action that update=
s navigation menu item metadata, allowing any authenticated user, including=
Subscribers, to overwrite menu item content and settings that are rendered=
in the site's public navigation.</td>
<td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11872" target=3D= "_blank" rel=3D"noopener">CVE-2026-11872</a></td>
</tr>

<td class=3D"vendor-product">CleverTap--Web SDK</td>
<td>CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). = The application does not sanitize untrusted data received via window.postMe= ssage before injecting it into the page DOM. An attacker can craft a malici= ous message that, when processed by renderCustomHtml, results in execution =
of arbitrary JavaScript in the context of the hosting site.</td>

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-51684" target=3D= "_blank" rel=3D"noopener">CVE-2025-51684</a></td>
</tr>

<td class=3D"vendor-product">ClickHouse--ClickHouse</td>
<td>SQL Injection vulnerability in ClickHouse Server Versions &lt;=3D 26.3.= 9.8 allows a remote attacker to execute arbitrary code via the create dicti= onaries function.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-51992" target=3D= "_blank" rel=3D"noopener">CVE-2026-51992</a></td>
</tr>

<td class=3D"vendor-product">Clover Payment Gateway by Zaytech for WooComme= rce--Clover Payment Gateway by Zaytech for WooCommerce</td>
<td>The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin = before 1.3.6 does not verify that an approved external payment record actua= lly belongs to the WooCommerce order being completed, nor that the paid amo= unt matches the order total, allowing unauthenticated users to mark arbitra=
ry orders as paid by replaying a single genuinely-approved payment referenc=
e (for example one obtained from their own minimal purchase).</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12493" target=3D= "_blank" rel=3D"noopener">CVE-2026-12493</a></td>
</tr>

<td class=3D"vendor-product">code-projects--Blood System 1.0</td> <td>code-projects Blood System 1.0 is vulnerable to Cross Site Scripting (X= SS) in /don.php via the city field.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-65342" target=3D= "_blank" rel=3D"noopener">CVE-2025-65342</a></td>
</tr>

<td class=3D"vendor-product">CodeAstro--Membership Management System</td> <td>CodeAstro Membership Management System 1.0 is vulnerable to SQL Injecti=
on in /print_membership_card.php?id=3D1.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69930" target=3D= "_blank" rel=3D"noopener">CVE-2025-69930</a></td>
</tr>

<td class=3D"vendor-product">CodeAstro--Membership Management System</td> <td>CodeAstro Membership Management System 1.0 is vulnerable to SQL Injecti=
on in /delete_membership.php?id=3D1.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69931" target=3D= "_blank" rel=3D"noopener">CVE-2025-69931</a></td>
</tr>

<td class=3D"vendor-product">CodeAstro--Membership Management System</td> <td>CodeAstro Membership Management System 1.0 is vulnerable to SQL Injecti=
on in /memberProfile.php?id=3D1.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69933" target=3D= "_blank" rel=3D"noopener">CVE-2025-69933</a></td>
</tr>

<td class=3D"vendor-product">CodeAstro--Membership Management System</td> <td>CodeAstro Membership Management System 1.0 is vulnerable to SQL Injecti=
on in /delete_members.php?id=3D1.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69934" target=3D= "_blank" rel=3D"noopener">CVE-2025-69934</a></td>
</tr>

<td class=3D"vendor-product">CodeAstro--Membership Management System</td> <td>CodeAstro Membership Management System 1.0 is vulnerale to SQL Injectio=
n in the report.php and revenue_report.php via the fromDate parameter.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69935" target=3D= "_blank" rel=3D"noopener">CVE-2025-69935</a></td>
</tr>

<td class=3D"vendor-product">CodeAstro--Membership Management System</td> <td>CodeAstro Membership Management System 1.0 is vulnerable to SQL Injecti=
on in /edit_member.php?id=3D1.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69936" target=3D= "_blank" rel=3D"noopener">CVE-2025-69936</a></td>
</tr>

<td class=3D"vendor-product">CodeAstro--Membership Management System</td> <td>CodeAstro Membership Management System 1.0 is vulnerable to SQL Injecti=
on in the edit_type.php endpoint via the Parameter id.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69937" target=3D= "_blank" rel=3D"noopener">CVE-2025-69937</a></td>
</tr>

<td class=3D"vendor-product">CodeAstro--Membership Management System</td> <td>CodeAstro Membership Management System 1.0 is vulnerable to SQL Injecti=
on in renew.php via the parameter membershipType.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69938" target=3D= "_blank" rel=3D"noopener">CVE-2025-69938</a></td>
</tr>

<td class=3D"vendor-product">Codeless Page Builder--Codeless Page Builder</=

<td>The Codeless Page Builder WordPress plugin through 1.1.4 does not sanit= ize or validate a shortcode attribute before using it as an HTML tag name w= hen rendering content, allowing users with contributor-level access and abo=
ve to inject arbitrary HTML and JavaScript that executes in the session of = any higher-privileged user (such as an administrator) who views the content= .</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15234" target=3D= "_blank" rel=3D"noopener">CVE-2026-15234</a></td>
</tr>

<td class=3D"vendor-product">Contact Form 7--Contact Form 7</td>
<td>The Contact Form 7 WordPress plugin before 2.5 does not validate the ho=
st of a user-supplied return URL before using it as the success and cancel = redirect targets of a Stripe checkout, allowing an unauthenticated attacker=
to redirect a victim, via a crafted link, to an arbitrary external site af= ter the checkout flow.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14236" target=3D= "_blank" rel=3D"noopener">CVE-2026-14236</a></td>
</tr>

<td class=3D"vendor-product">containers--fuse-overlayfs</td>
<td>fuse-overlayfs is an implementation of overlayfs in FUSE for rootless c= ontainers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID = mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-=
up file, allowing a low-privileged process to leave the upper-layer file wi=
th mode 4777. This issue is fixed in version 1.17.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52791" target=3D= "_blank" rel=3D"noopener">CVE-2026-52791</a></td>
</tr>

<td class=3D"vendor-product">coturn--coturn</td>
<td>Coturn is a free open source implementation of TURN and STUN Server. Fr=
om 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect &lt;UR= L&gt; and exposes a plaintext-TCP listener, an unauthenticated remote clien=
t can send a single ordinary HTTP GET request and receive a 301 response wh= ose Location header contains up to ~870 bytes of adjacent process heap memo= ry. The leaked region is a recycled network receive buffer that is reused w= ithout being zeroed, so on a busy server it can contain data from other cli= ents' requests (TURN credentials, OAuth tokens, relayed payloads). Root cau=
se is a signed=C3=A2=E2=80=A0=E2=80=99unsigned conversion. This issue is fi= xed in version 4.15.0.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62959" target=3D= "_blank" rel=3D"noopener">CVE-2026-62959</a></td>
</tr>

<td class=3D"vendor-product">CP-Plus--EZ-P21 IP Camera</td>
<td>This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecur=
e debug feature enabled in the firmware. An attacker with physical access c= ould exploit this vulnerability by placing arbitrary code on removable medi=
a and triggering their execution through the debug mechanism. Successful ex= ploitation of this vulnerability could allow an attacker to execute arbitra=
ry code with elevated privileges on the targeted device.</td>

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65893" target=3D= "_blank" rel=3D"noopener">CVE-2026-65893</a></td>
</tr>

<td class=3D"vendor-product">CP-Plus--EZ-P21 IP Camera</td>
<td>This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper a= uthentication of HTTP endpoints. A remote attacker could exploit this vulne= rability by conducting brute-force attacks against HTTP endpoint on the tar= geted device. Successful exploitation of this vulnerability could allow an = attacker to gain unauthorized access to live video snapshots from the targe= ted device.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65894" target=3D= "_blank" rel=3D"noopener">CVE-2026-65894</a></td>
</tr>

<td class=3D"vendor-product">Cudy--Cudy</td>
<td>TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v= 2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 = were discovered to contain a command injection vulnerability in the system.= setclock interface. This vulnerability allows attackers to execute arbitrar=
y commands as root via a crafted input.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-38708" target=3D= "_blank" rel=3D"noopener">CVE-2026-38708</a></td>
</tr>

<td class=3D"vendor-product">Cudy--Cudy</td>
<td>TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v= 2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 = were discovered to contain a command injection vulnerability in the net.set= _wan interface. This vulnerability allows attackers to execute arbitrary co= mmands as root via a crafted input.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-38709" target=3D= "_blank" rel=3D"noopener">CVE-2026-38709</a></td>
</tr>

<td class=3D"vendor-product">Cudy--Cudy</td>
<td>TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command = injection vulnerability in the system.setclock interface. This vulnerabilit=
y allows attackers to execute arbitrary commands as root via a crafted inpu= t.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-38710" target=3D= "_blank" rel=3D"noopener">CVE-2026-38710</a></td>
</tr>

<td class=3D"vendor-product">Cudy--Cudy</td>
<td>TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v= 2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 = were discovered to contain a command injection vulnerability in the system.= upgrade_check interface. This vulnerability allows attackers to execute arb= itrary commands as root via a crafted input.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-38711" target=3D= "_blank" rel=3D"noopener">CVE-2026-38711</a></td>
</tr>

<td class=3D"vendor-product">Cudy--Cudy</td>
<td>TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v= 2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 = were discovered to contain a command injection vulnerability in the ipsec_c= onn interface. This vulnerability allows attackers to execute arbitrary com= mands as root via a crafted input.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-38713" target=3D= "_blank" rel=3D"noopener">CVE-2026-38713</a></td>
</tr>

<td class=3D"vendor-product">Custom Fields Account Registration For Woocomm= erce--Custom Fields Account Registration For Woocommerce</td>
<td>The Custom Fields Account Registration For Woocommerce WordPress plugin=
before 1.4 does not prevent its custom registration fields from writing to=
the user capabilities meta key on sites that use a non-default database ta= ble prefix, so an unauthenticated user who registers an account can be gran= ted the administrator role when a correspondingly named field has been conf= igured.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13152" target=3D= "_blank" rel=3D"noopener">CVE-2026-13152</a></td>
</tr>

<td class=3D"vendor-product">Customer Switching--Customer Switching</td>

<td>The Customer Switching WordPress plugin before 2.1.3 does not securely = bind an active user-switching session to the operator who initiated it, all= owing a lower-privileged account that an operator is currently switched int=
o to be resolved as that operator and to switch into any permitted account,=
including an administrator, resulting in full account takeover.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15240" target=3D= "_blank" rel=3D"noopener">CVE-2026-15240</a></td>
</tr>

<td class=3D"vendor-product">Database--Database for Contact Form 7, WPforms=
, Elementor forms</td>
<td>The Database for Contact Form 7, WPforms, Elementor forms WordPress plu= gin before 1.5.3 does not properly sanitise and escape a parameter before r= eflecting it back in an admin page, leading to a Reflected Cross-Site Scrip= ting which could be used against high privilege users such as admin.</td> <td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14870" target=3D= "_blank" rel=3D"noopener">CVE-2026-14870</a></td>
</tr>

<td class=3D"vendor-product">DaveGamble--cJSON</td>
<td>cJSON library is vulnerable to an integer overflow in the print_string_= ptr() function in cJSON.c on 32-bit platforms. The escape_characters counte=
r, a 32-bit size_t, can wrap around when processing strings containing appr= oximately 858,993,460 or more control characters, causing the output buffer=
to be allocated based on an underestimated length. When cJSON_PrintBuffere= d() is used with a pre-allocated buffer, the subsequent write loop overflow=
s the heap allocation. An attacker supplying a crafted JSON string to an ap= plication using cJSON on a 32-bit platform can cause a heap buffer overflow=
, potentially leading to remote code execution, information disclosure, or = denial of service. Because project creator contact attempts were unsuccessf= ul, the vulnerability has only been confirmed in version 1.7.19 but may als=
o affect other versions.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16554" target=3D= "_blank" rel=3D"noopener">CVE-2026-16554</a></td>
</tr>

<td class=3D"vendor-product">ddnexus--pagy</td>
<td>Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pa= gy::I18n.locale=3D in gem/lib/pagy/modules/i18n/i18n.rb stored locale value=
s verbatim and later used them as &lt;locale&gt;.yml path components, allow= ing untrusted params[:locale] values with absolute paths or ../ sequences t=
o create a file existence and readability oracle for YAML files. This issue=
is fixed in version 43.5.6.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54659" target=3D= "_blank" rel=3D"noopener">CVE-2026-54659</a></td>
</tr>

<td class=3D"vendor-product">DedeCMS--DeceCMS</td>
<td>SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attac= ker to obtain sensitive information via the sqlquery parameter of the sys_s= ql_query.php component</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-51077" target=3D= "_blank" rel=3D"noopener">CVE-2026-51077</a></td>
</tr>

<td class=3D"vendor-product">DedeCMS--DedeCMS</td>
<td>An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensi= tive information via the str parameter of the file_manage_control.php compo= nent</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-51078" target=3D= "_blank" rel=3D"noopener">CVE-2026-51078</a></td>
</tr>

<td class=3D"vendor-product">Demi--Demi</td>
<td>The Demi WordPress plugin before 0.0.7 stores its full-site backup arch= ives in a publicly accessible location under a predictable filename and wit= hout access protection, allowing unauthenticated attackers to download comp= lete backups including the site database and its user password hashes.</td> <td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14333" target=3D= "_blank" rel=3D"noopener">CVE-2026-14333</a></td>
</tr>

<td class=3D"vendor-product">Develar--app-builder</td>
<td>A vulnerability in the `zipx.Unzip` extraction routine of Develar's app= -builder allows an attacker to overwrite arbitrary files on macOS APFS by e= xploiting a Unicode Normalization Collision combined with symlink following=
behavior. APFS treats certain Unicode equivalent filenames as identical (e= .g., =C3=83=C5=B8 =C3=A2=E2=80=A0=E2=80=9D ss), while app builder performs =
no canonical normalization before validating or writing paths. As a result,=
a crafted ZIP archive containing: =C2=A2 a symlink entry named ss pointing=
to a target file, and =C2=A2 a regular file named =C3=83=C5=B8 containing = attacker controlled data, will cause the second write to follow the symlink=
and overwrite the target file.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13723" target=3D= "_blank" rel=3D"noopener">CVE-2026-13723</a></td>
</tr>

<td class=3D"vendor-product">Devolutions--Password Manager</td>
<td>Improper certificate validation in the Devolutions Server connection ha= ndling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, i= OS, and macOS allows an adjacent-network attacker to intercept and modify s= ensitive information via a forged TLS certificate.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-8497" target=3D"= _blank" rel=3D"noopener">CVE-2026-8497</a></td>
</tr>

<td class=3D"vendor-product">Devolutions--Server</td>
<td>Improper access control in the role membership management endpoint in D= evolutions Server allows an authenticated non-administrative user holding t=
he user-group membership management permission to escalate privileges to ad= ministrator via a crafted API request. This issue affects : * Devolutions S= erver 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and e= arlier</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17568" target=3D= "_blank" rel=3D"noopener">CVE-2026-17568</a></td>
</tr>

<td class=3D"vendor-product">Devolutions--Server</td>
<td>Improper access control in the NetBox synchronizer in Devolutions Serve=
r allows an authenticated user with view-only permission on an entry to obt= ain a stored API token via the partial connection endpoint. This issue affe= cts : * Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Ser= ver 2026.1.23.0 and earlier</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17569" target=3D= "_blank" rel=3D"noopener">CVE-2026-17569</a></td>
</tr>

<td class=3D"vendor-product">Devolutions--Server</td>
<td>Improper access control in the PAM password history endpoints in Devolu= tions Server allows an authenticated low-privileged user to disclose plaint= ext credential secrets via crafted API requests. This issue affects : * Dev= olutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.= 23.0 and earlier</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17570" target=3D= "_blank" rel=3D"noopener">CVE-2026-17570</a></td>
</tr>

<td class=3D"vendor-product">Direct Payments for WooCommerce--Direct Paymen=
ts for WooCommerce</td>
<td>The Direct Payments for WooCommerce WordPress plugin before 2.5.3 does = not verify that the requester owns the targeted WooCommerce order in severa=
l unauthenticated AJAX handlers before changing its status and overwriting = its payment metadata, allowing unauthenticated attackers to tamper with oth=
er customers' orders, including forging a "payment sent" state, overwriting=
the payment-method label, and attaching forged payment-proof files.</td> <td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12966" target=3D= "_blank" rel=3D"noopener">CVE-2026-12966</a></td>
</tr>

<td class=3D"vendor-product">dnsmgr--dnsmgr v.2.15</td>
<td>An issue in dnsmgr v.2.15 and before allows a local attacker to execute=
arbitrary code via the ping function of the CheckUils.php file</td>

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-35847" target=3D= "_blank" rel=3D"noopener">CVE-2026-35847</a></td>
</tr>

<td class=3D"vendor-product">Document Gallery--Document Gallery</td>
<td>The Document Gallery WordPress plugin before 5.1.1 does not properly sa= nitise and escape user input before reflecting it back in the response of a=
n unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting = vulnerability which can be exploited against unauthenticated users.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12982" target=3D= "_blank" rel=3D"noopener">CVE-2026-12982</a></td>
</tr>

<td class=3D"vendor-product">dompdf--dompdf</td>
<td>Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior,=
the=C2=A0validateLocalUri()=C2=A0method enforces chroot boundaries with a= =C2=A0strpos() prefix check after normalizing paths with =C2=A0realpath()= =C2=A0. Because normalization strips the trailing directory separator from = =C2=A0$chrootPath=C2=A0, the check only verifies that =C2=A0$chrootPath=C2=
=A0 is a string prefix of=C2=A0$realfile, so a chroot of =C2=A0/var/www=C2=
=A0 also matches sibling directories like /var/www2=C2=A0, /var/www-admin, = or=C2=A0/var/www_backup. An attacker who controls part of the rendered HTML=
could exploit this to escape the chroot and read sensitive files outside t=
he allowed directory. This issue has been fixed in version 3.16.</td> <td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55554" target=3D= "_blank" rel=3D"noopener">CVE-2026-55554</a></td>
</tr>

<td class=3D"vendor-product">dompdf--dompdf</td>
<td>Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are=
vulnerable to a File Existence Oracle attack through the manipulation of t=
he CSS @font-face directive. By providing malicious HTML that references lo= cal files via the file:// protocol repeatedly, an attacker can trigger PHP = memory exhaustion. Because Dompdf behaves differently depending on whether =
a referenced local file exists (an existing file is processed repeatedly un= til it triggers an "Allowed memory size exhausted" crash, whereas a missing=
file fails fast or is ignored and never hits the memory limit), an attacke=
r can use this observable discrepancy as an oracle to enumerate sensitive f= iles on the server regardless of CHROOT restrictions. Exploitation requires=
the attacker to supply unrestricted or unsanitized HTML in a request that = permits large data, plus a configuration where Dompdf's memory limit is low=
enough to be exhausted (with =C2=A0$_dompdf_show_warnings=3Dtrue=C2=A0 mak= ing the overflow easier to reach). This issue has been fixed in version 3.1= 6.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55555" target=3D= "_blank" rel=3D"noopener">CVE-2026-55555</a></td>
</tr>

<td class=3D"vendor-product">dompdf--dompdf</td>
<td>Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior,=
aAn attacker who controls the HTML input can bypass this restriction by em= bedding a target file path inside an SVG image delivered through a =C2=A0da= ta:=C2=A0 URI, because dompdf processes the SVG twice and the second pass d= oes not enforce the same protections as the first. When rendering, dompdf h= ands the SVG to the separate =C2=A0php-svg-lib=C2=A0 library with external = references forced on, and that library has no knowledge of the chroot direc= tory, blocks only the =C2=A0phar://=C2=A0 scheme, and ultimately reads the = referenced file with no path or protocol validation. This lets an external,=
unauthenticated attacker read arbitrary image files from the server's file=
system in the default configuration. This issue has been fixed in version = 3.16.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56722" target=3D= "_blank" rel=3D"noopener">CVE-2026-56722</a></td>
</tr>

<td class=3D"vendor-product">dompdf--dompdf</td>
<td>Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior acc= ept a BMP image and generates a PDF-compatible PNG based only on its declar=
ed header dimensions and never bounds width =C3=83=E2=80=94 height before t=
he image is converted through GD. A 58-byte BMP whose header declares e.g. = 6000=C3=83=E2=80=946000 is accepted and later drives imagecreatetruecolor($= width, $height) (and PHP's native BMP decoder) to allocate the full pixel c= anvas. A payload can fit in a single HTTP request: the BMP can be inlined a=
s a data:image/bmp;base64, URI inside attacker-controlled HTML, so no uploa=
d, no remote fetch, and no chroot-reachable file is required. I measured a = 169-byte request driving a dompdf render to ~412 MB peak RSS and ~4.8 s of = CPU/wall time, versus ~34 MB for an identically-sized benign request - roug= hly a 12=C3=83=E2=80=94 memory amplification per request, repeatable and un= authenticated. This issue has been fixed in version 3.16.</td> <td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59941" target=3D= "_blank" rel=3D"noopener">CVE-2026-59941</a></td>
</tr>

<td class=3D"vendor-product">dompdf--dompdf</td>
<td>Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are=
vulnerable to a Denial of Service (DoS) attack via resource exhaustion. An=
attacker can crash the PHP process by providing a specially crafted HTML d= ocument containing a single image with massive dimensions (e.g., 30,000x30,= 000 pixels). While Dompdf implements internal checks to validate image dime= nsions, these can be bypassed by using a high-entropy image (such as random=
noise) encoded in Base64 and wrapped in specific CSS containers. The vulne= rability exists because the dimension validation happens early, but the res= ource allocation for calculating the object's bounding box and internal buf= fers during the rendering phase does not strictly limit the cumulative CPU = time or memory usage for a single object that has passed the initial check.=
An unauthenticated remote attacker can cause a complete Denial of Service =
on the web server by submitting a crafted HTML string. This affects any app= lication that allows users to provide HTML content or URLs that are subsequ= ently converted to PDF using Dompdf. This issue has been fixed in version 3= .16.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59942" target=3D= "_blank" rel=3D"noopener">CVE-2026-59942</a></td>
</tr>

<td class=3D"vendor-product">dompdf--dompdf</td>
<td>Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior,=
if a malicious actor can supply unrestricted content for rendering by Domp=
df they can utilize the SVG rendering functionality to leak filesystem info= rmation when rendering PDF files using image references within a data-URI e= ncoded SVG document. Using an &lt;image&gt; element inside a data-URI embed= ded SVG, an attacker can attempt to embed other files via the href or xlink= :href attributes. When processing a file that does not exist (e.g. file:///= DOESNOTEXIST), dompdf behaves differently than it does when accessing a fil=
e or directory that actually exists on the filesystem. This issue has been = fixed in version 3.16.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59943" target=3D= "_blank" rel=3D"noopener">CVE-2026-59943</a></td>
</tr>

<td class=3D"vendor-product">Download Manager--Download Manager</td>
<td>The Download Manager WordPress plugin before 3.3.62 does not bind its t= emporary download token to the requesting session nor expire it promptly, m= aking the token a long-lived, multi-use, portable bearer token, so that an = attacker who obtains one leaked download key can repeatedly download a role=
- or password-protected package file without authorization.</td>

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14235" target=3D= "_blank" rel=3D"noopener">CVE-2026-14235</a></td>
</tr>

<td class=3D"vendor-product">Download Manager--Download Manager</td>
<td>The Download Manager WordPress plugin before 3.3.66 does not properly e= scape a package's title before outputting it in the front-end package templ= ates, allowing users with the Author role or above to store a title that re= sults in arbitrary JavaScript execution in the browser of any user, includi=
ng unauthenticated visitors, who views a page displaying the package.</td> <td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14292" target=3D= "_blank" rel=3D"noopener">CVE-2026-14292</a></td>
</tr>

<td class=3D"vendor-product">DriveLock--DriveLock</td>
<td>DriveLock Directory Traversal Information Disclosure Vulnerability. Thi=
s vulnerability allows remote attackers to disclose sensitive information o=
n affected installations of DriveLock. Authentication is not required to ex= ploit this vulnerability. The specific flaw exists within the web service, = which listens on TCP port 4568 by default. The issue results from the lack =
of proper validation of a user-supplied path prior to using it in file oper= ations. An attacker can leverage this vulnerability to disclose information=
in the context of the service account. Was ZDI-CAN-28746.</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5487" target=3D"= _blank" rel=3D"noopener">CVE-2026-5487</a></td>
</tr>

<td class=3D"vendor-product">DriveLock--DriveLock</td>
<td>DriveLock Directory Traversal Information Disclosure Vulnerability. Thi=
s vulnerability allows remote attackers to disclose sensitive information o=
n affected installations of DriveLock. Authentication is not required to ex= ploit this vulnerability. The specific flaw exists within the web service, = which listens on TCP port 4568 by default. The issue results from the lack =
of proper validation of a user-supplied path prior to using it in file oper= ations. An attacker can leverage this vulnerability to disclose information=
in the context of the service account. Was ZDI-CAN-28719.</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5489" target=3D"= _blank" rel=3D"noopener">CVE-2026-5489</a></td>
</tr>

<td class=3D"vendor-product">DriveLock--DriveLock</td>
<td>DriveLock SQL Injection Privilege Escalation Vulnerability. This vulner= ability allows remote attackers to escalate privileges on affected installa= tions of DriveLock. Authentication is required to exploit this vulnerabilit=
y. The specific flaw exists within the web service, which listens on TCP po=
rt 4568 by default. The issue results from the lack of proper validation of=
a user-supplied string before using it to construct SQL queries. An attack=
er can leverage this vulnerability to escalate privileges to resources norm= ally protected from the user. . Was ZDI-CAN-28726.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5490" target=3D"= _blank" rel=3D"noopener">CVE-2026-5490</a></td>
</tr>

<td class=3D"vendor-product">DriveLock--DriveLock</td>
<td>DriveLock Directory Traversal Information Disclosure Vulnerability. Thi=
s vulnerability allows remote attackers to disclose sensitive information o=
n affected installations of DriveLock. Authentication is not required to ex= ploit this vulnerability. The specific flaw exists within the web service, = which listens on TCP port 6067 by default. The issue results from the lack =
of proper validation of a user-supplied path prior to using it in file oper= ations. An attacker can leverage this vulnerability to disclose information=
in the context of the service account. Was ZDI-CAN-28722.</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5491" target=3D"= _blank" rel=3D"noopener">CVE-2026-5491</a></td>
</tr>

<td class=3D"vendor-product">DriveLock--DriveLock</td>
<td>DriveLock Directory Traversal Information Disclosure Vulnerability. Thi=
s vulnerability allows remote attackers to disclose sensitive information o=
n affected installations of DriveLock. Authentication is required to exploi=
t this vulnerability. The specific flaw exists within the web service, whic=
h listens on TCP port 4568 by default. The issue results from the lack of p= roper validation of a user-supplied path prior to using it in file operatio= ns. An attacker can leverage this vulnerability to disclose information in = the context of the service account. Was ZDI-CAN-28713.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5492" target=3D"= _blank" rel=3D"noopener">CVE-2026-5492</a></td>
</tr>

<td class=3D"vendor-product">Dynamic Pricing With Discount Rules for WooCom= merce--Dynamic Pricing With Discount Rules for WooCommerce</td>
<td>The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugi=
n before 5.0.0 does not validate a nonce or user capabilities on one of its=
AJAX actions and reflects unsanitised user input in the response, allowing=
unauthenticated attackers to perform Reflected Cross-Site Scripting agains=
t a victim who is induced to send a crafted request.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13725" target=3D= "_blank" rel=3D"noopener">CVE-2026-13725</a></td>
</tr>

<td class=3D"vendor-product">DynamicKit--DynamicKit for Elementor</td>

<td>The DynamicKit for Elementor WordPress plugin before 1.0.3 does not val= idate the host of a user-supplied URL used as the base of the password-rese=
t link it emails, allowing unauthenticated attackers to send a target user =
a legitimately-formatted reset email whose link points to an attacker-contr= olled host and carries a valid reset key, leading to account takeover when = the victim clicks it.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14596" target=3D= "_blank" rel=3D"noopener">CVE-2026-14596</a></td>
</tr>

<td class=3D"vendor-product">Easy Appointments--Easy Appointments</td>

<td>The Easy Appointments WordPress plugin through 3.12.26 does not perform=
a per-request capability or nonce check on one of its customer-listing han= dlers, allowing authenticated users with contributor-level access to read e= very stored customer's personal information.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14188" target=3D= "_blank" rel=3D"noopener">CVE-2026-14188</a></td>
</tr>

<td class=3D"vendor-product">Easy Appointments--Easy Appointments</td>

<td>The Easy Appointments WordPress plugin through 3.12.26 does not perform=
capability checks in several of its appointment-management actions, relyin=
g only on a nonce that any authenticated user can obtain, allowing users wi=
th contributor-level access to read all customers' appointment details and =
to create, modify, and delete bookings.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14221" target=3D= "_blank" rel=3D"noopener">CVE-2026-14221</a></td>
</tr>

<td class=3D"vendor-product">Easy Appointments--Easy Appointments</td>

<td>The Easy Appointments WordPress plugin through 3.12.26 does not perform=
any capability or nonce check in one of its connection-deletion actions, a= llowing users with contributor-level access to delete the booking configura= tion and disable the booking system.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14222" target=3D= "_blank" rel=3D"noopener">CVE-2026-14222</a></td>
</tr>

<td class=3D"vendor-product">Easy Appointments--Easy Appointments</td>

<td>The Easy Appointments WordPress plugin through 3.12.26 does not verify = ownership or capability when returning stored customer details, allowing us= ers with subscriber-level access to read any customer's personal informatio=
n by iterating an identifier.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14223" target=3D= "_blank" rel=3D"noopener">CVE-2026-14223</a></td>
</tr>

<td class=3D"vendor-product">Easy Appointments--Easy Appointments</td>

<td>The Easy Appointments WordPress plugin through 3.12.26 does not verify = that the appointment targeted by its customer-data update action belongs to=
the current user; the action only checks a shared nonce that any authentic= ated user can obtain from their own appointment's edit form. A subscriber-l= evel user with an appointment of their own can therefore reuse that nonce t=
o overwrite the customer metadata (email, name, phone, description) of anot= her user's appointment. Because the Easy Appointments WordPress plugin thro= ugh 3.12.26 then treats that metadata as the appointment's contact data, a = subsequent administrator status change with customer notifications enabled = delivers the victim's appointment notification to the attacker-controlled e= mail address.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14224" target=3D= "_blank" rel=3D"noopener">CVE-2026-14224</a></td>
</tr>

<td class=3D"vendor-product">Easy Appointments--Easy Appointments</td>

<td>The Easy Appointments WordPress plugin through 3.12.26 does not require=
a sufficient capability on one of its appointment-listing REST endpoints, = restricting it only to a capability that every authenticated user holds, al= lowing users with subscriber-level access to read all bookings on the site,=
including customer names, schedules, and statuses.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14226" target=3D= "_blank" rel=3D"noopener">CVE-2026-14226</a></td>
</tr>

<td class=3D"vendor-product">EasyAppointments--EasyAppointments</td>
<td>SQL injection vulnerability exists in the order_by parameter of the /cu= stomers/search endpoint in Alex Tselegidis EasyAppointments &lt;=3D 1.5.1. = The vulnerability arises from unsanitized user input passed to the order_by=
method of the CodeIgniter Query Builder, enabling attackers to perform tim= e-based queries and schema enumeration. Under certain MySQL configurations,=
the flaw may lead to remote code execution by writing a PHP shell using IN=
TO OUTFILE.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-50455" target=3D= "_blank" rel=3D"noopener">CVE-2025-50455</a></td>
</tr>

<td class=3D"vendor-product">Eclipse Foundation--Eclipse CSI - PIA</td>

<td>PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks i=
ts **unverified** `iss` claim against an issuer allowlist using Python's `u= rlparse` before performing OIDC discovery with `requests`. Because `urlpars=
e` and `requests`/`urllib3` parse an authority string containing a backslas=
h (e.g. `https://attacker-host\@ci.eclipse.org/`) into *different* hostname=
s, an attacker can craft an issuer that passes the allowlist check yet driv=
es `requests` - and subsequently `urllib.request.urlopen` for JWKS retrieva=
l - to connect to an arbitrary attacker-chosen host, port, and scheme.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18353" target=3D= "_blank" rel=3D"noopener">CVE-2026-18353</a></td>
</tr>

<td class=3D"vendor-product">Ecommerce--Ecommerce</td> <td>Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to=
SQL Injection in /show_price_by_pdtId.php.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-65336" target=3D= "_blank" rel=3D"noopener">CVE-2025-65336</a></td>
</tr>

<td class=3D"vendor-product">Ecommerce--Fruits Bazar 1.0</td>
<td>Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting (XSS) =
in admin/edit_product.php.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-65341" target=3D= "_blank" rel=3D"noopener">CVE-2025-65341</a></td>
</tr>

<td class=3D"vendor-product">ELECOM CO.,LTD.--WAB-M1775-PS</td>
<td>ELECOM wireless LAN routers and access points devices contain a reflect=
ed cross-site scripting vulnerability in WebUI. If this vulnerability is ex= ploited, an arbitrary script may be executed on a logged-in user's web brow= ser.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44387" target=3D= "_blank" rel=3D"noopener">CVE-2026-44387</a></td>
</tr>

<td class=3D"vendor-product">ELECOM CO.,LTD.--WAB-M1775-PS</td>
<td>ELECOM wireless LAN routers and access points devices contain an OS Com= mand Injection vulnerability in Restore Settings. If this vulnerability is = exploited, an arbitrary OS command may be executed by an attacker who can l=
og in to the product.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-61376" target=3D= "_blank" rel=3D"noopener">CVE-2026-61376</a></td>
</tr>

<td class=3D"vendor-product">ELECOM CO.,LTD.--WRC-X3000GS3-B</td>
<td>ELECOM wireless LAN routers and access points devices contain an OS Com= mand Injection vulnerability in WebUI. If this vulnerability is exploited, =
an arbitrary OS command may be executed by an attacker who can log in to th=
e product.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59764" target=3D= "_blank" rel=3D"noopener">CVE-2026-59764</a></td>
</tr>

<td class=3D"vendor-product">Element Pack Addons for Elementor--Element Pac=
k Addons for Elementor</td>
<td>The Element Pack Addons for Elementor WordPress plugin before 8.7.13 do=
es not sanitize option values passed through certain data attributes before=
a bundled front-end library re-parses and renders them in the browser, all= owing users with contributor-level access or higher to inject arbitrary Jav= aScript that executes in the session of any visitor who views the affected = content.</td>
<td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14817" target=3D= "_blank" rel=3D"noopener">CVE-2026-14817</a></td>
</tr>

<td class=3D"vendor-product">ElementsKit Elementor Addons--ElementsKit Elem= entor Addons</td>
<td>The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does n=
ot prevent a custom-widget definition saved by a user with administrative c= apabilities from being written verbatim into a generated PHP file that the = ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently e= xecutes, allowing arbitrary PHP code to run on the server; on a multisite n= etwork this lets a non-super subsite Administrator, who is otherwise denied=
code/file editing, reach host-level code execution beyond the privileges t=
he network grants them.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13392" target=3D= "_blank" rel=3D"noopener">CVE-2026-13392</a></td>
</tr>

<td class=3D"vendor-product">ElementsKit Elementor Addons--ElementsKit Elem= entor Addons</td>
<td>The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does n=
ot sanitize or escape certain megamenu menu-item settings before storing th=
em and outputting them on the front end, and does not require the unfiltere= d_html capability to save them, allowing users with administrative capabili= ties to store malicious JavaScript; on a multisite network this lets a non-= super subsite Administrator, who is denied unfiltered_html, plant a stored = Cross-Site Scripting payload that executes in the sessions of the network S= uper Admin and site visitors.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13393" target=3D= "_blank" rel=3D"noopener">CVE-2026-13393</a></td>
</tr>

<td class=3D"vendor-product">Ellucian--Advance Web</td>
<td>A SQL Injection in the Giving Reports functionality in Ellucian Advance=
Web and Legacy Advance allows an authenticated attacker to extract sensiti= ve=C2=A0information from databases via a crafted SQL query in the class cre= dit=C2=A0field. This issue affects Advance Web: all versions; Legacy Advanc=
e: all versions. Ellucian CRM Advance is not impacted.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-6881" target=3D"= _blank" rel=3D"noopener">CVE-2026-6881</a></td>
</tr>

<td class=3D"vendor-product">Enhancesoft LLC--osTicket</td>
<td>A logic vulnerability in the password reset token validation routine im= plemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the = password reset process, the application retrieves the timestamp associated = with the provided token and checks whether the configured validity period h=
as expired. Consequently, the expiry check is only performed if the timesta=
mp lookup fails, allowing tokens with an existing timestamp to bypass the i= ntended expiry validation. Therefore, an attacker able to obtain a valid pa= ssword reset token could reuse it to perform an unauthorised password reset=
and compromise the affected account.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18363" target=3D= "_blank" rel=3D"noopener">CVE-2026-18363</a></td>
</tr>

<td class=3D"vendor-product">Ente--Museum Server</td>
<td>Authorization Bypass in the emergency recovery approval component in En=
te Technologies Ente Museum Server allows an authenticated attacker configu= red as a victim's emergency contact to bypass the configured recovery waiti=
ng period and take over the victim's account via a crafted `approve-recover=
y` API request.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16751" target=3D= "_blank" rel=3D"noopener">CVE-2026-16751</a></td>
</tr>

<td class=3D"vendor-product">EnterpriseDB--pglogical</td>
<td>pglogical's apply worker does not sufficiently validate the length of c= ertain fields in incoming replication protocol messages before copying them=
, resulting in an out-of-bounds read. A party acting as the publisher for a=
subscription, for example a non-PostgreSQL endpoint that speaks the pglogi= cal replication protocol, can return crafted messages that cause the subscr= iber's apply worker to read beyond the bounds of an allocated buffer, discl= osing adjacent process memory or crashing the worker. To exploit the issue =
an attacker must be able to direct a subscription at an endpoint they contr= ol. In default installations this requires privileges normally reserved for=
a superuser, so the issue is most relevant to managed deployments where th=
e ability to create subscriptions has been delegated to non-superuser roles= .</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50735" target=3D= "_blank" rel=3D"noopener">CVE-2026-50735</a></td>
</tr>

<td class=3D"vendor-product">EnterpriseDB--pglogical</td>
<td>The pglogical queue mechanism, used to convey out-of-band commands such=
as replicated DDL from a publisher to a subscriber, executes message paylo= ads on the subscriber at the privilege level of the apply worker, which is = equivalent to a PostgreSQL superuser in default installations. A party acti=
ng as the publisher can send crafted queue messages that cause arbitrary SQ=
L to be executed on the subscriber as superuser, escalating from a role per= mitted to use pglogical to full superuser and breaking the isolation betwee=
n tenants in shared deployments. To exploit the issue an attacker must be a= ble to direct a subscription at an endpoint they control. In default instal= lations this requires privileges normally reserved for a superuser, so the = issue is most relevant to managed deployments where the ability to create s= ubscriptions has been delegated to non-superuser roles.</td> <td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50736" target=3D= "_blank" rel=3D"noopener">CVE-2026-50736</a></td>
</tr>

<td class=3D"vendor-product">EnterpriseDB--pglogical</td>
<td>When applying replicated changes for a row that is missing one or more = columns, pglogical evaluates the affected table's default expressions on th=
e subscriber. Because the apply worker runs at a privilege level equivalent=
to a PostgreSQL superuser in default installations, any function invoked b=
y such a default expression also runs at that privilege. A party acting as = the publisher can use this path to cause functions to be executed on the su= bscriber as superuser, escalating from a role permitted to use pglogical to=
full superuser. This is a second, independent path to the same superuser e= scalation tracked under CVE-2026-50736 (the pglogical queue issue). To expl= oit the issue an attacker must be able to direct a subscription at an endpo= int they control. In default installations this requires privileges normall=
y reserved for a superuser, so the issue is most relevant to managed deploy= ments where the ability to create subscriptions has been delegated to non-s= uperuser roles.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50737" target=3D= "_blank" rel=3D"noopener">CVE-2026-50737</a></td>
</tr>

<td class=3D"vendor-product">EnterpriseDB--pglogical</td>
<td>A use-after-free condition exists in pglogical's worker signaling code,=
where a worker structure can be dereferenced after the underlying slot has=
been freed or recycled during normal worker lifecycle events. The conditio=
n is reachable during normal replication operation, including by a low-priv= ileged user able to influence worker start, stop, and restart timing throug=
h permitted pglogical operations. In the typical case the condition crashes=
replication workers, causing an availability impact. In the worst case a u= se-after-free in a PostgreSQL backend can be leveraged as a remote code exe= cution primitive at the privilege of that backend.</td>

<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50738" target=3D= "_blank" rel=3D"noopener">CVE-2026-50738</a></td>
</tr>

<td class=3D"vendor-product">Ericsson--Ericsson Packet Core Controller (PCC= )</td>
<td>Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a = vulnerability in Configuration Management, allowing an attacker to execute = specifically crafted commands to reveal system secret through error message= s.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-59177" target=3D= "_blank" rel=3D"noopener">CVE-2025-59177</a></td>
</tr>

<td class=3D"vendor-product">Ericsson--Packet Core Controller (PCC)</td>

<td>Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain an=
Improper Neutralization of Special Elements vulnerability allowing an atta= cker to execute arbitrary code as root.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-59172" target=3D= "_blank" rel=3D"noopener">CVE-2025-59172</a></td>
</tr>

<td class=3D"vendor-product">Ericsson--Packet Core Controller (PCC)</td>

<td>Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain an=
Exposure of Sensitive System Information vulnerability in Configuration Ma= nagement allowing an attacker to enumerate other users on the system.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-59178" target=3D= "_blank" rel=3D"noopener">CVE-2025-59178</a></td>
</tr>

<td class=3D"vendor-product">Ericsson--Packet Core Controller (PCC)</td>

<td>Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a = hardcoded credential vulnerability in the alarm system. An attacker with ac= cess to the cluster with knowledge of the hardcoded credential can read ala=
rm and alert information.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-59180" target=3D= "_blank" rel=3D"noopener">CVE-2025-59180</a></td>
</tr>

<td class=3D"vendor-product">Ericsson--Packet Core Controller (PCC)</td>

<td>Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a = directory traversal vulnerability in Configuration Management that could al= low an attacker to change directory permissions, denying access to legitima=
te users.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-59181" target=3D= "_blank" rel=3D"noopener">CVE-2025-59181</a></td>
</tr>

<td class=3D"vendor-product">Erlang--OTP</td>
<td>Improper Handling of Exceptional Conditions vulnerability in Erlang OTP=
erts (epmd) allows an unauthenticated remote attacker to permanently termi= nate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion. T=
he do_accept function in erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit()=
when accept(2) returns EMFILE (per-process file descriptor limit reached) =
or ENFILE (system-wide file descriptor limit reached), rather than treating=
these as recoverable conditions. An attacker can exhaust epmd's file descr= iptor slots by holding many TCP connections open while periodically sending=
a single byte to reset the idle timeout, then causing accept(2) to return = EMFILE, which kills the daemon. epmd has no per-source-IP connection cap, m= aking the attack feasible from a single source. On Debian/Ubuntu default pa= ckaging the impact is amplified: the systemd unit inherits a low file descr= iptor soft limit, and repeated daemon deaths trigger systemd's start-rate-l= imit, permanently failing both epmd.service and epmd.socket and requiring m= anual operator intervention to recover. This issue affects OTP from OTP 17.=
0 before OTP=C2=A029.0.4, OTP=C2=A028.5.0.4 and OTP=C2=A027.3.4.15.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-42792" target=3D= "_blank" rel=3D"noopener">CVE-2026-42792</a></td>
</tr>

<td class=3D"vendor-product">Erlang--OTP</td>
<td>Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module)=
allows writing files outside the intended extraction directory via a craft=
ed zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths usin=
g zip:check_dir_level/2, which tracks directory depth as a running integer = counter: .. decrements it, normal path components increment it. The caller = rejects only paths where the final counter value is less than zero. A path = such as ../x/y causes the counter to go negative mid-traversal then recover=
to zero, passing validation while resolving to a location outside the extr= action directory when joined with the current working directory via add_cwd=
. This vulnerability is associated with program file lib/stdlib/src/zip.erl=
. This issue affects OTP from OTP 27.1 before OTP=C2=A029.0.4, OTP=C2=A028.= 5.0.4 and OTP=C2=A027.3.4.15, corresponding to stdlib from 6.1 before 8.0.3=
, 7.3.0.1 and 6.2.2.4.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-47078" target=3D= "_blank" rel=3D"noopener">CVE-2026-47078</a></td>
</tr>

<td class=3D"vendor-product">Erlang--OTP</td>
<td>Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erla= ng/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer=
Overflow, Excessive Allocation. This vulnerability is associated with prog= ram files erts/emulator/beam/external.c, emulator/beam/external.c. The BIT_= BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accep=
ts an encoding with both length and trailing-bits fields set to zero. The s= ubsequent computation of the bitstring size underflows an unsigned integer,=
producing a value of roughly 2^64 that is then passed as a memory allocati=
on size. The allocator aborts the entire node with a message such as "Canno=
t allocate 2305843009213693951 bytes of memory (of type binary)". The crash=
is a VM-level abort, not an Erlang-level exception. It cannot be intercept=
ed by supervision trees, by try/catch, or by passing the [safe] option to b= inary_to_term/2 (which only restricts atom creation and does not perform st= ructural validation of binary encodings). Any application that decodes ETF = from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is e= xposed. The Erlang distribution protocol also decodes incoming terms throug=
h the same code path, but distribution is expected to run on trusted networ=
ks per the OTP Secure Coding Guidelines (DSG-011). This issue affects OTP f= rom OTP 27.0 before OTP=C2=A029.0.4, OTP=C2=A028.5.0.4 and OTP=C2=A027.3.4.= 15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.<=

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54890" target=3D= "_blank" rel=3D"noopener">CVE-2026-54890</a></td>
</tr>

<td class=3D"vendor-product">Erlang--OTP</td>
<td>Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerabili=
ty in Erlang OTP erts allows an attacker who can supply a crafted Erlang ex= ternal term format (ETF) binary to binary_to_term/1 to corrupt the BEAM hea=
p pointer and crash the virtual machine. When decoding a LARGE_TUPLE_EXT te= rm, the validation pass decoded_size() in erts/emulator/beam/external.c rea=
ds the 32-bit arity field as unsigned (get_uint32()), while the decode pass=
dec_term() reads the same field as a signed 32-bit integer (get_int32()) i= nto an int. An arity wire value of 0x80000000 passes validation as 21474836=
48 but decodes as -2147483648, so the subsequent hp +=3D n moves the heap a= llocation pointer backward. Neither pass enforces the runtime tuple-arity l= imit MAX_ARITYVAL. The result is an out-of-bounds heap write; in practice t=
he VM detects an impossible heap size and aborts, denying service. The requ= ired padding is large when uncompressed but the compressed-ETF envelope shr= inks it to a small payload on the wire. This issue affects OTP from OTP 25.=
0 before OTP=C2=A029.0.4, OTP=C2=A028.5.0.4 and OTP=C2=A027.3.4.15, corresp= onding to erts from 13.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55737" target=3D= "_blank" rel=3D"noopener">CVE-2026-55737</a></td>
</tr>

<td class=3D"vendor-product">Erlang--OTP</td>
<td>The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verif=
y that the cipher suite selected by the server in ServerHello was among the=
suites offered by the client in ClientHello. The client-side tls_handshake= :hello/5 handler validates the negotiated protocol version and the downgrad=
e sentinel but hands the server-chosen suite directly to ssl_handshake:hand= le_server_hello_extensions/9, which installs it without a membership check.=
The TLS 1.3 client path performs this check (per RFC 8446), so it is not a= ffected. An on-path attacker between the client and the intended server can=
respond with a ServerHello selecting an anonymous key exchange suite such =
as TLS_DH_anon_* or TLS_ECDH_anon_* that the client never offered. Anonymou=
s suites do not require the server to present a certificate, so the entire = verify_peer and cacerts configuration is bypassed: the attacker completes t=
he handshake with its own ephemeral parameters, no certificate is validated=
, no hostname is checked, and ssl:connect returns {ok, Socket}. All subsequ= ent application traffic is readable and modifiable by the attacker. This is= sue affects OTP from OTP 17.0 before OTP=C2=A029.0.4, OTP=C2=A028.5.0.4 and=
OTP=C2=A027.3.4.15, corresponding to ssl from 5.3.4 before 11.7.4, 11.6.0.=
4 and 11.2.12.11.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55953" target=3D= "_blank" rel=3D"noopener">CVE-2026-55953</a></td>
</tr>

<td class=3D"vendor-product">Erlang--OTP</td>
<td>The Erlang/OTP ssl application does not detect cycles when reconstructi=
ng an incomplete peer certificate chain during a TLS or DTLS handshake. In = ssl_certificate:handle_incomplete_chain/5, the received chain is passed to = ssl_certificate:build_certificate_chain/5, which walks issuer relationships=
via ssl_certificate:do_certificate_chain/7 with no cycle detection and no = depth limit. When the peer supplies two mutually cross-signed certificates =
in unordered form (A issues B, B issues A), the issuer lookup alternates be= tween the two certificates and the pair of functions recurses indefinitely,=
growing the call stack and chain accumulator without bound. An unauthentic= ated remote attacker can send a crafted certificate chain in a TLS or DTLS = Certificate handshake message to exhaust available memory and crash the BEA=
M node. Only a TCP connection and a partial handshake are required; no auth= entication or completed handshake is needed, and both TLS/DTLS servers and = clients are affected when processing peer certificate messages. This issue = affects OTP from OTP 23.2 before OTP=C2=A029.0.4, OTP=C2=A028.5.0.4 and OTP= =C2=A027.3.4.15, corresponding to ssl from 10.2 before 11.7.4, 11.6.0.4 and=
11.2.12.11.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58227" target=3D= "_blank" rel=3D"noopener">CVE-2026-58227</a></td>
</tr>

<td class=3D"vendor-product">Erlang--OTP</td>
<td>Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver = allows a remote unauthenticated attacker to corrupt the driver's memory (an=
d potentially achieve remote code execution or a denial-of-service crash) b=
y sending a single text-encoded H.248/Megaco message containing an oversize=
d property parm name. When tokenizing a Local/Remote descriptor, mfs_load_p= roperty_groups extracts the attacker-controlled property name (bounded only=
by the message length) and, when no value follows, formats it into a fixed=
512-byte error_msg field of the MfsErlDrvData struct using an unchecked sp= rintf call. Names longer than roughly 452 bytes overflow into the immediate=
ly following struct fields (text_buf, text_ptr, term_spec, term_spec_size, = term_spec_index), overwriting live pointers and counters with attacker-chos=
en bytes. Subsequent scanner code writes and frees through the corrupted po= inters, producing arbitrary write and arbitrary free primitives inside the = BEAM VM process, which can be leveraged for remote code execution. On build=
s compiled with _FORTIFY_SOURCE the overflow is detected at runtime and ter= minates the process with SIGABRT, resulting in denial of service. The overf= low occurs in the flex scanner before any grammar or Megaco-level authentic= ation processing, so exploitation requires only network reachability to the=
megaco transport port on a node configured with {scanner, flex}. This vuln= erability is associated with program files lib/megaco/src/flex/megaco_flex_= scanner_drv.flex.src and program routines mfs_load_property_groups. This is= sue affects OTP from OTP 17.0 before OTP=C2=A029.0.4, OTP=C2=A028.5.0.4 and=
OTP=C2=A027.3.4.15, corresponding to megaco from 3.17.1 before 4.9.1, 4.8.= 3.1 and 4.7.2.2. Versions prior to OTP 17.0 are also affected but are not l= isted because the OTP version scheme is only defined from OTP 17.0 onwards.= </td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59250" target=3D= "_blank" rel=3D"noopener">CVE-2026-59250</a></td>
</tr>

<td class=3D"vendor-product">Erlang--OTP</td>
<td>Allocation of resources without limits in Erlang/OTP public_key certifi= cate path validation allows a remote unauthenticated attacker to cause deni=
al of service by sending a crafted X.509 certificate chain during the TLS h= andshake. During RFC 5280 policy processing in public_key:pkix_path_validat= ion/3, the certificate policy tree maintained by pubkey_policy_tree grows w= ithout an upper bound. When a certificate chain contains M policies per cer= tificate and K certificates, the tree grows on the order of M^K nodes becau=
se pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_siblings=
/2 extend the tree per policy per certificate. A modest chain with many pol= icies per certificate is enough to pin BEAM schedulers and exhaust the node=
's memory, taking down the entire VM. The attacker only needs to be able to=
present a certificate chain to the victim, which is the normal preconditio=
n for a TLS handshake, so exploitation succeeds against any incoming or out= going TLS connection that validates the peer's chain (the default for SSL/T=
LS clients and mutual-TLS servers). This is the same vulnerability class as=
OpenSSL's X509_verify_cert policy tree DoS. This vulnerability is associat=
ed with program files lib/public_key/src/pubkey_policy_tree.erl and program=
routines pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_s= iblings/2. This issue affects OTP from OTP 26.2 before OTP=C2=A029.0.4, OTP= =C2=A028.5.0.4 and OTP=C2=A027.3.4.15, corresponding to public_key from 1.1=
5 before 1.21.4, 1.20.3.4 and 1.17.1.5.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59251" target=3D= "_blank" rel=3D"noopener">CVE-2026-59251</a></td>
</tr>

<td class=3D"vendor-product">Essential Addons for Elementor--Essential Addo=
ns for Elementor</td>
<td>The Essential Addons for Elementor WordPress plugin before 6.6.10 does = not validate the HTML tag name of the Pricing Table widget title before out= putting it, allowing users with Contributor-level access and above to injec=
t JavaScript that will be executed (Stored Cross-Site Scripting) when the p= age is viewed, including in the session of an administrator previewing or v= isiting the post.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13344" target=3D= "_blank" rel=3D"noopener">CVE-2026-13344</a></td>
</tr>

<td class=3D"vendor-product">Essential Addons for Elementor--Essential Addo=
ns for Elementor</td>
<td>The Essential Addons for Elementor WordPress plugin before 6.6.10 does = not perform authorization, status, or visibility checks when resolving WooC= ommerce products in its product-comparison feature, allowing unauthenticate=
d users to disclose the title, price, and SKU of draft, pending, and privat=
e products that are otherwise withheld from public view.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13345" target=3D= "_blank" rel=3D"noopener">CVE-2026-13345</a></td>
</tr>

<td class=3D"vendor-product">Event Tickets and Registration--Event Tickets = and Registration</td>
<td>The Event Tickets and Registration WordPress plugin before 5.28.4 does = not properly escape event titles before outputting them in a ticket history=
log, allowing users with the Editor role and above to perform Stored Cross= -Site Scripting attacks that execute against higher-privileged users on mul= tisite installations.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14819" target=3D= "_blank" rel=3D"noopener">CVE-2026-14819</a></td>
</tr>

<td class=3D"vendor-product">Event Tickets and Registration--Event Tickets = and Registration</td>
<td>The Event Tickets and Registration WordPress plugin before 5.29.0.1 doe=
s not perform any authorization check on one of its order-management REST e= ndpoints, allowing unauthenticated users to change the status of existing o= rders.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14822" target=3D= "_blank" rel=3D"noopener">CVE-2026-14822</a></td>
</tr>

<td class=3D"vendor-product">Event Tickets and Registration--Event Tickets = and Registration</td>
<td>The Event Tickets and Registration WordPress plugin before 5.29.0.1 doe=
s not properly verify authorization on some of its seating actions, allowin=
g users with contributor-level access and above to overwrite the seating la= yout, ticket inventory, and attendee seat assignments of events they do not=
own.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14823" target=3D= "_blank" rel=3D"noopener">CVE-2026-14823</a></td>
</tr>

<td class=3D"vendor-product">Eventin--Eventin</td>
<td>The Eventin WordPress plugin before 4.1.16 does not properly authorize = order creation and accepts an attacker-supplied order status, allowing unau= thenticated users to create orders marked as paid without completing any pa= yment.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13178" target=3D= "_blank" rel=3D"noopener">CVE-2026-13178</a></td>
</tr>

<td class=3D"vendor-product">Events Made Easy--Events Made Easy</td>
<td>The Events Made Easy WordPress plugin before 3.1.4 does not verify that=
the requester is authorized to modify the targeted record when handling an=
unauthenticated data-change request, relying only on a public nonce with n=
o per-record token or ownership check, allowing unauthenticated attackers t=
o overwrite the personal data of any person record.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14843" target=3D= "_blank" rel=3D"noopener">CVE-2026-14843</a></td>
</tr>

<td class=3D"vendor-product">Everest Toolkit--Everest Toolkit</td>
<td>The Everest Toolkit WordPress plugin through 1.2.3 does not validate th=
e type of files uploaded during demo-content import (the WordPress file-typ=
e test is disabled), allowing high-privilege users (Administrator by defaul=
t, including non-super-admin site administrators on multisite) to upload ex= ecutable PHP files to the uploads directory.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13158" target=3D= "_blank" rel=3D"noopener">CVE-2026-13158</a></td>
</tr>

<td class=3D"vendor-product">FacturaONE para WooCommerce con VeriFactu--Fac= turaONE para WooCommerce con VeriFactu</td>
<td>The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5= .37 does not authenticate one of its request handlers, whose only protectio=
n is derived from a cryptographic key that is empty in the default, unconfi= gured state, allowing unauthenticated attackers to write an arbitrary file = into a web-accessible directory and achieve remote code execution.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14289" target=3D= "_blank" rel=3D"noopener">CVE-2026-14289</a></td>
</tr>

<td class=3D"vendor-product">FeehiCMS--FeehiCMS</td>
<td>An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges = via the Session management module, authentication logic, logout handler com= ponents</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-51953" target=3D= "_blank" rel=3D"noopener">CVE-2026-51953</a></td>
</tr>

<td class=3D"vendor-product">Five Star Restaurant Reservations--Five Star R= estaurant Reservations</td>
<td>The Five Star Restaurant Reservations WordPress plugin before 2.7.23 do=
es not perform a capability check on one of its AJAX actions, allowing user=
s with the lowest booking-management role (which by default cannot access t=
he Five Star Restaurant Reservations WordPress plugin before 2.7.23's setti= ngs) to reset the site's configured booking notification rules.</td> <td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15151" target=3D= "_blank" rel=3D"noopener">CVE-2026-15151</a></td>
</tr>

<td class=3D"vendor-product">Fluent Forms--Fluent Forms</td>
<td>The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and es= cape one of its form field configuration settings before outputting it insi=
de an inline script when a form is rendered, which could allow users with a=
role as low as Contributor (with delegated form-management permission, and=
therefore lacking the unfiltered_html capability, e.g. in a multisite setu=
p) to perform Stored Cross-Site Scripting attacks that execute in the brows=
er of any visitor who loads the form, including administrators previewing i= t.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11881" target=3D= "_blank" rel=3D"noopener">CVE-2026-11881</a></td>
</tr>

<td class=3D"vendor-product">Fluent Support--Fluent Support</td>
<td>The Fluent Support WordPress plugin before 2.3.1 does not perform a per= -ticket access check before reassigning a ticket's customer, allowing a res= tricted support agent to change the assigned customer of any ticket in the = system, including tickets outside their granted scope.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14197" target=3D= "_blank" rel=3D"noopener">CVE-2026-14197</a></td>
</tr>

<td class=3D"vendor-product">FluentBoards--FluentBoards</td>
<td>The FluentBoards WordPress plugin before 1.95.3 does not verify that th=
e items selected for a board import operation belong to a board the request= ing user is authorized to access, allowing any authenticated user with memb=
er access to a single board to copy and read the stages and tasks (includin=
g titles, descriptions and file attachments) of any other board on the site= .</td>
<td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14938" target=3D= "_blank" rel=3D"noopener">CVE-2026-14938</a></td>
</tr>

<td class=3D"vendor-product">FluentCart--FluentCart A New Era of eCommerce<=

<td>The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 doe=
s not verify that a subscription belongs to the requesting customer in seve= ral of its payment-method endpoints, allowing any authenticated customer to=
act on another customer's subscription (changing its payment method, or ca= ncelling and re-binding it) when they know the target subscription identifi= er.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14926" target=3D= "_blank" rel=3D"noopener">CVE-2026-14926</a></td>
</tr>

<td class=3D"vendor-product">FluentCart--FluentCart A New Era of eCommerce<=

<td>The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 doe=
s not perform any authorization or ownership check before rendering custome=
r order documents keyed on a sequential numeric identifier, allowing unauth= enticated visitors to enumerate and disclose customer personal data (names,=
email addresses, billing and shipping postal addresses, and order details)=
across the store.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14927" target=3D= "_blank" rel=3D"noopener">CVE-2026-14927</a></td>
</tr>

<td class=3D"vendor-product">FlxWoo--FlxWoo</td>
<td>The FlxWoo WordPress plugin before 3.1.1 does not verify with the payme=
nt processor that a checkout session was actually paid before marking the a= ssociated order as paid, allowing unauthenticated attackers to complete Woo= Commerce orders without paying.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14830" target=3D= "_blank" rel=3D"noopener">CVE-2026-14830</a></td>
</tr>

<td class=3D"vendor-product">foreUP--foreUP</td>
<td>A vulnerability in the foreUP customer REST API allows any authenticate=
d user to read cleartext payment-processor merchant credentials in the resp= onse body.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15657" target=3D= "_blank" rel=3D"noopener">CVE-2026-15657</a></td>
</tr>

<td class=3D"vendor-product">foreUP--foreUP</td>
<td>A vulnerability in the foreUP customer REST API allows any authenticate=
d, low-privilege customer to access an endpoint that returns the records of=
other users without checking that the caller owns the data associated with=
that record.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15658" target=3D= "_blank" rel=3D"noopener">CVE-2026-15658</a></td>
</tr>

<td class=3D"vendor-product">Frappe--ERPNext</td>
<td>SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe=
15.107.2. The application constructs SQL queries through direct string int= erpolation using `str.format()` without employing parameterized queries, al= lowing the name (docname) of a Supplier record containing SQL metacharacter=
s to be interpreted as part of the query. Exploitation of this vulnerabilit=
y could allow an authenticated user with low privileges to execute arbitrar=
y SQL queries, bypass Frappe's access restrictions (DocPerm), extract confi= dential information from the database-including fragments of the administra= tor's password hash-and access other sensitive data, such as credentials, i= ntegration tokens, or financial information.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12895" target=3D= "_blank" rel=3D"noopener">CVE-2026-12895</a></td>
</tr>

<td class=3D"vendor-product">free5gc--free5gc</td>
<td>free5GC is an open-source implementation of the 5G core network. Prior =
to 1.4.5, the free5GC AUSF (Authentication Server Function) does not valida=
te the supiOrSuci field in UE authentication requests. Null bytes (\x00) an=
d other control characters pass through JSON parsing unchanged and are forw= arded to the UDM in an unescaped URL path. This causes Go's net/url.Parse()=
to fail, returning HTTP 500 "System failure" and leaking internal stack tr= aces. An unauthenticated attacker can trigger this at scale causing denial =
of service for all subscribers attempting authentication through the affect=
ed AUSF. This vulnerability is fixed in 1.4.5.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53551" target=3D= "_blank" rel=3D"noopener">CVE-2026-53551</a></td>
</tr>

<td class=3D"vendor-product">FreeRDP--FreeRDP</td>
<td>FreeRDP Windows client before 3.29.0 contains a heap buffer overflow vu= lnerability in the clipboard virtual channel when processing CLIPRDR_FILE_C= ONTENTS_RESPONSE PDUs without validating the server-provided size against t=
he destination buffer. A malicious RDP server can send a response with a da=
ta payload significantly larger than requested, causing arbitrary heap memo=
ry corruption that may enable remote code execution when a user performs a = paste operation.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67305" target=3D= "_blank" rel=3D"noopener">CVE-2026-67305</a></td>
</tr>

<td class=3D"vendor-product">Frontend Admin by DynamiApps--Frontend Admin b=
y DynamiApps</td>
<td>The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does no=
t perform capability checks on its taxonomy term creation, modification, an=
d deletion operations, allowing authenticated users with low privileges (su=
ch as Subscribers) to create, rename, and delete arbitrary taxonomy terms.<=

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11867" target=3D= "_blank" rel=3D"noopener">CVE-2026-11867</a></td>
</tr>

<td class=3D"vendor-product">Frontend Admin by DynamiApps--Frontend Admin b=
y DynamiApps</td>
<td>The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes=
HTML entities in a submitted form field value after sanitizing it, which r= estores HTML tags that the sanitizer had neutralized. A double-encoded payl= oad submitted by an unauthenticated visitor is therefore stored as a live t=
ag and later output without escaping on the Frontend Admin by DynamiApps Wo= rdPress plugin before 3.29.9's front-end display surfaces, resulting in sto= red cross-site scripting that executes in the browser of any user, includin=
g an administrator, who views a page displaying the submitted value.</td> <td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13609" target=3D= "_blank" rel=3D"noopener">CVE-2026-13609</a></td>
</tr>

<td class=3D"vendor-product">Frontend File Manager Plugin--Frontend File Ma= nager Plugin</td>
<td>The Frontend File Manager Plugin WordPress plugin through 23.6 does not=
perform nonce validation on one of its file-metadata update actions, allow= ing an attacker to modify the metadata of a logged-in user's uploaded file = via a CSRF attack, which can be leveraged to download that file. When guest=
uploads are enabled, the same action is reachable unauthenticated against = any user's file.</td>
<td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16292" target=3D= "_blank" rel=3D"noopener">CVE-2026-16292</a></td>
</tr>

<td class=3D"vendor-product">FS Inc--Switch 2.2.0D Build 118101</td>
<td>A reflected cross-site scripting (XSS) vulnerability in the /logo.asp c= omponent of FS Inc S3150-8T2F Switch 2.2.0D Build 118101 allows attackers t=
o execute arbitrary Javascript in the context of the victim's browser via a=
crafted URL.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52232" target=3D= "_blank" rel=3D"noopener">CVE-2026-52232</a></td>
</tr>

<td class=3D"vendor-product">G DATA--Total Security</td>
<td>G DATA Total Security Backup Service Link Following Local Privilege Esc= alation Vulnerability. This vulnerability allows local attackers to escalat=
e privileges on affected installations of G DATA Total Security. An attacke=
r must first obtain the ability to execute low-privileged code on the targe=
t system in order to exploit this vulnerability. The specific flaw exists w= ithin the Backup Service. By creating a symbolic link, an attacker can abus=
e the service to delete a file. An attacker can leverage this vulnerability=
to escalate privileges and execute arbitrary code in the context of SYSTEM=
. Was ZDI-CAN-28665.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13268" target=3D= "_blank" rel=3D"noopener">CVE-2026-13268</a></td>
</tr>

<td class=3D"vendor-product">Gallery for Google Photos--Gallery for Google = Photos</td>
<td>The Gallery for Google Photos WordPress plugin before 1.2.1 does not pr= operly restrict access to the stored third-party OAuth credentials of the c= onnected account, exposing the persistent access and refresh tokens to unau= thenticated users and allowing long-term compromise of the linked account.<=

<td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15236" target=3D= "_blank" rel=3D"noopener">CVE-2026-15236</a></td>
</tr>

<td class=3D"vendor-product">Geeky Bot--Geeky Bot</td>
<td>The Geeky Bot WordPress plugin before 1.2.8 does not perform an authori= zation check on one of its AJAX actions, allowing unauthenticated users to = retrieve chat-history session metadata including WordPress usernames, user = IDs, and timestamps.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15048" target=3D= "_blank" rel=3D"noopener">CVE-2026-15048</a></td>
</tr>

<td class=3D"vendor-product">geonetwork--core-geonetwork</td>
<td>GeoNetwork is a catalog application to manage spatially referenced reso= urces. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in G= eonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessi= ngFilter permits an attacker-controlled external redirect after login. This=
issue is fixed in versions 4.2.16 and 4.4.11.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53573" target=3D= "_blank" rel=3D"noopener">CVE-2026-53573</a></td>
</tr>

<td class=3D"vendor-product">Ghost Robotics--Vision 60</td>
<td>A lack of authentication in the mobile app (APK v5.5.0) for Ghost Robot= ics' Vision 60 robot allows an unauthenticated attacker connected to the de= vice's internal Wi-Fi network to gain unrestricted access to the web admini= stration interface and the HTTP API. Due to the lack of authorization mecha= nisms, the attacker can view real-time camera feeds, control the robot's mo= vements, manage sensors (GPS, RTK, SAM, LIDAR), and execute critical operat= ional commands (Play, Pause, Stop, E-Stop). Successful exploitation complet= ely compromises the confidentiality, integrity, and physical security of th=
e system.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12989" target=3D= "_blank" rel=3D"noopener">CVE-2026-12989</a></td>
</tr>

<td class=3D"vendor-product">Ghost Robotics--Vision 60</td>
<td>An access control vulnerability in the mobile app (APK v5.5.0) for Ghos=
t Robotics' Vision 60 robot allows multiple simultaneous sessions to run wi= thout proper client validation or session integrity checks. An attacker wit=
h a modified version of the app can connect to the robot during an active, = legitimate session. This allows the attacker to bypass control restrictions=
, intercept sensitive information (such as real-time video), and partially = interact with the system unnoticed and without disconnecting the legitimate=
user, compromising confidentiality and operational security.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12990" target=3D= "_blank" rel=3D"noopener">CVE-2026-12990</a></td>
</tr>

<td class=3D"vendor-product">Ghost Robotics--Vision 60</td>
<td>The lack of cryptographic mechanisms to ensure the integrity and authen= ticity of communications in Ghost Robotics' Vision 60 robot (APK v5.5.0) ex= poses the system to man-in-the-middle attacks. An attacker located on the l= ocal network can use ARP spoofing and selective traffic blocking techniques=
to intercept and manipulate packets between the legitimate operator and th=
e robot. This allows the attacker to disconnect the original controller, es= tablish unauthorized communications, and prevent the operator from regainin=
g control of the device, seriously compromising the confidentiality, integr= ity, and availability (CIA) of operations.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12991" target=3D= "_blank" rel=3D"noopener">CVE-2026-12991</a></td>
</tr>

<td class=3D"vendor-product">GiveWP--GiveWP</td>
<td>The GiveWP WordPress plugin before 4.16.3 does not restrict the set of = available payment gateways to those enabled by the administrator, deriving =
it in part from request input, which allows unauthenticated users to comple=
te donations through a payment gateway the administrator has disabled.</td> <td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14317" target=3D= "_blank" rel=3D"noopener">CVE-2026-14317</a></td>
</tr>

<td class=3D"vendor-product">GiveWP--GiveWP</td>
<td>The GiveWP WordPress plugin before 4.16.3 does not escape a donation-fo=
rm template setting before outputting it in an HTML attribute, allowing use=
rs with the GiveWP Worker role and above to inject arbitrary web scripts th=
at execute on the public donation form viewed by any visitor.</td>

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14318" target=3D= "_blank" rel=3D"noopener">CVE-2026-14318</a></td>
</tr>

<td class=3D"vendor-product">GiveWP--GiveWP</td>
<td>The GiveWP WordPress plugin before 4.16.3 does not properly restrict ac= cess to a REST API endpoint that returns recurring-donation records, allowi=
ng unauthenticated users to retrieve information about anonymous recurring = donors, including their name and subscription details.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14319" target=3D= "_blank" rel=3D"noopener">CVE-2026-14319</a></td>
</tr>

<td class=3D"vendor-product">gleam-lang--gleam</td>
<td>Insufficient Verification of Data Authenticity vulnerability in Gleam a= llows an adversary in the middle to substitute forged Hex package contents = during dependency resolution. During dependency resolution Gleam fetches pa= ckage metadata from the signature-verified Hex repository, which covers eac=
h release's dependency requirements and SHA-256 outer_checksum. After resol= ving versions, gleam_cli::dependencies::lookup_package makes a second reque=
st to the unsigned Hex API through gleam_core::hex::get_package_release and=
records the outer_checksum and dependency names from that JSON response in=
to manifest.toml, instead of the values from the verified repository metada= ta. The Hex repository signature does not cover the API response. An advers= ary in the middle who can intercept TLS with a certificate trusted by the G= leam process (for example a TLS-inspecting proxy using a CA in the operatin=
g system trust store or added through GLEAM_CACERTS_PATH), and who can modi=
fy both the API release response and the corresponding repository tarball, = can supply a package archive with a matching forged checksum without the He=
x repository signing key. Gleam verifies the forged tarball against the for= ged checksum, accepts it, and extracts it as a dependency source, resulting=
in loss of integrity of the downloaded package contents. Only projects tha=
t resolve or update Hex dependencies are affected, which happens when the m= anifest is missing, a dependency is added or updated, or dependency require= ments change. Builds that reuse an unchanged, known-good manifest.toml cont= inue to verify tarballs against its pinned checksum. This issue affects gle= am: from 0.18.0 before 1.18.0.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59247" target=3D= "_blank" rel=3D"noopener">CVE-2026-59247</a></td>
</tr>

<td class=3D"vendor-product">GNU--Bison</td>
<td>GNU Bison allows for an execution of an arbitrary program during HTML r= eport generation due to improper handling of grammar-defined configuration = variables. A grammar file can override the executable used for the XML to H= TML transformation step via %define tool.xsltproc, which is accepted withou=
t restriction and passed directly to execvp(). When running bison --html on=
a attacker-provided grammar, this behavior allows execution of an arbitrar=
y program with the privileges of the Bison process. Maintainers of this pro= ject were notified about this vulnerability, and fixed the issue in commit = 3169c1e7a2c6acc4c59dfcf8b089896d6881925b. However, they did not provide vul= nerable version range. Version 3.8.2 was tested=C2=A0and confirmed as vulne= rable, other versions were not tested but might also be vulnerable.</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56389" target=3D= "_blank" rel=3D"noopener">CVE-2026-56389</a></td>
</tr>

<td class=3D"vendor-product">GNU--Bison</td>
<td>GNU Bison improperly handles grammar defined output paths. Grammar dire= ctives such as %output and %header allow specifying file paths, which are a= ccepted without restriction and override caller supplied output options. Wh=
en processing attacker-supplied grammar, this behavior allows directing gen= erated files to arbitrary writable locations on the filesystem, potentially=
overwriting existing files accessible to the Bison process. Maintainers of=
this project were notified about this vulnerability, and fixed the issue i=
n commit=C2=A08d101c19d4d9aaedf83a448c925513742d4efcf0. However, they did n=
ot provide vulnerable version range. Version 3.8.2 was tested=C2=A0and conf= irmed as vulnerable, other versions were not tested but might also be vulne= rable.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56390" target=3D= "_blank" rel=3D"noopener">CVE-2026-56390</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Compositing in Google Chrome prior to 151.0.7922.72 a= llowed a remote attacker who had compromised the renderer process to potent= ially perform a sandbox escape via a crafted HTML page. (Chromium security = severity: Critical)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17650" target=3D= "_blank" rel=3D"noopener">CVE-2026-17650</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Dawn in Google Chrome on = Android prior to 151.0.7922.72 allowed a remote attacker to potentially per= form a sandbox escape via a crafted HTML page. (Chromium security severity:=
Critical)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17651" target=3D= "_blank" rel=3D"noopener">CVE-2026-17651</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed=
a remote attacker who had compromised the renderer process to potentially = perform a sandbox escape via a crafted HTML page. (Chromium security severi= ty: Critical)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17652" target=3D= "_blank" rel=3D"noopener">CVE-2026-17652</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Skia in Google Chrome prior to 151.0.7922.72 allowed =
a remote attacker who had compromised the renderer process to potentially p= erform a sandbox escape via a crafted HTML page. (Chromium security severit=
y: Critical)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17653" target=3D= "_blank" rel=3D"noopener">CVE-2026-17653</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Race in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed =
a local attacker to perform OS-level privilege escalation via a malicious f= ile. (Chromium security severity: Critical)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17654" target=3D= "_blank" rel=3D"noopener">CVE-2026-17654</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in ANGLE in Google Chrome pr= ior to 151.0.7922.72 allowed a remote attacker to potentially perform a san= dbox escape via a crafted HTML page. (Chromium security severity: Critical)= </td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17655" target=3D= "_blank" rel=3D"noopener">CVE-2026-17655</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Ozone in Google Chrome prior to 151.0.7922.72 allowed=
a remote attacker to potentially perform a sandbox escape via a crafted HT=
ML page. (Chromium security severity: Critical)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17656" target=3D= "_blank" rel=3D"noopener">CVE-2026-17656</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Navigation in Google Chrome prior to 151.0.7922.72 al= lowed a remote attacker who had compromised the renderer process to potenti= ally perform a sandbox escape via a crafted HTML page. (Chromium security s= everity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17657" target=3D= "_blank" rel=3D"noopener">CVE-2026-17657</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a = remote attacker to execute arbitrary code inside a sandbox via a crafted HT=
ML page. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17658" target=3D= "_blank" rel=3D"noopener">CVE-2026-17658</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in SiteIsolation in Google Chrome prior to=
151.0.7922.72 allowed a remote attacker who had compromised the renderer p= rocess to bypass site isolation via a crafted HTML page. (Chromium security=
severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17659" target=3D= "_blank" rel=3D"noopener">CVE-2026-17659</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Network in Google Chrome = prior to 151.0.7922.72 allowed a remote attacker who had compromised the re= nderer process to potentially perform a sandbox escape via a crafted HTML p= age. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17660" target=3D= "_blank" rel=3D"noopener">CVE-2026-17660</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Loader in Google Chrome prior to 151.0.7922.72 allowe=
d a remote attacker to execute arbitrary code inside a sandbox via a crafte=
d HTML page. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17661" target=3D= "_blank" rel=3D"noopener">CVE-2026-17661</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Prefetch in Google Chrome prior to 1= 51.0.7922.72 allowed a remote attacker to leak cross-origin data via a craf= ted HTML page. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17662" target=3D= "_blank" rel=3D"noopener">CVE-2026-17662</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in GPU in Google Chrome on A= ndroid prior to 151.0.7922.72 allowed a remote attacker who had compromised=
the renderer process to potentially perform a sandbox escape via a crafted=
HTML page. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17663" target=3D= "_blank" rel=3D"noopener">CVE-2026-17663</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Loader in Google Chrome p= rior to 151.0.7922.72 allowed a remote attacker who had compromised the ren= derer process to leak cross-origin data via a crafted HTML page. (Chromium = security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17664" target=3D= "_blank" rel=3D"noopener">CVE-2026-17664</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a = remote attacker to execute arbitrary code inside a sandbox via a crafted HT=
ML page. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17665" target=3D= "_blank" rel=3D"noopener">CVE-2026-17665</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Cryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.7=
2 allowed an attacker in a privileged network position to bypass discretion= ary access control via malicious network traffic. (Chromium security severi= ty: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17666" target=3D= "_blank" rel=3D"noopener">CVE-2026-17666</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allo= wed a remote attacker to leak cross-origin data via a crafted HTML page. (C= hromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17667" target=3D= "_blank" rel=3D"noopener">CVE-2026-17667</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allo= wed a remote attacker to leak cross-origin data via a crafted HTML page. (C= hromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17668" target=3D= "_blank" rel=3D"noopener">CVE-2026-17668</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 151.0.7922.72 allowed a remote attacker to potentially perform a s= andbox escape via a crafted HTML page. (Chromium security severity: High)</=

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17669" target=3D= "_blank" rel=3D"noopener">CVE-2026-17669</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed=
a remote attacker who had compromised the renderer process to potentially = perform a sandbox escape via a crafted HTML page. (Chromium security severi= ty: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17670" target=3D= "_blank" rel=3D"noopener">CVE-2026-17670</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in ANGLE in Google Chrome pr= ior to 151.0.7922.72 allowed a remote attacker who had compromised the rend= erer process to potentially perform a sandbox escape via a crafted HTML pag=
e. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17671" target=3D= "_blank" rel=3D"noopener">CVE-2026-17671</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Chromecast in Google Chro=
me prior to 151.0.7922.72 allowed a remote attacker who had compromised the=
renderer process to potentially perform a sandbox escape via a crafted HTM=
L page. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17672" target=3D= "_blank" rel=3D"noopener">CVE-2026-17672</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Integer overflow in QUIC in Google Chrome prior to 151.0.7922.72 allowe=
d a remote attacker who had compromised the renderer process to potentially=
perform a sandbox escape via a crafted HTML page. (Chromium security sever= ity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17673" target=3D= "_blank" rel=3D"noopener">CVE-2026-17673</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in HTML in Google Chrome prior to 151.0.79= 22.72 allowed a remote attacker to bypass content security policy via a cra= fted HTML page. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17674" target=3D= "_blank" rel=3D"noopener">CVE-2026-17674</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 al= lowed a remote attacker who had compromised the renderer process to potenti= ally perform a sandbox escape via a crafted HTML page. (Chromium security s= everity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17675" target=3D= "_blank" rel=3D"noopener">CVE-2026-17675</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in ANGLE in Google Chrome on Android prior=
to 151.0.7922.72 allowed a remote attacker who had compromised the rendere=
r process to potentially perform a sandbox escape via a crafted HTML page. = (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17676" target=3D= "_blank" rel=3D"noopener">CVE-2026-17676</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in ANGLE in Google Chrome on Android prior=
to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbo=
x escape via a crafted HTML page. (Chromium security severity: High)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17677" target=3D= "_blank" rel=3D"noopener">CVE-2026-17677</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read in ANGLE in Google Chrome prior to 151.0.7922.72 all= owed a remote attacker who had compromised the renderer process to potentia= lly perform a sandbox escape via a crafted HTML page. (Chromium security se= verity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17678" target=3D= "_blank" rel=3D"noopener">CVE-2026-17678</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Print Preview in Google C= hrome prior to 151.0.7922.72 allowed a remote attacker who had compromised = the renderer process to leak cross-origin data via a crafted HTML page. (Ch= romium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17679" target=3D= "_blank" rel=3D"noopener">CVE-2026-17679</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Heap buffer overflow in Color in Google Chrome on ChromeOS prior to 151= .0.7922.72 allowed a remote attacker who had compromised the renderer proce=
ss to potentially perform a sandbox escape via a crafted HTML page. (Chromi=
um security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17680" target=3D= "_blank" rel=3D"noopener">CVE-2026-17680</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Web Authentication in Goo= gle Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who = had compromised the renderer process to potentially perform a sandbox escap=
e via a crafted HTML page. (Chromium security severity: High)</td>

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17681" target=3D= "_blank" rel=3D"noopener">CVE-2026-17681</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allow=
ed a remote attacker who had compromised the renderer process to potentiall=
y perform a sandbox escape via a crafted HTML page. (Chromium security seve= rity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17682" target=3D= "_blank" rel=3D"noopener">CVE-2026-17682</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in ANGLE in Google Chrome prior to 151.0.7= 922.72 allowed a remote attacker to obtain potentially sensitive informatio=
n from process memory via a crafted HTML page. (Chromium security severity:=
High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17683" target=3D= "_blank" rel=3D"noopener">CVE-2026-17683</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Chrome for iOS in Google = Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker who had comp= romised the renderer process to potentially perform a sandbox escape via a = crafted HTML page. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17684" target=3D= "_blank" rel=3D"noopener">CVE-2026-17684</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Autofill in Google Chrome prior to 151.0.7922.72 allo= wed a remote attacker to execute arbitrary code inside a sandbox via a craf= ted HTML page. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17685" target=3D= "_blank" rel=3D"noopener">CVE-2026-17685</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Passwords in Google Chrom=
e prior to 151.0.7922.72 allowed a remote attacker who had compromised the = renderer process to bypass site isolation via a crafted HTML page. (Chromiu=
m security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17686" target=3D= "_blank" rel=3D"noopener">CVE-2026-17686</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed=
a remote attacker who had compromised the renderer process to potentially = perform a sandbox escape via a crafted HTML page. (Chromium security severi= ty: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17687" target=3D= "_blank" rel=3D"noopener">CVE-2026-17687</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Input in Google Chrome prior to 151.0.7922.72 allowed=
a remote attacker who had compromised the renderer process to potentially = perform a sandbox escape via a crafted HTML page. (Chromium security severi= ty: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17688" target=3D= "_blank" rel=3D"noopener">CVE-2026-17688</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allo= wed a remote attacker to leak cross-origin data via a crafted HTML page. (C= hromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17689" target=3D= "_blank" rel=3D"noopener">CVE-2026-17689</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in PDF in Google Chrome on A= ndroid prior to 151.0.7922.72 allowed a local attacker to leak cross-origin=
data via a crafted HTML page. (Chromium security severity: High)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17690" target=3D= "_blank" rel=3D"noopener">CVE-2026-17690</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds write in ANGLE in Google Chrome on Windows prior to 151.0= .7922.72 allowed a remote attacker to potentially perform a sandbox escape = via a crafted HTML page. (Chromium security severity: High)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17691" target=3D= "_blank" rel=3D"noopener">CVE-2026-17691</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in DataTransfer in Google Chrome on Windows prior to 151= .0.7922.72 allowed a remote attacker who had compromised the renderer proce=
ss to potentially perform a sandbox escape via a crafted HTML page. (Chromi=
um security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17692" target=3D= "_blank" rel=3D"noopener">CVE-2026-17692</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in FileSystem in Google Chrome prior to=
151.0.7922.72 allowed a remote attacker to leak cross-origin data via a cr= afted HTML page. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17693" target=3D= "_blank" rel=3D"noopener">CVE-2026-17693</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in DOM in Google Chrome prior to 151.0.7922.72 allowed a=
remote attacker to execute arbitrary code inside a sandbox via a crafted H= TML page. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17694" target=3D= "_blank" rel=3D"noopener">CVE-2026-17694</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in ANGLE in Google Chrome on Mac prior to = 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox es= cape via a crafted HTML page. (Chromium security severity: High)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17695" target=3D= "_blank" rel=3D"noopener">CVE-2026-17695</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Side-channel information leakage in Media in Google Chrome prior to 151= .0.7922.72 allowed a remote attacker to leak cross-origin data via a crafte=
d HTML page. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17696" target=3D= "_blank" rel=3D"noopener">CVE-2026-17696</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed=
a remote attacker to potentially perform a sandbox escape via a crafted HT=
ML page. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17697" target=3D= "_blank" rel=3D"noopener">CVE-2026-17697</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in UI in Google Chrome on An= droid prior to 151.0.7922.72 allowed a local attacker to leak cross-origin = data via a crafted HTML page. (Chromium security severity: High)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17698" target=3D= "_blank" rel=3D"noopener">CVE-2026-17698</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed=
a local attacker to potentially perform a sandbox escape via a malicious f= ile. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17699" target=3D= "_blank" rel=3D"noopener">CVE-2026-17699</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Actor in Google Chrome pr= ior to 151.0.7922.72 allowed a remote attacker who had compromised the rend= erer process to leak cross-origin data via a crafted HTML page. (Chromium s= ecurity severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17700" target=3D= "_blank" rel=3D"noopener">CVE-2026-17700</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in ANGLE in Google Chrome on=
Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised t=
he renderer process to potentially perform a sandbox escape via a crafted H= TML page. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17701" target=3D= "_blank" rel=3D"noopener">CVE-2026-17701</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Skia in Google Chrome prior to 151.0.79= 22.72 allowed a remote attacker who had compromised the renderer process to=
leak cross-origin data via a crafted HTML page. (Chromium security severit=
y: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17702" target=3D= "_blank" rel=3D"noopener">CVE-2026-17702</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Chrome for iOS in Google Chrome on i=
OS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation re= strictions via a crafted HTML page. (Chromium security severity: High)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17703" target=3D= "_blank" rel=3D"noopener">CVE-2026-17703</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed=
a remote attacker who had compromised the renderer process to potentially = perform a sandbox escape via a crafted HTML page. (Chromium security severi= ty: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17704" target=3D= "_blank" rel=3D"noopener">CVE-2026-17704</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Integer overflow in libxml in Google Chrome prior to 151.0.7922.72 allo= wed a remote attacker to execute arbitrary code inside a sandbox via a craf= ted HTML page. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17705" target=3D= "_blank" rel=3D"noopener">CVE-2026-17705</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Media in Google Chrome on=
Windows prior to 151.0.7922.72 allowed a remote attacker who had compromis=
ed the renderer process to leak cross-origin data via a crafted HTML page. = (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17706" target=3D= "_blank" rel=3D"noopener">CVE-2026-17706</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in Media in Google Chrome on Windows prior to 151.0.7= 922.72 allowed a remote attacker who had compromised the renderer process t=
o obtain potentially sensitive information from process memory via a crafte=
d HTML page. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17707" target=3D= "_blank" rel=3D"noopener">CVE-2026-17707</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Audio in Google Chrome prior to 151.0.7922.72 allowed=
a remote attacker who had compromised the renderer process to potentially = perform a sandbox escape via a crafted HTML page. (Chromium security severi= ty: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17708" target=3D= "_blank" rel=3D"noopener">CVE-2026-17708</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowe=
d a remote attacker who had compromised the renderer process to potentially=
perform a sandbox escape via a crafted HTML page. (Chromium security sever= ity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17709" target=3D= "_blank" rel=3D"noopener">CVE-2026-17709</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in MHTML in Google Chrome on Mac prior to = 151.0.7922.72 allowed a remote attacker who had compromised the renderer pr= ocess to potentially perform a sandbox escape via a crafted HTML page. (Chr= omium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17710" target=3D= "_blank" rel=3D"noopener">CVE-2026-17710</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowe=
d a remote attacker who had compromised the renderer process to potentially=
perform a sandbox escape via a crafted HTML page. (Chromium security sever= ity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17711" target=3D= "_blank" rel=3D"noopener">CVE-2026-17711</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Race in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a r= emote attacker to execute arbitrary code inside a sandbox via a crafted HTM=
L page. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17712" target=3D= "_blank" rel=3D"noopener">CVE-2026-17712</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Accessibility in Google C= hrome on Android prior to 151.0.7922.72 allowed a remote attacker who had c= ompromised the renderer process to potentially perform a sandbox escape via=
a crafted HTML page. (Chromium security severity: High)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17713" target=3D= "_blank" rel=3D"noopener">CVE-2026-17713</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allo= wed a remote attacker to obtain potentially sensitive information from proc= ess memory via a crafted HTML page. (Chromium security severity: High)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17714" target=3D= "_blank" rel=3D"noopener">CVE-2026-17714</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Passwords in Google Chrome prior to 151= .0.7922.72 allowed a remote attacker who convinced a user to engage in spec= ific UI gestures to leak cross-origin data via a crafted HTML page. (Chromi=
um security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17715" target=3D= "_blank" rel=3D"noopener">CVE-2026-17715</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Updater in Google Chrome on Mac prior to 151.0.7922.7=
2 allowed a local attacker to perform privilege escalation via malicious ne= twork traffic. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17716" target=3D= "_blank" rel=3D"noopener">CVE-2026-17716</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allow=
ed a remote attacker to potentially perform a sandbox escape via a crafted = HTML page. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17717" target=3D= "_blank" rel=3D"noopener">CVE-2026-17717</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed=
a remote attacker to potentially perform a sandbox escape via a crafted HT=
ML page. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17718" target=3D= "_blank" rel=3D"noopener">CVE-2026-17718</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Input in Google Chrome prior to 151.0.7922.72 allowed=
a remote attacker to execute arbitrary code inside a sandbox via a crafted=
HTML page. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17719" target=3D= "_blank" rel=3D"noopener">CVE-2026-17719</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Passwords in Google Chrome prior to = 151.0.7922.72 allowed a remote attacker who had compromised the renderer pr= ocess to leak cross-origin data via a crafted HTML page. (Chromium security=
severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17720" target=3D= "_blank" rel=3D"noopener">CVE-2026-17720</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 al= lowed a remote attacker to potentially perform a sandbox escape via a craft=
ed HTML page. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17721" target=3D= "_blank" rel=3D"noopener">CVE-2026-17721</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Object lifecycle issue in WebView in Google Chrome on Android prior to = 151.0.7922.72 allowed a remote attacker who had compromised the renderer pr= ocess to potentially perform a sandbox escape via a crafted HTML page. (Chr= omium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17722" target=3D= "_blank" rel=3D"noopener">CVE-2026-17722</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Media in Google Chrome on Windows prior to 151.0.7922= .72 allowed a remote attacker who had compromised the renderer process to p= otentially perform a sandbox escape via a crafted HTML page. (Chromium secu= rity severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17723" target=3D= "_blank" rel=3D"noopener">CVE-2026-17723</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 a= llowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a c= rafted HTML page. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17724" target=3D= "_blank" rel=3D"noopener">CVE-2026-17724</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a = remote attacker to execute arbitrary code inside a sandbox via a crafted HT=
ML page. (Chromium security severity: High)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17725" target=3D= "_blank" rel=3D"noopener">CVE-2026-17725</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Integer overflow in WebGL in Google Chrome on Android prior to 151.0.79= 22.72 allowed a remote attacker to potentially perform a sandbox escape via=
a crafted HTML page. (Chromium security severity: High)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17726" target=3D= "_blank" rel=3D"noopener">CVE-2026-17726</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds write in WebGL in Google Chrome on Android prior to 151.0= .7922.72 allowed a remote attacker to potentially perform a sandbox escape = via a crafted HTML page. (Chromium security severity: High)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17727" target=3D= "_blank" rel=3D"noopener">CVE-2026-17727</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Extensions in Google Chrome prior to 15= 1.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (= UXSS) via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17728" target=3D= "_blank" rel=3D"noopener">CVE-2026-17728</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a = remote attacker who had compromised the renderer process to potentially per= form out of bounds memory access via a crafted HTML page. (Chromium securit=
y severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17729" target=3D= "_blank" rel=3D"noopener">CVE-2026-17729</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Side-channel information leakage in Autofill in Google Chrome prior to = 151.0.7922.72 allowed a remote attacker who convinced a user to engage in s= pecific UI gestures to leak cross-origin data via a crafted HTML page. (Chr= omium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17730" target=3D= "_blank" rel=3D"noopener">CVE-2026-17730</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Autofill in Google Chrome on Android pr= ior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data vi=
a a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17731" target=3D= "_blank" rel=3D"noopener">CVE-2026-17731</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in SVG in Google Chrome prior to 151.0.792= 2.72 allowed a remote attacker to leak cross-origin data via a crafted HTML=
page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17732" target=3D= "_blank" rel=3D"noopener">CVE-2026-17732</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in QUIC in Google Chrome on Android prior =
to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a = crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17733" target=3D= "_blank" rel=3D"noopener">CVE-2026-17733</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Autofill in Google Chrome prior to 151.= 0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UX= SS) via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17734" target=3D= "_blank" rel=3D"noopener">CVE-2026-17734</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in BFCache in Google Chrome = prior to 151.0.7922.72 allowed a remote attacker who had compromised the re= nderer process to potentially perform a sandbox escape via a crafted HTML p= age. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17735" target=3D= "_blank" rel=3D"noopener">CVE-2026-17735</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in WebView in Google Chrome =
on Android prior to 151.0.7922.72 allowed a remote attacker who had comprom= ised the renderer process to potentially perform a sandbox escape via a cra= fted HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17736" target=3D= "_blank" rel=3D"noopener">CVE-2026-17736</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Bluetooth in Google Chrome on Android prior to 151.0.= 7922.72 allowed a remote attacker who had compromised the renderer process =
to potentially perform a sandbox escape via a crafted HTML page. (Chromium = security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17737" target=3D= "_blank" rel=3D"noopener">CVE-2026-17737</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Payments in Google Chrome=
prior to 151.0.7922.72 allowed a remote attacker who had compromised the r= enderer process to potentially perform a sandbox escape via a crafted HTML = page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17738" target=3D= "_blank" rel=3D"noopener">CVE-2026-17738</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Extensions in Google Chrome prior to=
151.0.7922.72 allowed an attacker who convinced a user to install a malici= ous extension to inject arbitrary scripts or HTML (UXSS) via a crafted Chro=
me Extension. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17739" target=3D= "_blank" rel=3D"noopener">CVE-2026-17739</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allo= wed a remote attacker to leak cross-origin data via a crafted HTML page. (C= hromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17740" target=3D= "_blank" rel=3D"noopener">CVE-2026-17740</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in WebView in Google Chrome =
on Android prior to 151.0.7922.72 allowed a remote attacker to potentially = perform a sandbox escape via a crafted HTML page. (Chromium security severi= ty: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17741" target=3D= "_blank" rel=3D"noopener">CVE-2026-17741</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Payments in Google Chrome prior to 1= 51.0.7922.72 allowed a remote attacker to leak cross-origin data via a craf= ted HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17742" target=3D= "_blank" rel=3D"noopener">CVE-2026-17742</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in ControlledFrame in Google Chrome pri=
or to 151.0.7922.72 allowed a remote attacker to bypass same origin policy = via a crafted HTML page. (Chromium security severity: Medium)</td>

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17743" target=3D= "_blank" rel=3D"noopener">CVE-2026-17743</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in File Input in Google Chrome on Linux pr= ior to 151.0.7922.72 allowed a remote attacker to potentially perform a san= dbox escape via a crafted HTML page. (Chromium security severity: Medium)</=

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17744" target=3D= "_blank" rel=3D"noopener">CVE-2026-17744</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read in Skia in Google Chrome prior to 151.0.7922.72 allo= wed a remote attacker who had compromised the renderer process to potential=
ly perform a sandbox escape via a crafted HTML page. (Chromium security sev= erity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17745" target=3D= "_blank" rel=3D"noopener">CVE-2026-17745</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in GPU in Google Chrome on Mac prior to 151.0.7922.72 al= lowed a remote attacker who had compromised the renderer process to potenti= ally perform a sandbox escape via a crafted HTML page. (Chromium security s= everity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17746" target=3D= "_blank" rel=3D"noopener">CVE-2026-17746</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Payments in Google Chrome=
on Android prior to 151.0.7922.72 allowed a remote attacker who had compro= mised the renderer process to perform UI spoofing via a crafted HTML page. = (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17747" target=3D= "_blank" rel=3D"noopener">CVE-2026-17747</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Extensions in Google Chrome prior to 15= 1.0.7922.72 allowed a remote attacker who had compromised the renderer proc= ess to bypass site isolation via a crafted HTML page. (Chromium security se= verity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17748" target=3D= "_blank" rel=3D"noopener">CVE-2026-17748</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Extensions in Google Chro=
me prior to 151.0.7922.72 allowed an attacker who convinced a user to insta=
ll a malicious extension to potentially perform a sandbox escape via a craf= ted Chrome Extension. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17749" target=3D= "_blank" rel=3D"noopener">CVE-2026-17749</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed=
a remote attacker to potentially perform a sandbox escape via a crafted HT=
ML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17750" target=3D= "_blank" rel=3D"noopener">CVE-2026-17750</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in AdFilter in Google Chrome prior to 151.= 0.7922.72 allowed a remote attacker to execute arbitrary code inside a sand= box via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17751" target=3D= "_blank" rel=3D"noopener">CVE-2026-17751</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Views in Google Chrome on Mac prior to 151.0.7922.72 = allowed a remote attacker to potentially exploit heap corruption via a craf= ted HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17752" target=3D= "_blank" rel=3D"noopener">CVE-2026-17752</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Autofill in Google Chrome prior to 151.= 0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted=
HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17753" target=3D= "_blank" rel=3D"noopener">CVE-2026-17753</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Blink in Google Chrome prior to 151.0.7= 922.72 allowed a remote attacker to bypass same origin policy via a crafted=
HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17754" target=3D= "_blank" rel=3D"noopener">CVE-2026-17754</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in Extensions in Google Chrome prior to 151.0.792= 2.72 allowed an attacker who convinced a user to install a malicious extens= ion to perform UI spoofing via a crafted Chrome Extension. (Chromium securi=
ty severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17755" target=3D= "_blank" rel=3D"noopener">CVE-2026-17755</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Presentation in Google Chrome prior =
to 151.0.7922.72 allowed a remote attacker to bypass navigation restriction=
s via a crafted HTML page. (Chromium security severity: Medium)</td>

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17756" target=3D= "_blank" rel=3D"noopener">CVE-2026-17756</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allow=
ed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch= romium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17757" target=3D= "_blank" rel=3D"noopener">CVE-2026-17757</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Heap buffer overflow in Dawn in Google Chrome prior to 151.0.7922.72 al= lowed a remote attacker to potentially perform a sandbox escape via a craft=
ed HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17758" target=3D= "_blank" rel=3D"noopener">CVE-2026-17758</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in Codecs in Google Chrome prior to 151.0.7922.72 all= owed a remote attacker to obtain potentially sensitive information from pro= cess memory via a crafted HTML page. (Chromium security severity: Medium)</=

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17759" target=3D= "_blank" rel=3D"noopener">CVE-2026-17759</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Side-channel information leakage in NoStatePrefetch in Google Chrome pr= ior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data vi=
a a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17760" target=3D= "_blank" rel=3D"noopener">CVE-2026-17760</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Chrome for iOS in Google = Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject ar= bitrary scripts or HTML (UXSS) via malicious network traffic. (Chromium sec= urity severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17761" target=3D= "_blank" rel=3D"noopener">CVE-2026-17761</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data = via a crafted HTML page. (Chromium security severity: Medium)</td>

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17762" target=3D= "_blank" rel=3D"noopener">CVE-2026-17762</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in GPU in Google Chrome prior to 151.0.792= 2.72 allowed a remote attacker who had compromised the renderer process to = leak cross-origin data via a crafted HTML page. (Chromium security severity=
: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17763" target=3D= "_blank" rel=3D"noopener">CVE-2026-17763</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in FedCM in Google Chrome prior to 151.0.7= 922.72 allowed a remote attacker to bypass same origin policy via a crafted=
HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17764" target=3D= "_blank" rel=3D"noopener">CVE-2026-17764</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in WebProtect in Google Chrome prior to 15= 1.0.7922.72 allowed a remote attacker who had compromised the renderer proc= ess to leak cross-origin data via a crafted HTML page. (Chromium security s= everity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17765" target=3D= "_blank" rel=3D"noopener">CVE-2026-17765</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Clipboard in Google Chrom=
e on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-= origin data via a crafted HTML page. (Chromium security severity: Medium)</=

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17766" target=3D= "_blank" rel=3D"noopener">CVE-2026-17766</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in WebView in Google Chrome =
on Android prior to 151.0.7922.72 allowed a remote attacker who had comprom= ised the renderer process to leak cross-origin data via a crafted HTML page=
. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17767" target=3D= "_blank" rel=3D"noopener">CVE-2026-17767</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in WebSockets in Google Chro=
me prior to 151.0.7922.72 allowed a remote attacker who had compromised the=
renderer process to potentially perform a sandbox escape via a crafted HTM=
L page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17768" target=3D= "_blank" rel=3D"noopener">CVE-2026-17768</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Cast in Google Chrome pri=
or to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via=
a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17769" target=3D= "_blank" rel=3D"noopener">CVE-2026-17769</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read in Media in Google Chrome on Mac prior to 151.0.7922= .72 allowed a remote attacker who had compromised the renderer process to p= otentially perform a sandbox escape via a crafted HTML page. (Chromium secu= rity severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17770" target=3D= "_blank" rel=3D"noopener">CVE-2026-17770</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allow=
ed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch= romium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17771" target=3D= "_blank" rel=3D"noopener">CVE-2026-17771</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read in WebGL in Google Chrome prior to 151.0.7922.72 all= owed a remote attacker to perform an out of bounds memory read via a crafte=
d HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17772" target=3D= "_blank" rel=3D"noopener">CVE-2026-17772</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Cast in Google Chrome pri=
or to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via=
a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17773" target=3D= "_blank" rel=3D"noopener">CVE-2026-17773</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Variations in Google Chro=
me prior to 151.0.7922.72 allowed an attacker in a privileged network posit= ion to potentially exploit heap corruption via malicious network traffic. (= Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17774" target=3D= "_blank" rel=3D"noopener">CVE-2026-17774</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in PresentationAPI in Google Chrome prior =
to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a = crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17775" target=3D= "_blank" rel=3D"noopener">CVE-2026-17775</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Policy bypass in Receiver in Google Chrome prior to 151.0.7922.72 allow=
ed a remote attacker who had compromised the renderer process to potentiall=
y perform a sandbox escape via a crafted HTML page. (Chromium security seve= rity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17776" target=3D= "_blank" rel=3D"noopener">CVE-2026-17776</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Autofill in Google Chrome prior to 151.= 0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted=
HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17777" target=3D= "_blank" rel=3D"noopener">CVE-2026-17777</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Extensions in Google Chrome prior to 151.0.7922.72 al= lowed a remote attacker to execute arbitrary code inside a sandbox via a cr= afted Chrome Extension. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17778" target=3D= "_blank" rel=3D"noopener">CVE-2026-17778</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Site Isolation in Google Chrome prior t=
o 151.0.7922.72 allowed a remote attacker to bypass site isolation via a cr= afted HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17779" target=3D= "_blank" rel=3D"noopener">CVE-2026-17779</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Isolated Web Apps in Google Chrome prio=
r to 151.0.7922.72 allowed a remote attacker to bypass navigation restricti= ons via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17780" target=3D= "_blank" rel=3D"noopener">CVE-2026-17780</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Extensions in Google Chrome prior to 15= 1.0.7922.72 allowed an attacker who convinced a user to install a malicious=
extension to leak cross-origin data via a crafted Chrome Extension. (Chrom= ium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17781" target=3D= "_blank" rel=3D"noopener">CVE-2026-17781</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior t=
o 151.0.7922.72 allowed a remote attacker to spoof the contents of the Omni= box (URL bar) via a crafted HTML page. (Chromium security severity: Medium)= </td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17782" target=3D= "_blank" rel=3D"noopener">CVE-2026-17782</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Loader in Google Chrome prior to 151.0.= 7922.72 allowed a remote attacker to leak cross-origin data via a crafted H= TML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17783" target=3D= "_blank" rel=3D"noopener">CVE-2026-17783</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Audio in Google Chrome on Mac prior to 151.0.7922.72 = allowed a remote attacker who had compromised the renderer process to poten= tially perform a sandbox escape via a crafted HTML page. (Chromium security=
severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17784" target=3D= "_blank" rel=3D"noopener">CVE-2026-17784</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allo= wed a remote attacker to leak cross-origin data via a crafted HTML page. (C= hromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17785" target=3D= "_blank" rel=3D"noopener">CVE-2026-17785</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in DevTools in Google Chrome=
prior to 151.0.7922.72 allowed an attacker who convinced a user to install=
a malicious extension to perform privilege escalation via a crafted Chrome=
Extension. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17786" target=3D= "_blank" rel=3D"noopener">CVE-2026-17786</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in DevTools in Google Chrome prior to 151.= 0.7922.72 allowed a remote attacker to bypass same origin policy via a craf= ted HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17787" target=3D= "_blank" rel=3D"noopener">CVE-2026-17787</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Blink in Google Chrome prior to 151.0.7= 922.72 allowed a remote attacker to leak cross-origin data via a crafted HT=
ML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17788" target=3D= "_blank" rel=3D"noopener">CVE-2026-17788</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Chrome for iOS in Google = Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass na= vigation restrictions via malicious network traffic. (Chromium security sev= erity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17789" target=3D= "_blank" rel=3D"noopener">CVE-2026-17789</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in ANGLE in Google Chrome on Windows prior to 151.0.7= 922.72 allowed a remote attacker to obtain potentially sensitive informatio=
n from process memory via a crafted HTML page. (Chromium security severity:=
Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17790" target=3D= "_blank" rel=3D"noopener">CVE-2026-17790</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Payments in Google Chrome=
prior to 151.0.7922.72 allowed a remote attacker who had compromised the r= enderer process to perform UI spoofing via a crafted HTML page. (Chromium s= ecurity severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17791" target=3D= "_blank" rel=3D"noopener">CVE-2026-17791</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Credential Management in Google Chrome = prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via=
a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17792" target=3D= "_blank" rel=3D"noopener">CVE-2026-17792</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Messages in Google Chrome on Android pr= ior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a=
crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17793" target=3D= "_blank" rel=3D"noopener">CVE-2026-17793</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Mobile in Google Chrome o=
n Android prior to 151.0.7922.72 allowed a remote attacker who had compromi= sed the renderer process to spoof the contents of the Omnibox (URL bar) via=
a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17794" target=3D= "_blank" rel=3D"noopener">CVE-2026-17794</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in GetUserMedia in Google Chrome prior to = 151.0.7922.72 allowed a remote attacker who had compromised the renderer pr= ocess to leak cross-origin data via a crafted HTML page. (Chromium security=
severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17795" target=3D= "_blank" rel=3D"noopener">CVE-2026-17795</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Side-channel information leakage in WebXR in Google Chrome prior to 151= .0.7922.72 allowed a remote attacker to obtain potentially sensitive inform= ation from process memory via a crafted HTML page. (Chromium security sever= ity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17796" target=3D= "_blank" rel=3D"noopener">CVE-2026-17796</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in CSS in Google Chrome prior to 151.0.792= 2.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) v=
ia a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17797" target=3D= "_blank" rel=3D"noopener">CVE-2026-17797</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Cast in Google Chrome prior to 151.0.79= 22.72 allowed a remote attacker to leak cross-origin data via a crafted HTM=
L page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17798" target=3D= "_blank" rel=3D"noopener">CVE-2026-17798</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Safe Browsing in Google C= hrome prior to 151.0.7922.72 allowed a remote attacker to bypass discretion= ary access control via a malicious file. (Chromium security severity: Mediu= m)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17799" target=3D= "_blank" rel=3D"noopener">CVE-2026-17799</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in MediaRecording in Google Chrome prior t=
o 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive i= nformation from process memory via a crafted HTML page. (Chromium security = severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17800" target=3D= "_blank" rel=3D"noopener">CVE-2026-17800</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read and write in ANGLE in Google Chrome prior to 151.0.7= 922.72 allowed a remote attacker to potentially perform a sandbox escape vi=
a a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17801" target=3D= "_blank" rel=3D"noopener">CVE-2026-17801</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Side-channel information leakage in GPU in Google Chrome on Android pri=
or to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via=
a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17802" target=3D= "_blank" rel=3D"noopener">CVE-2026-17802</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Save to Drive in Google C= hrome prior to 151.0.7922.72 allowed a remote attacker who had compromised = the renderer process to potentially perform a sandbox escape via a crafted = PDF file. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17803" target=3D= "_blank" rel=3D"noopener">CVE-2026-17803</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Media in Google Chrome prior to 151.0.7922.72 allowed=
a remote attacker who had compromised the renderer process to potentially = perform a sandbox escape via a crafted HTML page. (Chromium security severi= ty: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17804" target=3D= "_blank" rel=3D"noopener">CVE-2026-17804</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Glic in Google Chrome on Android pri=
or to 151.0.7922.72 allowed a remote attacker to bypass navigation restrict= ions via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17805" target=3D= "_blank" rel=3D"noopener">CVE-2026-17805</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Extensions in Google Chro=
me prior to 151.0.7922.72 allowed a remote attacker who had compromised the=
renderer process to potentially perform a sandbox escape via a crafted HTM=
L page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17806" target=3D= "_blank" rel=3D"noopener">CVE-2026-17806</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a = remote attacker to execute arbitrary code inside a sandbox via a crafted HT=
ML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17807" target=3D= "_blank" rel=3D"noopener">CVE-2026-17807</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in WebGL in Google Chrome on Android prior to 151.0.7= 922.72 allowed a remote attacker to leak cross-origin data via a crafted HT=
ML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17808" target=3D= "_blank" rel=3D"noopener">CVE-2026-17808</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Extensions in Google Chro=
me prior to 151.0.7922.72 allowed a remote attacker who had compromised the=
renderer process to potentially perform a sandbox escape via a crafted HTM=
L page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17809" target=3D= "_blank" rel=3D"noopener">CVE-2026-17809</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allow=
ed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch= romium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17810" target=3D= "_blank" rel=3D"noopener">CVE-2026-17810</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in ANGLE in Google Chrome on Windows prior to 151.0.7922= .72 allowed a remote attacker to potentially perform a sandbox escape via a=
crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17811" target=3D= "_blank" rel=3D"noopener">CVE-2026-17811</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in DigitalCredentials in Google Chrome pri=
or to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a = crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17812" target=3D= "_blank" rel=3D"noopener">CVE-2026-17812</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Chrome for iOS in Google Chrome on i=
OS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation re= strictions via a crafted HTML page. (Chromium security severity: Medium)</t=

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17813" target=3D= "_blank" rel=3D"noopener">CVE-2026-17813</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Chrome for iOS in Google = Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass na= vigation restrictions via a crafted HTML page. (Chromium security severity:=
Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17814" target=3D= "_blank" rel=3D"noopener">CVE-2026-17814</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in GuestView in Google Chrome prior to = 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a cra= fted HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17815" target=3D= "_blank" rel=3D"noopener">CVE-2026-17815</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Speech in Google Chrome on Android p= rior to 151.0.7922.72 allowed a remote attacker who had compromised the ren= derer process to perform privilege escalation via a crafted HTML page. (Chr= omium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17816" target=3D= "_blank" rel=3D"noopener">CVE-2026-17816</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in ReportingAndNEL in Google Chrome prior =
to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a = crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17817" target=3D= "_blank" rel=3D"noopener">CVE-2026-17817</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Network in Google Chrome prior to 151.0= .7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXS=
S) via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17818" target=3D= "_blank" rel=3D"noopener">CVE-2026-17818</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in WebAppInstalls in Google Chrome prior t=
o 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a craf= ted HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17819" target=3D= "_blank" rel=3D"noopener">CVE-2026-17819</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Autofill in Google Chrome prior to 1= 51.0.7922.72 allowed a remote attacker to leak cross-origin data via a craf= ted HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17820" target=3D= "_blank" rel=3D"noopener">CVE-2026-17820</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Extensions in Google Chrome prior to=
151.0.7922.72 allowed an attacker who convinced a user to install a malici= ous extension to bypass navigation restrictions via a crafted Chrome Extens= ion. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17821" target=3D= "_blank" rel=3D"noopener">CVE-2026-17821</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 a= llowed a remote attacker to perform UI spoofing via a crafted HTML page. (C= hromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17822" target=3D= "_blank" rel=3D"noopener">CVE-2026-17822</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in WebXR in Google Chrome prior to 151.= 0.7922.72 allowed a remote attacker to bypass same origin policy via a craf= ted HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17823" target=3D= "_blank" rel=3D"noopener">CVE-2026-17823</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in ServiceWorker in Google Chrome prior=
to 151.0.7922.72 allowed a remote attacker to bypass same origin policy vi=
a a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17824" target=3D= "_blank" rel=3D"noopener">CVE-2026-17824</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Passwords in Google Chrome on Androi=
d prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary = access control via a crafted HTML page. (Chromium security severity: Medium= )</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17825" target=3D= "_blank" rel=3D"noopener">CVE-2026-17825</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 151.0.7922.72 allowed a remote attacker who convinced a user to en= gage in specific UI gestures to leak cross-origin data via a crafted HTML p= age. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17826" target=3D= "_blank" rel=3D"noopener">CVE-2026-17826</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in CSS in Google Chrome prior to 151.0.792= 2.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) v=
ia a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17827" target=3D= "_blank" rel=3D"noopener">CVE-2026-17827</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via=
a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17828" target=3D= "_blank" rel=3D"noopener">CVE-2026-17828</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Passwords in Google Chrome prior to = 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a cra= fted HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17829" target=3D= "_blank" rel=3D"noopener">CVE-2026-17829</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restr= ictions via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17830" target=3D= "_blank" rel=3D"noopener">CVE-2026-17830</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Passwords in Google Chrom=
e prior to 151.0.7922.72 allowed a remote attacker who had compromised the = renderer process to perform UI spoofing via a crafted HTML page. (Chromium = security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17831" target=3D= "_blank" rel=3D"noopener">CVE-2026-17831</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed=
a remote attacker who had compromised the renderer process to potentially = perform a sandbox escape via a crafted HTML page. (Chromium security severi= ty: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17832" target=3D= "_blank" rel=3D"noopener">CVE-2026-17832</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Passwords in Google Chrome prior to 151= .0.7922.72 allowed a remote attacker to leak cross-origin data via a crafte=
d HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17833" target=3D= "_blank" rel=3D"noopener">CVE-2026-17833</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Passwords in Google Chrom=
e prior to 151.0.7922.72 allowed a remote attacker who had compromised the = renderer process to potentially perform a sandbox escape via a crafted HTML=
page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17834" target=3D= "_blank" rel=3D"noopener">CVE-2026-17834</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via=
a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17835" target=3D= "_blank" rel=3D"noopener">CVE-2026-17835</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a = remote attacker to execute arbitrary code inside a sandbox via a crafted HT=
ML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17836" target=3D= "_blank" rel=3D"noopener">CVE-2026-17836</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in DevTools in Google Chrome=
prior to 151.0.7922.72 allowed a remote attacker who had compromised the r= enderer process to potentially perform a sandbox escape via a crafted HTML = page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17837" target=3D= "_blank" rel=3D"noopener">CVE-2026-17837</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior t=
o 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a = crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17838" target=3D= "_blank" rel=3D"noopener">CVE-2026-17838</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via=
a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17839" target=3D= "_blank" rel=3D"noopener">CVE-2026-17839</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in Passwords in Google Chrome prior to 151.0.7922= .72 allowed a remote attacker to perform domain spoofing via a crafted HTML=
page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17840" target=3D= "_blank" rel=3D"noopener">CVE-2026-17840</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 a= llowed a remote attacker to perform UI spoofing via a crafted HTML page. (C= hromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17841" target=3D= "_blank" rel=3D"noopener">CVE-2026-17841</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 151.0.7922.72 allowed a remote attacker who convinced a user to en= gage in specific UI gestures to bypass same origin policy via a crafted HTM=
L page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17842" target=3D= "_blank" rel=3D"noopener">CVE-2026-17842</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in CSS in Google Chrome prior to 151.0.792= 2.72 allowed a remote attacker to leak cross-origin data via a crafted HTML=
page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17843" target=3D= "_blank" rel=3D"noopener">CVE-2026-17843</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Cast in Google Chrome pri=
or to 151.0.7922.72 allowed an attacker on the local network segment to lea=
k cross-origin data via malicious network traffic. (Chromium security sever= ity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17844" target=3D= "_blank" rel=3D"noopener">CVE-2026-17844</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in CSS in Google Chrome prior to 151.0.792= 2.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) v=
ia a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17845" target=3D= "_blank" rel=3D"noopener">CVE-2026-17845</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Media in Google Chrome on Windows prior=
to 151.0.7922.72 allowed a remote attacker who had compromised the rendere=
r process to bypass same origin policy via a crafted HTML page. (Chromium s= ecurity severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17846" target=3D= "_blank" rel=3D"noopener">CVE-2026-17846</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in ANGLE in Google Chrome pr= ior to 151.0.7922.72 allowed a remote attacker to potentially perform a san= dbox escape via a crafted HTML page. (Chromium security severity: Medium)</=

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17847" target=3D= "_blank" rel=3D"noopener">CVE-2026-17847</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Integer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allo= wed a remote attacker to potentially perform a sandbox escape via a crafted=
video file. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17848" target=3D= "_blank" rel=3D"noopener">CVE-2026-17848</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 151.0.7922.72 allowed a remote attacker to spoof the contents of t=
he Omnibox (URL bar) via malicious network traffic. (Chromium security seve= rity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17849" target=3D= "_blank" rel=3D"noopener">CVE-2026-17849</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Permissions in Google Chrome prior to 1= 51.0.7922.72 allowed a remote attacker to bypass same origin policy via a c= rafted HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17850" target=3D= "_blank" rel=3D"noopener">CVE-2026-17850</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Side-channel information leakage in Autofill in Google Chrome prior to = 151.0.7922.72 allowed a remote attacker who had compromised the renderer pr= ocess to leak cross-origin data via a crafted HTML page. (Chromium security=
severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17851" target=3D= "_blank" rel=3D"noopener">CVE-2026-17851</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Media Router in Google Chrome prior to = 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a = crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17852" target=3D= "_blank" rel=3D"noopener">CVE-2026-17852</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in DevTools in Google Chrome prior to 151.= 0.7922.72 allowed a remote attacker who had compromised the renderer proces=
s to inject scripts or HTML into a privileged page via a crafted HTML page.=
(Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17853" target=3D= "_blank" rel=3D"noopener">CVE-2026-17853</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in WebMCP in Google Chrome prior to 151= .0.7922.72 allowed a remote attacker to bypass same origin policy via a cra= fted HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17854" target=3D= "_blank" rel=3D"noopener">CVE-2026-17854</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Race in DevTools in Google Chrome on Mac prior to 151.0.7922.72 allowed=
a remote attacker who had compromised the renderer process to potentially = perform a sandbox escape via a crafted HTML page. (Chromium security severi= ty: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17855" target=3D= "_blank" rel=3D"noopener">CVE-2026-17855</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Network in Google Chrome on Mac prior t=
o 151.0.7922.72 allowed a remote attacker who had compromised the renderer = process to potentially perform a sandbox escape via a crafted HTML page. (C= hromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17856" target=3D= "_blank" rel=3D"noopener">CVE-2026-17856</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Network in Google Chrome prior to 151.0= .7922.72 allowed a remote attacker to leak cross-origin data via a crafted = HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17857" target=3D= "_blank" rel=3D"noopener">CVE-2026-17857</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in WebNN in Google Chrome on Windows prior to 151.0.7= 922.72 allowed a remote attacker to leak cross-origin data via a crafted HT=
ML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17858" target=3D= "_blank" rel=3D"noopener">CVE-2026-17858</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Favicons in Google Chrome prior to 151.= 0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted=
HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17859" target=3D= "_blank" rel=3D"noopener">CVE-2026-17859</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Mobile in Google Chrome o=
n Android prior to 151.0.7922.72 allowed a local attacker to spoof the cont= ents of the Omnibox (URL bar) via a malicious file. (Chromium security seve= rity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17860" target=3D= "_blank" rel=3D"noopener">CVE-2026-17860</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Updater in Google Chrome = prior to 151.0.7922.72 allowed a local attacker to perform OS-level privile=
ge escalation via a malicious file. (Chromium security severity: Medium)</t=

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17861" target=3D= "_blank" rel=3D"noopener">CVE-2026-17861</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Tracing in Google Chrome on Windows prior to 151.0.79= 22.72 allowed a local attacker to perform OS-level privilege escalation via=
a malicious file. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17862" target=3D= "_blank" rel=3D"noopener">CVE-2026-17862</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Browser in Google Chrome on Windows pri=
or to 151.0.7922.72 allowed a local attacker to perform privilege escalatio=
n via a malicious file. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17863" target=3D= "_blank" rel=3D"noopener">CVE-2026-17863</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Updater in Google Chrome on Mac prior t=
o 151.0.7922.72 allowed a local attacker to perform OS-level privilege esca= lation via a malicious file. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17864" target=3D= "_blank" rel=3D"noopener">CVE-2026-17864</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Crypto in Google Chrome on Mac prior to=
151.0.7922.72 allowed a remote attacker who had compromised the renderer p= rocess to potentially perform a sandbox escape via a crafted HTML page. (Ch= romium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17865" target=3D= "_blank" rel=3D"noopener">CVE-2026-17865</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Type Confusion in Tab in Google Chrome on Android prior to 151.0.7922.7=
2 allowed a remote attacker who had compromised the renderer process to pot= entially perform a sandbox escape via a crafted HTML page. (Chromium securi=
ty severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17866" target=3D= "_blank" rel=3D"noopener">CVE-2026-17866</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Dawn in Google Chrome pri=
or to 151.0.7922.72 allowed a remote attacker to potentially perform a sand= box escape via a crafted HTML page. (Chromium security severity: Medium)</t=

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17867" target=3D= "_blank" rel=3D"noopener">CVE-2026-17867</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in USB in Google Chrome prior to 151.0.= 7922.72 allowed a remote attacker to perform privilege escalation via a cra= fted HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17868" target=3D= "_blank" rel=3D"noopener">CVE-2026-17868</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read in WebXR in Google Chrome prior to 151.0.7922.72 all= owed a remote attacker to perform an out of bounds memory read via a crafte=
d HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17869" target=3D= "_blank" rel=3D"noopener">CVE-2026-17869</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Cast in Google Chrome pri=
or to 151.0.7922.72 allowed an attacker on the local network segment to lea=
k cross-origin data via malicious network traffic. (Chromium security sever= ity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17870" target=3D= "_blank" rel=3D"noopener">CVE-2026-17870</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Passwords in Google Chrome prior to 151= .0.7922.72 allowed a remote attacker who convinced a user to engage in spec= ific UI gestures to leak cross-origin data via a crafted HTML page. (Chromi=
um security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17871" target=3D= "_blank" rel=3D"noopener">CVE-2026-17871</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Cryptographic Flaw in WebAppInstalls in Google Chrome on Android prior =
to 151.0.7922.72 allowed a local attacker to potentially perform a sandbox = escape via a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17872" target=3D= "_blank" rel=3D"noopener">CVE-2026-17872</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Chrome for iOS in Google Chrome on i=
OS prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary=
access control via a crafted HTML page. (Chromium security severity: Mediu= m)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17873" target=3D= "_blank" rel=3D"noopener">CVE-2026-17873</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via=
a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17874" target=3D= "_blank" rel=3D"noopener">CVE-2026-17874</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowe=
d a remote attacker to execute arbitrary code inside a sandbox via a crafte=
d PDF file. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17875" target=3D= "_blank" rel=3D"noopener">CVE-2026-17875</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Payments in Google Chrome prior to 151.= 0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted=
HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17876" target=3D= "_blank" rel=3D"noopener">CVE-2026-17876</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chromoting in Google Chrome on Linux pr= ior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege=
escalation via malicious network traffic. (Chromium security severity: Med= ium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17877" target=3D= "_blank" rel=3D"noopener">CVE-2026-17877</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in CSS in Google Chrome prior to 151.0.792= 2.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) v=
ia a crafted HTML page. (Chromium security severity: Medium)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17878" target=3D= "_blank" rel=3D"noopener">CVE-2026-17878</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Autofill in Google Chrome prior to 151.= 0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted=
HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17879" target=3D= "_blank" rel=3D"noopener">CVE-2026-17879</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Autofill in Google Chrome prior to 151.= 0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted=
HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17880" target=3D= "_blank" rel=3D"noopener">CVE-2026-17880</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Integer overflow in WebXR in Google Chrome prior to 151.0.7922.72 allow=
ed a remote attacker to execute arbitrary code inside a sandbox via a craft=
ed HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17881" target=3D= "_blank" rel=3D"noopener">CVE-2026-17881</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Policy bypass in Extensions in Google Chrome prior to 151.0.7922.72 all= owed an attacker who convinced a user to install a malicious extension to b= ypass site isolation via a crafted Chrome Extension. (Chromium security sev= erity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17882" target=3D= "_blank" rel=3D"noopener">CVE-2026-17882</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Headless in Google Chrome prior to 151.= 0.7922.72 allowed a remote attacker to bypass same origin policy via a craf= ted HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17883" target=3D= "_blank" rel=3D"noopener">CVE-2026-17883</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Object lifecycle issue in WebRTC in Google Chrome prior to 151.0.7922.7=
2 allowed a remote attacker to potentially exploit heap corruption via a cr= afted HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17884" target=3D= "_blank" rel=3D"noopener">CVE-2026-17884</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Paint in Google Chrome prior to 151.0.7= 922.72 allowed a remote attacker to leak cross-origin data via a crafted HT=
ML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17885" target=3D= "_blank" rel=3D"noopener">CVE-2026-17885</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Enterprise in Google Chrome prior to 151.0.7922.72 al= lowed a remote attacker to potentially exploit heap corruption via a crafte=
d HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17886" target=3D= "_blank" rel=3D"noopener">CVE-2026-17886</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in TabStrip in Google Chrome prior to 151.0.7922.72 allo= wed a remote attacker who convinced a user to engage in specific UI gesture=
s to potentially exploit heap corruption via a crafted HTML page. (Chromium=
security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17887" target=3D= "_blank" rel=3D"noopener">CVE-2026-17887</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in WebUI in Google Chrome pr= ior to 151.0.7922.72 allowed a remote attacker to potentially perform a san= dbox escape via malicious network traffic. (Chromium security severity: Med= ium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17888" target=3D= "_blank" rel=3D"noopener">CVE-2026-17888</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in WebXR in Google Chrome prior to 151.0.7922.72 allo= wed a remote attacker to leak cross-origin data via a crafted HTML page. (C= hromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17889" target=3D= "_blank" rel=3D"noopener">CVE-2026-17889</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in DevTools in Google Chrome=
prior to 151.0.7922.72 allowed a remote attacker who had compromised the r= enderer process to potentially perform a sandbox escape via a crafted HTML = page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17890" target=3D= "_blank" rel=3D"noopener">CVE-2026-17890</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in ANGLE in Google Chrome on Android prior to 151.0.7922= .72 allowed a remote attacker who had compromised the renderer process to p= otentially perform a sandbox escape via a crafted HTML page. (Chromium secu= rity severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17891" target=3D= "_blank" rel=3D"noopener">CVE-2026-17891</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7= 922.72 allowed a remote attacker to obtain potentially sensitive informatio=
n from process memory via a crafted HTML page. (Chromium security severity:=
Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17892" target=3D= "_blank" rel=3D"noopener">CVE-2026-17892</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Updater in Google Chrome =
on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised=
the renderer process to potentially perform a sandbox escape via a crafted=
HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17893" target=3D= "_blank" rel=3D"noopener">CVE-2026-17893</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Views in Google Chrome on Linux prior to 151.0.7922.7=
2 allowed a remote attacker to potentially exploit heap corruption via a cr= afted HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17894" target=3D= "_blank" rel=3D"noopener">CVE-2026-17894</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in DataTransfer in Google Chrome prior to = 151.0.7922.72 allowed a remote attacker who convinced a user to engage in s= pecific UI gestures to leak cross-origin data via a crafted HTML page. (Chr= omium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17895" target=3D= "_blank" rel=3D"noopener">CVE-2026-17895</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allo= wed a remote attacker to execute arbitrary code inside a sandbox via a craf= ted HTML page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17896" target=3D= "_blank" rel=3D"noopener">CVE-2026-17896</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in ORB in Google Chrome prior to 151.0.792= 2.72 allowed a remote attacker to leak cross-origin data via a crafted HTML=
page. (Chromium security severity: Medium)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17897" target=3D= "_blank" rel=3D"noopener">CVE-2026-17897</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allo= wed an attacker who convinced a user to install a malicious extension to ex= ecute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chro= mium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17898" target=3D= "_blank" rel=3D"noopener">CVE-2026-17898</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in DevTools in Google Chrome prior to 1= 51.0.7922.72 allowed an attacker who convinced a user to install a maliciou=
s extension to perform privilege escalation via a crafted Chrome Extension.=
(Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17899" target=3D= "_blank" rel=3D"noopener">CVE-2026-17899</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Enterprise in Google Chrome on Windows = prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data = via a malicious file. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17900" target=3D= "_blank" rel=3D"noopener">CVE-2026-17900</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Sharing in Google Chrome =
on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navig= ation restrictions via malicious network traffic. (Chromium security severi= ty: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17901" target=3D= "_blank" rel=3D"noopener">CVE-2026-17901</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Editing in Google Chrome on Linux prior=
to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a=
crafted HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17902" target=3D= "_blank" rel=3D"noopener">CVE-2026-17902</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Chromecast in Google Chrome prior to=
151.0.7922.72 allowed an attacker on the local network segment to inject s= cripts or HTML into a privileged page via malicious network traffic. (Chrom= ium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17903" target=3D= "_blank" rel=3D"noopener">CVE-2026-17903</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in NFC in Google Chrome on Android prio=
r to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via =
a crafted HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17904" target=3D= "_blank" rel=3D"noopener">CVE-2026-17904</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in SurfaceCapture in Google Chrome prior t=
o 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a c= rafted HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17905" target=3D= "_blank" rel=3D"noopener">CVE-2026-17905</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Bluetooth in Google Chrom=
e prior to 151.0.7922.72 allowed a remote attacker who had compromised the = renderer process to potentially perform a sandbox escape via a crafted HTML=
page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17906" target=3D= "_blank" rel=3D"noopener">CVE-2026-17906</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Side-channel information leakage in Network in Google Chrome prior to 1= 51.0.7922.72 allowed a remote attacker to leak cross-origin data via a craf= ted HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17907" target=3D= "_blank" rel=3D"noopener">CVE-2026-17907</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Printing in Google Chrome=
on Windows prior to 151.0.7922.72 allowed a remote attacker who had compro= mised the renderer process to potentially perform a sandbox escape via a cr= afted HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17908" target=3D= "_blank" rel=3D"noopener">CVE-2026-17908</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Isolated Web Apps in Goog=
le Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-or= igin data via malicious network traffic. (Chromium security severity: Low)<=

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17909" target=3D= "_blank" rel=3D"noopener">CVE-2026-17909</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in NFC in Google Chrome on Android prio=
r to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via =
a crafted HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17910" target=3D= "_blank" rel=3D"noopener">CVE-2026-17910</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in SVG in Google Chrome prior to 151.0.= 7922.72 allowed a remote attacker to leak cross-origin data via a crafted H= TML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17911" target=3D= "_blank" rel=3D"noopener">CVE-2026-17911</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restr= ictions via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17912" target=3D= "_blank" rel=3D"noopener">CVE-2026-17912</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via=
a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17913" target=3D= "_blank" rel=3D"noopener">CVE-2026-17913</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Side-channel information leakage in Skia in Google Chrome prior to 151.= 0.7922.72 allowed a remote attacker to obtain potentially sensitive informa= tion from process memory via a crafted HTML page. (Chromium security severi= ty: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17914" target=3D= "_blank" rel=3D"noopener">CVE-2026-17914</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in WebView in Google Chrome on Android pri=
or to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a = crafted HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17915" target=3D= "_blank" rel=3D"noopener">CVE-2026-17915</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Settings in Google Chrome prior to 1= 51.0.7922.72 allowed a remote attacker who had compromised the renderer pro= cess to perform privilege escalation via a crafted HTML page. (Chromium sec= urity severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17916" target=3D= "_blank" rel=3D"noopener">CVE-2026-17916</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Chrome for iOS in Google Chrome on i=
OS prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary=
access control via a crafted HTML page. (Chromium security severity: Low)<=

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17917" target=3D= "_blank" rel=3D"noopener">CVE-2026-17917</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Sync in Google Chrome prior to 151.0.7922.72 allowed =
a remote attacker to execute arbitrary code inside a sandbox via a crafted = HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17918" target=3D= "_blank" rel=3D"noopener">CVE-2026-17918</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Enterprise in Google Chrome on Mac p= rior to 151.0.7922.72 allowed a local attacker to perform privilege escalat= ion via physical access to the device. (Chromium security severity: Low)</t=

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17919" target=3D= "_blank" rel=3D"noopener">CVE-2026-17919</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed an=
attacker who convinced a user to install a malicious extension to execute = arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium s= ecurity severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17920" target=3D= "_blank" rel=3D"noopener">CVE-2026-17920</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Navigation in Google Chro=
me prior to 151.0.7922.72 allowed a remote attacker who had compromised the=
renderer process to bypass navigation restrictions via a crafted HTML page=
. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17921" target=3D= "_blank" rel=3D"noopener">CVE-2026-17921</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Enterprise in Google Chrome prior to 15= 1.0.7922.72 allowed a remote attacker to execute arbitrary code via a craft=
ed HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17922" target=3D= "_blank" rel=3D"noopener">CVE-2026-17922</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Policy bypass in Enterprise in Google Chrome prior to 151.0.7922.72 all= owed a remote attacker to bypass navigation restrictions via a crafted doma=
in name. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17923" target=3D= "_blank" rel=3D"noopener">CVE-2026-17923</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in DNS in Google Chrome prior to 151.0.7922.72 allowed a=
remote attacker who had compromised the renderer process to potentially pe= rform a sandbox escape via a crafted HTML page. (Chromium security severity=
: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17924" target=3D= "_blank" rel=3D"noopener">CVE-2026-17924</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Cast in Google Chrome on Android prior =
to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via=
a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17925" target=3D= "_blank" rel=3D"noopener">CVE-2026-17925</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in DevTools in Google Chrome=
prior to 151.0.7922.72 allowed a remote attacker who convinced a user to e= ngage in specific UI gestures to bypass navigation restrictions via a craft=
ed HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17926" target=3D= "_blank" rel=3D"noopener">CVE-2026-17926</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in DevTools in Google Chrome prior to 1= 51.0.7922.72 allowed an attacker who convinced a user to install a maliciou=
s extension to leak cross-origin data via a crafted Chrome Extension. (Chro= mium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17927" target=3D= "_blank" rel=3D"noopener">CVE-2026-17927</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in DataTransfer in Google Chrome prior to = 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a cra= fted HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17928" target=3D= "_blank" rel=3D"noopener">CVE-2026-17928</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in DevTools in Google Chrome=
prior to 151.0.7922.72 allowed a remote attacker to bypass navigation rest= rictions via a malicious file. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17929" target=3D= "_blank" rel=3D"noopener">CVE-2026-17929</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Extensions in Google Chro=
me prior to 151.0.7922.72 allowed a remote attacker who had compromised the=
renderer process to perform privilege escalation via a crafted HTML page. = (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17930" target=3D= "_blank" rel=3D"noopener">CVE-2026-17930</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in DevTools in Google Chrome prior to 151.= 0.7922.72 allowed a remote attacker to bypass navigation restrictions via a=
crafted HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17931" target=3D= "_blank" rel=3D"noopener">CVE-2026-17931</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in DataTransfer in Google Chrome on Windows prior to 151= .0.7922.72 allowed a local attacker to obtain potentially sensitive informa= tion from process memory via a crafted HTML page. (Chromium security severi= ty: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17932" target=3D= "_blank" rel=3D"noopener">CVE-2026-17932</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in DOMStorage in Google Chrome prior to 15= 1.0.7922.72 allowed a remote attacker to leak cross-origin data via a craft=
ed HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17933" target=3D= "_blank" rel=3D"noopener">CVE-2026-17933</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in DevTools in Google Chrome=
prior to 151.0.7922.72 allowed a remote attacker to bypass navigation rest= rictions via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17934" target=3D= "_blank" rel=3D"noopener">CVE-2026-17934</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Heap buffer overflow in Codecs in Google Chrome prior to 151.0.7922.72 = allowed a remote attacker to execute arbitrary code inside a sandbox via a = crafted HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17935" target=3D= "_blank" rel=3D"noopener">CVE-2026-17935</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in DevTools in Google Chrome prior to 151.= 0.7922.72 allowed a remote attacker who convinced a user to engage in speci= fic UI gestures to bypass navigation restrictions via a crafted HTML page. = (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17936" target=3D= "_blank" rel=3D"noopener">CVE-2026-17936</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in DevTools in Google Chrome=
prior to 151.0.7922.72 allowed a remote attacker to bypass navigation rest= rictions via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17937" target=3D= "_blank" rel=3D"noopener">CVE-2026-17937</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in FullScreen in Google Chrome on Android = prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via=
a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17938" target=3D= "_blank" rel=3D"noopener">CVE-2026-17938</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Passwords in Google Chrom=
e prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing v=
ia malicious network traffic. (Chromium security severity: Low)</td>

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17939" target=3D= "_blank" rel=3D"noopener">CVE-2026-17939</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Picture-in-Picture in Goo= gle Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who = had compromised the renderer process to potentially perform a sandbox escap=
e via a crafted HTML page. (Chromium security severity: Low)</td>

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17940" target=3D= "_blank" rel=3D"noopener">CVE-2026-17940</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 151.0.7922.72 allowed a remote attacker to spoof the contents of t=
he Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: = Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17941" target=3D= "_blank" rel=3D"noopener">CVE-2026-17941</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Side-channel information leakage in SVG in Google Chrome prior to 151.0= .7922.72 allowed a remote attacker to leak cross-origin data via a crafted = HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17942" target=3D= "_blank" rel=3D"noopener">CVE-2026-17942</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Parser in Google Chrome prior to 151.0.= 7922.72 allowed a remote attacker to bypass content security policy via a c= rafted HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17943" target=3D= "_blank" rel=3D"noopener">CVE-2026-17943</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restr= ictions via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17944" target=3D= "_blank" rel=3D"noopener">CVE-2026-17944</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Navigation in Google Chro=
me prior to 151.0.7922.72 allowed a remote attacker who had compromised the=
renderer process to perform UI spoofing via a crafted HTML page. (Chromium=
security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17945" target=3D= "_blank" rel=3D"noopener">CVE-2026-17945</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allow=
ed a remote attacker who had compromised the renderer process to obtain pot= entially sensitive information from process memory via a crafted HTML page.=
(Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17946" target=3D= "_blank" rel=3D"noopener">CVE-2026-17946</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in WebSockets in Google Chrome prior to 151.0.7922.72 al= lowed a remote attacker to potentially perform a sandbox escape via a craft=
ed HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17947" target=3D= "_blank" rel=3D"noopener">CVE-2026-17947</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed an=
attacker who convinced a user to install a malicious extension to execute = arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium s= ecurity severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17948" target=3D= "_blank" rel=3D"noopener">CVE-2026-17948</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.792= 2.72 allowed a remote attacker to leak cross-origin data via a crafted HTML=
page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17949" target=3D= "_blank" rel=3D"noopener">CVE-2026-17949</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Safebrowsing in Google Chrome on Mac pr= ior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code vi=
a a malicious file. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17950" target=3D= "_blank" rel=3D"noopener">CVE-2026-17950</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Heap buffer overflow in WebRTC in Google Chrome prior to 151.0.7922.72 = allowed a remote attacker to perform an out of bounds memory read via a cra= fted HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17951" target=3D= "_blank" rel=3D"noopener">CVE-2026-17951</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922= .72 allowed an attacker who convinced a user to install a malicious extensi=
on to execute arbitrary code inside a sandbox via a crafted Chrome Extensio=
n. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17952" target=3D= "_blank" rel=3D"noopener">CVE-2026-17952</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in WebView in Google Chrome on Android = prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restr= ictions via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17953" target=3D= "_blank" rel=3D"noopener">CVE-2026-17953</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Policy bypass in MHTML in Google Chrome prior to 151.0.7922.72 allowed =
a remote attacker to leak cross-origin data via a crafted MHTML page. (Chro= mium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17954" target=3D= "_blank" rel=3D"noopener">CVE-2026-17954</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Payments in Google Chrome=
prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing vi=
a a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17955" target=3D= "_blank" rel=3D"noopener">CVE-2026-17955</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Scheduling in Google Chrome prior to 15= 1.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sa= ndbox via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17956" target=3D= "_blank" rel=3D"noopener">CVE-2026-17956</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in CORS in Google Chrome prior to 151.0.79= 22.72 allowed a remote attacker who had compromised the renderer process to=
leak cross-origin data via a crafted HTML page. (Chromium security severit=
y: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17957" target=3D= "_blank" rel=3D"noopener">CVE-2026-17957</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Views in Google Chrome prior to 151.0.7= 922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML = page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17958" target=3D= "_blank" rel=3D"noopener">CVE-2026-17958</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Network in Google Chrome prior to 151.0= .7922.72 allowed a remote attacker to leak cross-origin data via a crafted = HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17959" target=3D= "_blank" rel=3D"noopener">CVE-2026-17959</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Chrome for iOS in Google Chrome on i=
OS prior to 151.0.7922.72 allowed a remote attacker to bypass no-referrer p= olicy via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17960" target=3D= "_blank" rel=3D"noopener">CVE-2026-17960</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Session in Google Chrome on Android pri=
or to 151.0.7922.72 allowed a remote attacker to bypass navigation restrict= ions via a crafted HTML page. (Chromium security severity: Low)</td>

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17961" target=3D= "_blank" rel=3D"noopener">CVE-2026-17961</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Blink in Google Chrome prior to 151.0.7= 922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS)=
via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17962" target=3D= "_blank" rel=3D"noopener">CVE-2026-17962</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in SVG in Google Chrome prior to 151.0.792= 2.72 allowed a remote attacker to leak cross-origin data via a crafted HTML=
page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17963" target=3D= "_blank" rel=3D"noopener">CVE-2026-17963</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in UI in Google Chrome on Android prior to 151.0.= 7922.72 allowed a remote attacker to perform domain spoofing via a crafted = HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17964" target=3D= "_blank" rel=3D"noopener">CVE-2026-17964</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior t=
o 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a craf= ted HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17965" target=3D= "_blank" rel=3D"noopener">CVE-2026-17965</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Views in Google Chrome on Mac prior to = 151.0.7922.72 allowed a local attacker to obtain potentially sensitive info= rmation from process memory via a crafted HTML page. (Chromium security sev= erity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17966" target=3D= "_blank" rel=3D"noopener">CVE-2026-17966</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Chrome for iOS in Google Chrome on iOS prior to 151.0= .7922.72 allowed a remote attacker to potentially exploit heap corruption v=
ia a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17967" target=3D= "_blank" rel=3D"noopener">CVE-2026-17967</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in WebXR in Google Chrome on Android prior to 151.0.7= 922.72 allowed a remote attacker to obtain potentially sensitive informatio=
n from process memory via a crafted HTML page. (Chromium security severity:=
Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17968" target=3D= "_blank" rel=3D"noopener">CVE-2026-17968</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Passwords in Google Chrome prior to 151= .0.7922.72 allowed a remote attacker to execute arbitrary code inside a san= dbox via a crafted HTML page. (Chromium security severity: Low)</td>

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17969" target=3D= "_blank" rel=3D"noopener">CVE-2026-17969</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Passwords in Google Chrom=
e prior to 151.0.7922.72 allowed an attacker in a privileged network positi=
on to perform UI spoofing via malicious network traffic. (Chromium security=
severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17970" target=3D= "_blank" rel=3D"noopener">CVE-2026-17970</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Frame in Google Chrome prior to 151.0.7= 922.72 allowed a remote attacker to potentially perform out of bounds memor=
y access via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17971" target=3D= "_blank" rel=3D"noopener">CVE-2026-17971</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via=
a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17972" target=3D= "_blank" rel=3D"noopener">CVE-2026-17972</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Views in Google Chrome on Mac prior to = 151.0.7922.72 allowed a local attacker to obtain potentially sensitive info= rmation from process memory via a crafted HTML page. (Chromium security sev= erity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17973" target=3D= "_blank" rel=3D"noopener">CVE-2026-17973</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in DevTools in Google Chrome prior to 1= 51.0.7922.72 allowed a local attacker to bypass navigation restrictions via=
a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17974" target=3D= "_blank" rel=3D"noopener">CVE-2026-17974</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in IME in Google Chrome on Mac prior to 15= 1.0.7922.72 allowed a remote attacker to obtain potentially sensitive infor= mation from process memory via a crafted HTML page. (Chromium security seve= rity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17975" target=3D= "_blank" rel=3D"noopener">CVE-2026-17975</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Extensions in Google Chrome prior to=
151.0.7922.72 allowed an attacker who convinced a user to install a malici= ous extension to bypass discretionary access control via a crafted domain n= ame. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17976" target=3D= "_blank" rel=3D"noopener">CVE-2026-17976</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Policy bypass in CSS in Google Chrome prior to 151.0.7922.72 allowed a = remote attacker to leak cross-origin data via a crafted HTML page. (Chromiu=
m security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17977" target=3D= "_blank" rel=3D"noopener">CVE-2026-17977</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Side-channel information leakage in WebCodecs in Google Chrome prior to=
151.0.7922.72 allowed a remote attacker to obtain potentially sensitive in= formation from process memory via a crafted HTML page. (Chromium security s= everity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17978" target=3D= "_blank" rel=3D"noopener">CVE-2026-17978</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Race in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote att= acker to execute arbitrary code inside a sandbox via a crafted HTML page. (= Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17979" target=3D= "_blank" rel=3D"noopener">CVE-2026-17979</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in UI in Google Chrome on Android prior to=
151.0.7922.72 allowed a remote attacker who convinced a user to engage in = specific UI gestures to leak cross-origin data via a crafted HTML page. (Ch= romium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17980" target=3D= "_blank" rel=3D"noopener">CVE-2026-17980</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Blink in Google Chrome prior to 151.0.7= 922.72 allowed a remote attacker to leak cross-origin data via a crafted HT=
ML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17981" target=3D= "_blank" rel=3D"noopener">CVE-2026-17981</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Cast in Google Chrome pri=
or to 151.0.7922.72 allowed a remote attacker to bypass same origin policy = via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17982" target=3D= "_blank" rel=3D"noopener">CVE-2026-17982</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Global Media Controls in Google Chrome = prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via=
a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17983" target=3D= "_blank" rel=3D"noopener">CVE-2026-17983</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Browser in Google Chrome on Android pri=
or to 151.0.7922.72 allowed a local attacker to leak cross-origin data via =
a crafted HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17984" target=3D= "_blank" rel=3D"noopener">CVE-2026-17984</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Speech in Google Chrome prior to 151= .0.7922.72 allowed a remote attacker to bypass site isolation via a crafted=
HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17985" target=3D= "_blank" rel=3D"noopener">CVE-2026-17985</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Bluetooth in Google Chrome prior to = 151.0.7922.72 allowed a remote attacker who had compromised the renderer pr= ocess to bypass same origin policy via a crafted HTML page. (Chromium secur= ity severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17986" target=3D= "_blank" rel=3D"noopener">CVE-2026-17986</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Notifications in Google C= hrome prior to 151.0.7922.72 allowed a remote attacker who had compromised = the renderer process to potentially perform a sandbox escape via a crafted = PDF file. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17987" target=3D= "_blank" rel=3D"noopener">CVE-2026-17987</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Navigation in Google Chro=
me prior to 151.0.7922.72 allowed a remote attacker who had compromised the=
renderer process to bypass navigation restrictions via a crafted HTML page=
. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17988" target=3D= "_blank" rel=3D"noopener">CVE-2026-17988</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a = remote attacker to execute arbitrary code inside a sandbox via a crafted HT=
ML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17989" target=3D= "_blank" rel=3D"noopener">CVE-2026-17989</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in WebAuthn in Google Chrome=
prior to 151.0.7922.72 allowed a remote attacker who had compromised the r= enderer process to potentially perform a sandbox escape via a crafted PDF f= ile. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17990" target=3D= "_blank" rel=3D"noopener">CVE-2026-17990</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in AI in Google Chrome prior=
to 151.0.7922.72 allowed a remote attacker who had compromised the rendere=
r process to potentially perform a sandbox escape via a crafted HTML page. = (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17991" target=3D= "_blank" rel=3D"noopener">CVE-2026-17991</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Uninitialized Use in Skia in Google Chrome on Windows prior to 151.0.79= 22.72 allowed a remote attacker to obtain potentially sensitive information=
from process memory via a crafted HTML page. (Chromium security severity: = Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17992" target=3D= "_blank" rel=3D"noopener">CVE-2026-17992</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Race in Updater in Google Chrome on Windows prior to 151.0.7922.72 allo= wed a local attacker to perform privilege escalation via a malicious file. = (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17993" target=3D= "_blank" rel=3D"noopener">CVE-2026-17993</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Media in Google Chrome on Android prior=
to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictio=
ns via a crafted HTML page. (Chromium security severity: Low)</td>

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17994" target=3D= "_blank" rel=3D"noopener">CVE-2026-17994</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Out of bounds read in Dawn in Google Chrome prior to 151.0.7922.72 allo= wed a remote attacker to perform an out of bounds memory read via a crafted=
HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17995" target=3D= "_blank" rel=3D"noopener">CVE-2026-17995</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Browser in Google Chrome on Mac prior t=
o 151.0.7922.72 allowed a local attacker to bypass navigation restrictions = via a malicious file. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17996" target=3D= "_blank" rel=3D"noopener">CVE-2026-17996</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Passwords in Google Chrome prior to 151= .0.7922.72 allowed a remote attacker who had compromised the renderer proce=
ss to leak cross-origin data via a crafted HTML page. (Chromium security se= verity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17997" target=3D= "_blank" rel=3D"noopener">CVE-2026-17997</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Incorrect security UI in Extensions in Google Chrome prior to 151.0.792= 2.72 allowed an attacker who convinced a user to install a malicious extens= ion to perform UI spoofing via a crafted Chrome Extension. (Chromium securi=
ty severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17998" target=3D= "_blank" rel=3D"noopener">CVE-2026-17998</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Race in PictureInPicture in Google Chrome on Android prior to 151.0.792= 2.72 allowed a remote attacker to perform domain spoofing via a crafted HTM=
L page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17999" target=3D= "_blank" rel=3D"noopener">CVE-2026-17999</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in USB in Google Chrome on Android prio=
r to 151.0.7922.72 allowed a remote attacker who had compromised the render=
er process to leak cross-origin data via a crafted HTML page. (Chromium sec= urity severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18000" target=3D= "_blank" rel=3D"noopener">CVE-2026-18000</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in WebGL in Google Chrome prior to 151.0.7= 922.72 allowed a remote attacker to obtain potentially sensitive informatio=
n from process memory via a crafted HTML page. (Chromium security severity:=
Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18001" target=3D= "_blank" rel=3D"noopener">CVE-2026-18001</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Google Lens in Google Chr= ome prior to 151.0.7922.72 allowed a remote attacker who had compromised th=
e renderer process to potentially perform a sandbox escape via a crafted HT=
ML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18002" target=3D= "_blank" rel=3D"noopener">CVE-2026-18002</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via=
a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18003" target=3D= "_blank" rel=3D"noopener">CVE-2026-18003</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Speech in Google Chrome prior to 151= .0.7922.72 allowed a remote attacker who had compromised the renderer proce=
ss to leak cross-origin data via a crafted HTML page. (Chromium security se= verity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18004" target=3D= "_blank" rel=3D"noopener">CVE-2026-18004</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7= 922.72 allowed a remote attacker to obtain potentially sensitive informatio=
n from process memory via a crafted HTML page. (Chromium security severity:=
Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18005" target=3D= "_blank" rel=3D"noopener">CVE-2026-18005</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Google Lens in Google Chrome prior to 1= 51.0.7922.72 allowed a remote attacker who had compromised the renderer pro= cess to perform UI spoofing via a crafted HTML page. (Chromium security sev= erity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18006" target=3D= "_blank" rel=3D"noopener">CVE-2026-18006</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Input in Google Chrome on Android prior=
to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a cr= afted HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18007" target=3D= "_blank" rel=3D"noopener">CVE-2026-18007</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Settings in Google Chrome prior to 151.= 0.7922.72 allowed a remote attacker to perform UI spoofing via malicious ne= twork traffic. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18008" target=3D= "_blank" rel=3D"noopener">CVE-2026-18008</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in Passwords in Google Chrom=
e prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing v=
ia malicious network traffic. (Chromium security severity: Low)</td>

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18009" target=3D= "_blank" rel=3D"noopener">CVE-2026-18009</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Passwords in Google Chrome prior to 151= .0.7922.72 allowed a remote attacker to perform UI spoofing via malicious n= etwork traffic. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18010" target=3D= "_blank" rel=3D"noopener">CVE-2026-18010</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensi= tive information from process memory via physical access to the device. (Ch= romium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18011" target=3D= "_blank" rel=3D"noopener">CVE-2026-18011</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowe=
d a remote attacker to execute arbitrary code inside a sandbox via a crafte=
d PDF file. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18012" target=3D= "_blank" rel=3D"noopener">CVE-2026-18012</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Chrome for iOS in Google Chrome on iOS = prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via=
a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18013" target=3D= "_blank" rel=3D"noopener">CVE-2026-18013</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient validation of untrusted input in DevTools in Google Chrome=
prior to 151.0.7922.72 allowed a remote attacker to bypass navigation rest= rictions via a malicious file. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18014" target=3D= "_blank" rel=3D"noopener">CVE-2026-18014</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Tint in Google Chrome on Mac prior to 1= 51.0.7922.72 allowed a remote attacker to potentially perform a sandbox esc= ape via a crafted HTML page. (Chromium security severity: Low)</td>

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18015" target=3D= "_blank" rel=3D"noopener">CVE-2026-18015</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Insufficient policy enforcement in Chrome for iOS in Google Chrome on i=
OS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing = via a crafted HTML page. (Chromium security severity: Low)</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18016" target=3D= "_blank" rel=3D"noopener">CVE-2026-18016</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed =
a remote attacker to execute arbitrary code inside a sandbox via a crafted = HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18017" target=3D= "_blank" rel=3D"noopener">CVE-2026-18017</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Inappropriate implementation in Updater in Google Chrome on Windows pri=
or to 151.0.7922.72 allowed a local attacker to perform UI spoofing via a m= alicious file. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18018" target=3D= "_blank" rel=3D"noopener">CVE-2026-18018</a></td>
</tr>

<td class=3D"vendor-product">Google--Chrome</td>
<td>Side-channel information leakage in Media in Google Chrome prior to 151= .0.7922.72 allowed a remote attacker to leak cross-origin data via a crafte=
d HTML page. (Chromium security severity: Low)</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18019" target=3D= "_blank" rel=3D"noopener">CVE-2026-18019</a></td>
</tr>

<td class=3D"vendor-product">Google--Google-ADK</td>
<td>A vulnerability in the Agent Development Kit (ADK) allows for continuat= ion forgery in tool confirmations. An attacker who is able to manipulate or=
inject events into the session history can execute unauthorized tools by f= orging a tool confirmation response. This is possible because the framework=
did not verify if the target tool was registered to the executing agent, d=
id not validate if the tool actually required confirmation, and did not mat=
ch the confirmation arguments against the original tool call event in the h= istory.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18236" target=3D= "_blank" rel=3D"noopener">CVE-2026-18236</a></td>
</tr>

<td class=3D"vendor-product">Google--MCP Toolbox for Databases (googleapis/= mcp-toolbox)</td>
<td>A Server-Side Request Forgery (SSRF) and credential exfiltration vulner= ability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/m= cp-toolbox. The tool takes an unvalidated pageURL parameter from the client=
and issues an HTTP GET request to it using an authenticated client. The un= derlying transport automatically attaches an Authorization: Bearer header t=
o every outbound request regardless of the destination host. An attacker ca=
n supply an arbitrary external URL to the pageURL parameter (either directl=
y via the tool execution payload or implicitly via data-driven pagination t= racking loops), leading Toolbox into sending its OAuth/service-account acce=
ss token to an attacker-controlled listener. Depending on the configuration=
, this leaks either the end-user's token or the broader service-account acc= ess token (ADC), potentially exposing Protected Health Information (PHI) an=
d secondary Google Cloud Platform services.</td>

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16481" target=3D= "_blank" rel=3D"noopener">CVE-2026-16481</a></td>
</tr>

<td class=3D"vendor-product">Google--mcp-toolbox</td>
<td>Incorrect Authorization in the direct HTTP API tool invocation endpoint=
in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated=
attacker to invoke tools protected by the scopeRequired feature via sendin=
g tool invocation requests through legacy HTTP endpoints when the --enable-= api flag is active.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14537" target=3D= "_blank" rel=3D"noopener">CVE-2026-14537</a></td>
</tr>

<td class=3D"vendor-product">Google--mcp-toolbox</td>
<td>An improper authorization and security-boundary bypass vulnerability in=
the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.1= 6.1 through 1.4.0 allows an authenticated attacker to bypass allowedDataset=
s validation checks. The toolbox relies on the BigQuery dry-run API to enfo= rce dataset restrictions, but due to a fail-open logic flaw, it bypasses va= lidation when the API returns an empty array for specialized constructs. Th=
is allows the attacker to extract structural DDL schemas for explicitly exc= luded datasets via INFORMATION_SCHEMA, and access downstream federated row = data via EXTERNAL_QUERY connections.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14538" target=3D= "_blank" rel=3D"noopener">CVE-2026-14538</a></td>
</tr>

<td class=3D"vendor-product">Google--mcp-toolbox</td>
<td>An allocation of resources without limits vulnerability in the HTTP han= dler component of Google mcp-toolbox versions up to and including 1.4.0 all= ows an unauthenticated attacker to cause a denial of service (DoS). The /mc=
p endpoint handler reads incoming payloads directly into system memory usin=
g an unrestricted buffer loop (io.ReadAll) without applying defensive const= raints such as http.MaxBytesReader or pre-read Content-Length enforcement. =
By submitting a single, massive HTTP request body, an attacker can linearly=
consume available host memory until the runtime process is terminated by a=
n Out-Of-Memory (OOM) error.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14539" target=3D= "_blank" rel=3D"noopener">CVE-2026-14539</a></td>
</tr>

<td class=3D"vendor-product">Google--mcp-toolbox</td>
<td>A Server-Side Request Forgery (SSRF) vulnerability exists in the generi=
c HTTP source and tool components of Google mcp-toolbox versions 0.3.0 thro= ugh 1.4.0. While the toolbox implements baseline input sanitization for use= r-controlled parameters, the underlying HTTP client (internal/sources/http/= http.go) fails to safely regulate request redirection boundaries. Specifica= lly, the client is initialized without a restrictive CheckRedirect policy h= ook and lacks target IP validation. An attacker or a malicious data-driven = prompt can supply a crafted path parameter that triggers an open redirect o=
r a direct destination swap on the target backend, coercing the mcp-toolbox=
into blindly following the redirection and making unauthorized requests to=
internal or arbitrary external endpoints.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14540" target=3D= "_blank" rel=3D"noopener">CVE-2026-14540</a></td>
</tr>

<td class=3D"vendor-product">Google--mcp-toolbox</td>
<td>An authentication bypass and audience confusion vulnerability exists in=
the Google OAuth provider component of Google mcp-toolbox version 1.4.0. W= hen a Google authService is initialized with mcpEnabled: true but lacks an = explicitly defined audience or clientId, the ValidateMCPAuth pipeline for o= paque tokens skips audience validation entirely. As a result, the toolbox w= ill accept any valid Google OAuth access token-even those minted for unrela= ted ecosystem applications-granting unauthorized clients access to protecte=
d tools and data backends.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14541" target=3D= "_blank" rel=3D"noopener">CVE-2026-14541</a></td>
</tr>

<td class=3D"vendor-product">gopacket--gopacket</td>
<td>gopacket provides packet processing capabilities for Go. In version 1.6=
.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go re= ads an attacker-controlled 32-bit community count and AS path member count = and sizes a slice allocation from those counts without bounding them agains=
t the bytes remaining in the datagram, so a 104-byte UDP datagram can drive=
an allocation of up to 16 GiB and cause an unauthenticated remote denial o=
f service. This issue is fixed in version 1.6.1.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54332" target=3D= "_blank" rel=3D"noopener">CVE-2026-54332</a></td>
</tr>

<td class=3D"vendor-product">gopacket--gopacket</td>
<td>gopacket provides packet processing capabilities for Go. In version 1.6=
.0 and earlier, the Diameter AVP decoder computes an AVP data length by sub= tracting a fixed header size from an attacker-controlled AVP Length field, =
so a vendor-flagged AVP whose Length is smaller than the 12-byte header und= erflows the unsigned 32-bit value and drives an unbounded allocation of rou= ghly 4 GiB, and two such messages in succession OOM-kill a collector, causi=
ng an unauthenticated remote denial of service. This issue is fixed in vers= ion 1.6.1.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54345" target=3D= "_blank" rel=3D"noopener">CVE-2026-54345</a></td>
</tr>

<td class=3D"vendor-product">GStreamer--GStreamer</td>
<td>GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution Vul= nerability. This vulnerability allows remote attackers to execute arbitrary=
code on affected installations of GStreamer. Interaction with this library=
is required to exploit this vulnerability but attack vectors may vary depe= nding on the implementation. The specific flaw exists within the parsing of=
UncompressedFrameConfigBox structures. The issue results from the lack of = proper validation of the length of user-supplied data prior to copying it t=
o a fixed-length stack-based buffer. An attacker can leverage this vulnerab= ility to execute code in the context of the current process. Was ZDI-CAN-29= 392.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-5056" target=3D"= _blank" rel=3D"noopener">CVE-2026-5056</a></td>
</tr>

<td class=3D"vendor-product">HackingRepo--dssrf-js</td>
<td>DSSRF is a Node.js library that provides a wide range of utilities and = advanced SSRF defense checks. Prior to 1.0.4, is_url_safe in src/helpers.ts=
strips the @ userinfo delimiter with remove_at_symbol_in_string before new=
URL parses the URL, allowing an attacker-controlled URL to bypass internal= -IP validation and cause a client using the original URL to reach an intern=
al service. This issue is fixed in version 1.0.4.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54722" target=3D= "_blank" rel=3D"noopener">CVE-2026-54722</a></td>
</tr>

<td class=3D"vendor-product">HackingRepo--dssrf-js</td>
<td>DSSRF is a Node.js library that provides a wide range of utilities and = advanced SSRF defense checks. Prior to 1.0.5, is_url_safe can treat localho=
st as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 = yields no address and no dns.lookup fallback occurs, allowing server-side r= equest forgery. This issue is fixed in version 1.0.5.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54729" target=3D= "_blank" rel=3D"noopener">CVE-2026-54729</a></td>
</tr>

<td class=3D"vendor-product">Heimdall Data--Database Proxy</td>
<td>Heimdall Data Database Proxy generateFileContent CRLF Injection Remote = Code Execution Vulnerability. This vulnerability allows remote attackers to=
execute arbitrary code on affected installations of Heimdall Data Database=
Proxy. Authentication is required to exploit this vulnerability. The speci= fic flaw exists within the generateFileContent function. The issue results = from the lack of proper neutralization of CRLF sequences. An attacker can l= everage this vulnerability to execute code in the context of root. Was ZDI-= CAN-29251.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12357" target=3D= "_blank" rel=3D"noopener">CVE-2026-12357</a></td>
</tr>

<td class=3D"vendor-product">Honeywell--S35 Series 3M/5M/8M/PinHole Cameras= </td>
<td>Honeywell S35 Series 3M/5M/8M/PinHole Cameras, all versions prior to an=
d including version HC5.26.1.14.20260207 contains an=C2=A0audit log disclos= ure Vulnerability=C2=A0that could allow an attacker to access audit logs=C2= =A0without authentication, potentially resulting in the disclosure of sensi= tive information. Honeywell recommends updating to the latest available ver= sion (HC5.26.1.16.20260207) once available.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17612" target=3D= "_blank" rel=3D"noopener">CVE-2026-17612</a></td>
</tr>

<td class=3D"vendor-product">huggingface--huggingface/transformers</td>

<td>A vulnerability in huggingface/transformers versions &lt;=3D5.8.0.dev0 = allows an attacker to perform arbitrary file writes via path traversal. The=
issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBa= se` and `ProcessorMixin`, where keys from the `chat_template` dictionary ar=
e used directly as filenames without proper validation. An attacker can exp= loit this by publishing a malicious Hugging Face Hub repository with a craf= ted `tokenizer_config.json` file. When a victim downloads and saves the tok= enizer or processor, the attacker-controlled keys can escape the intended s= ave directory, enabling arbitrary file writes with attacker-controlled cont= ent. This vulnerability affects multiple processors inheriting from `Proces= sorMixin`, including Idefics, Florence, Gemma, Phi, and Qwen-VL.</td> <td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9856" target=3D"= _blank" rel=3D"noopener">CVE-2026-9856</a></td>
</tr>

<td class=3D"vendor-product">HUSKY--HUSKY</td>
<td>The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored sett= ing value against directory traversal before concatenating it into a file i= nclusion path, allowing users with the shop manager capability to cause the=
inclusion and execution of arbitrary local files, which is then triggered =
on every front-end request including for unauthenticated visitors.</td> <td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15244" target=3D= "_blank" rel=3D"noopener">CVE-2026-15244</a></td>
</tr>

<td class=3D"vendor-product">IBM--Langflow OSS</td>
<td>IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access a= nother user's private vector documents by creating their own flow with matc= hing Chroma persist_directory and collection_name values. The attacker rece= ives exact victim content in their workflow output despite having no author= ization to read the victim's flow. Additionally, the attacker can pollute t=
he victim's collection by inserting their own documents into the shared nam= espace.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13444" target=3D= "_blank" rel=3D"noopener">CVE-2026-13444</a></td>
</tr>

<td class=3D"vendor-product">Infor Global--Infor Global HR</td>
<td>An Insecure Direct Object Reference (IDOR) in the Employee Compensation=
View function of Infor Global HR v11.24.10.01.33 allows unauthorized attac= kers to arbitrarily view the compensation information of other employees vi=
a a crafted GET request.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-60931" target=3D= "_blank" rel=3D"noopener">CVE-2025-60931</a></td>
</tr>

<td class=3D"vendor-product">JetEngine--JetEngine</td>
<td>The JetEngine WordPress plugin before 3.8.12 does not escape a post met=
a value before outputting it through one of its shortcodes, allowing users = with the Contributor role and above to perform Stored Cross-Site Scripting = attacks that execute in the context of higher-privileged users such as admi= nistrators.</td>
<td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14864" target=3D= "_blank" rel=3D"noopener">CVE-2026-14864</a></td>
</tr>

<td class=3D"vendor-product">Jinher--Jinher OA C6</td>
<td>Jinher OA C6 contains an XML External Entity (XXE) injection vulnerabil= ity in the /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlH= ttp endpoint. An unauthenticated remote attacker can send a crafted XML pay= load to read arbitrary files from the server via an out-of-band attack.</td=

<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50782" target=3D= "_blank" rel=3D"noopener">CVE-2026-50782</a></td>
</tr>

<td class=3D"vendor-product">Johnson Controls--FM Systems Employee</td>

<td>Unrestricted upload of file with dangerous type vulnerability in Johnso=
n Controls FM Systems Employee allows Using Malicious Files. This issue aff= ects FM Systems Employee: before 2025.3.1.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-21662" target=3D= "_blank" rel=3D"noopener">CVE-2026-21662</a></td>
</tr>

<td class=3D"vendor-product">Johnson Controls--FM Systems Employee</td>

<td>Improper neutralization of input during web page generation ('cross-sit=
e scripting') vulnerability in Johnson Controls FM Systems Employee allows = Stored XSS. This issue affects FM Systems Employee: before 2025.3.1.</td> <td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34495" target=3D= "_blank" rel=3D"noopener">CVE-2026-34495</a></td>
</tr>

<td class=3D"vendor-product">Johnson Controls--FM Systems Employee</td>

<td>Improper neutralization of Script-Related HTML tags in a web page (basi=
c XSS) vulnerability in Johnson Controls FM Systems Employee allows Cross-S= ite Scripting (XSS). This issue affects FM Systems Employee: before 2025.3.= 1.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34497" target=3D= "_blank" rel=3D"noopener">CVE-2026-34497</a></td>
</tr>

<td class=3D"vendor-product">Johnson Controls--XAAP Application</td> <td>Cleartext storage of sensitive information vulnerability in Johnson Con= trols XAAP Application on Android allows an attacker on a jailbroken or oth= erwise compromised device to Retrieve Sensitive Data. This issue affects XA=
AP Application: before 1.53.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-34490" target=3D= "_blank" rel=3D"noopener">CVE-2026-34490</a></td>
</tr>

<td class=3D"vendor-product">joomdle.com--Joomdle component for Joomla</td> <td>Joomla Extension - joomdle.com - Insecure default configuration allows = read/write user account access in Joomdle &lt; 3.1.1 - The default configur= ation of the extension allowed read access and password reset of CMS accoun= ts.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65881" target=3D= "_blank" rel=3D"noopener">CVE-2026-65881</a></td>
</tr>

<td class=3D"vendor-product">joomdle.com--Joomdle component for Joomla</td> <td>Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle=
&lt; 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed=
a reflected XSS vector.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65882" target=3D= "_blank" rel=3D"noopener">CVE-2026-65882</a></td>
</tr>

<td class=3D"vendor-product">joomlacontenteditor.net--Joomla Content Editor=
(JCE) extension for Joomla</td>
<td>Joomla Extension - joomlacontenteditor.net - Creation of hidden files a=
nd unintended file overwrite via rename function in Joomla Content Editor (= JCE) &lt; 2.20.2 - Improper input validation in the file rename functionali=
ty allowed an authenticated user with file management permissions to rename=
files to otherwise invalid names, resulting in the creation of hidden file=
s. The issue also allowed existing files at the destination path to be unin= tentionally replaced.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65891" target=3D= "_blank" rel=3D"noopener">CVE-2026-65891</a></td>
</tr>

<td class=3D"vendor-product">joomshaper.com--SP Page Builder extension for = Joomla</td>
<td>Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP=
Page Builder &lt; 6.7.1 - Improper validation of order parameters in the D= ynamic Content endpoint leads to an SQL injection vector.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65766" target=3D= "_blank" rel=3D"noopener">CVE-2026-65766</a></td>
</tr>

<td class=3D"vendor-product">joomshaper.com--SP Page Builder extension for = Joomla</td>
<td>Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP=
Page Builder &lt; 6.7.1 - Improper validation of catid parameters in the l= oadMoreArticles endpoint leads to an SQL injection vector.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65876" target=3D= "_blank" rel=3D"noopener">CVE-2026-65876</a></td>
</tr>

<td class=3D"vendor-product">joomshaper.com--SP Page Builder extension for = Joomla</td>
<td>Joomla Extension - joomshaper.com - Authenticated SQL injection in SP P= age Builder &lt; 6.7.1 - Improper validation of various parameters in the m= edia manager search and date filters lead to an SQL injection vector.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65877" target=3D= "_blank" rel=3D"noopener">CVE-2026-65877</a></td>
</tr>

<td class=3D"vendor-product">joomshaper.com--SP Page Builder extension for = Joomla</td>
<td>Joomla Extension - joomshaper.com - Authenticated arbitrary file delete=
in SP Page Builder &lt; 6.7.1- Improper path validation and ACL checks lea=
d to a file deletion vector in the media manager.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65878" target=3D= "_blank" rel=3D"noopener">CVE-2026-65878</a></td>
</tr>

<td class=3D"vendor-product">joomshaper.com--SP Page Builder extension for = Joomla</td>
<td>Joomla Extension - joomshaper.com - Unauthenticated mail relay via a ha= rdcoded, product-wide secret in SP Page Builder &lt; 6.7.1 - A hardcoded se= cret allowed attackers to forge the mail from address of forms.</td>

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65879" target=3D= "_blank" rel=3D"noopener">CVE-2026-65879</a></td>
</tr>

<td class=3D"vendor-product">JS Help Desk--JS Help Desk</td>
<td>The JS Help Desk WordPress plugin before 3.1.4 does not perform authori= zation or ownership checks before returning support-ticket content in a non= ce-gated search handler, allowing any authenticated user (Subscriber and ab= ove) to read the subject and full message body of every other user's suppor=
t tickets.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14928" target=3D= "_blank" rel=3D"noopener">CVE-2026-14928</a></td>
</tr>

<td class=3D"vendor-product">JS Help Desk--JS Help Desk</td>
<td>The JS Help Desk WordPress plugin before 3.1.4 does not verify ownershi=
p of the targeted reply before updating it, allowing any authenticated user=
(Subscriber and above) to overwrite the content of any support-ticket repl=
y on the site.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14929" target=3D= "_blank" rel=3D"noopener">CVE-2026-14929</a></td>
</tr>

<td class=3D"vendor-product">JS Help Desk--JS Help Desk</td>
<td>The JS Help Desk WordPress plugin before 3.1.4 does not perform any aut= horization, nonce, or ownership check on a front-end request dispatcher, al= lowing unauthenticated users to upload files (limited to the JS Help Desk W= ordPress plugin before 3.1.4's inert allowed extensions) and attach them to=
arbitrary users' support tickets.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14930" target=3D= "_blank" rel=3D"noopener">CVE-2026-14930</a></td>
</tr>

<td class=3D"vendor-product">JS Help Desk--JS Help Desk</td>
<td>The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent c= apability to the Contributor role on activation and does not perform a capa= bility check on a user-listing handler, allowing Contributor-level users to=
enumerate the email addresses of all registered WordPress users.</td> <td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14931" target=3D= "_blank" rel=3D"noopener">CVE-2026-14931</a></td>
</tr>

<td class=3D"vendor-product">JS Help Desk--JS Help Desk</td>
<td>The JS Help Desk WordPress plugin before 3.1.5 does not verify that the=
requesting user owns the ticket being loaded: a low-privileged authenticat=
ed user can supply another user's ticket ID and read that ticket's contents=
, including the reporter's PII and message body.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15209" target=3D= "_blank" rel=3D"noopener">CVE-2026-15209</a></td>
</tr>

<td class=3D"vendor-product">juev--nebula-mesh</td>
<td>nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtua=
l private network. Prior to version 0.3.3, every /ui/* POST / PUT / PATCH /=
DELETE route processes the request as soon as the session cookie validates=
. SameSite=3DLax on the session cookie prevents most cross-site form submit=
s but does not protect: top-level form-submit navigations from third-party = pages (some browsers still send Lax cookies on top-level POSTs); same-regis= trable-domain attackers (sibling-subdomain XSS, subdomain takeover); the GE=
T /ui/logout route, which a third-party &lt;img src=3D".../ui/logout"&gt; c=
an force-trigger. This issue has been patched in version 0.3.3.</td> <td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-47725" target=3D= "_blank" rel=3D"noopener">CVE-2026-47725</a></td>
</tr>

<td class=3D"vendor-product">juev--nebula-mesh</td>
<td>nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtua=
l private network. Prior to version 0.3.2, internal/api/audit.go:12 - handl= eGetAuditLog does no admin check. The route is bearer-auth gated only; any = operator API key returns the full audit log via store.ListAuditEntries (up =
to limit=3D1000). This includes cross-tenant actor names, host/CA/operator = IDs, action timestamps, and masked-IP entries from rate-limit refusals - en= ough surface for a tenant to enumerate the server's activity, infer staffin=
g patterns, or identify high-value targets. This issue has been patched in = version 0.3.2.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-47726" target=3D= "_blank" rel=3D"noopener">CVE-2026-47726</a></td>
</tr>

<td class=3D"vendor-product">juev--nebula-mesh</td>
<td>nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtua=
l private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 c= onstructs a CAManager with the plaintext ed25519.PrivateKey after unwrappin=
g via the master key; internal/pki/ca.go:13-16 stores it. Callers at intern= al/api/enroll.go:116, internal/api/updates.go:297, and internal/api/mobile_= bundle.go:40 use the manager for one Sign() and drop the reference on funct= ion return - but the underlying slice contents are not wiped before release=
. The keystore package's contract (internal/keystore/keystore.go doc: "Call= ers MUST zeroise the returned plaintext DEK as soon as it is no longer need= ed") is not met by the CAManager consumer. Decrypted CA private keys persis=
t in process heap until Go's GC scavenges the underlying slice - minutes to=
hours under load, indefinitely on idle servers. This issue has been patche=
d in version 0.3.7.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48025" target=3D= "_blank" rel=3D"noopener">CVE-2026-48025</a></td>
</tr>

<td class=3D"vendor-product">juev--nebula-mesh</td>
<td>nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtua=
l private network. Prior to version 0.3.2, internal/web/session.go and inte= rnal/web/oidc.go set HttpOnly and SameSite=3DLax on every cookie but never = Secure. A single plaintext request to the origin (operator on a LAN, mistyp=
ed URL, HTTP=C3=A2=E2=80=A0=E2=80=99HTTPS not strictly enforced, reverse pr= oxy misconfiguration) discloses the session. This issue has been patched in=
version 0.3.2.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-48058" target=3D= "_blank" rel=3D"noopener">CVE-2026-48058</a></td>
</tr>

<td class=3D"vendor-product">keras-team--keras-team/keras</td>
<td>A vulnerability in keras-team/keras versions &lt;=3D 3.14.0 allows arbi= trary local HDF5 file content disclosure due to improper handling of HDF5 E= xternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functio=
ns bypass the `safe_get_h5_group` and `safe_get_h5_dataset` helpers, which = are designed to reject ExternalLinks and SoftLinks. This results in automat=
ic dereferencing of links to external HDF5 files, enabling attackers to dis= close sensitive data from the victim's local filesystem. Specifically, `Ker= asFileEditor` extracts attributes and datasets from linked files into its i= nternal structures, while `keras.saving.load_weights` loads weights from li= nked files into the user's model. This issue can be exploited by providing =
a malicious `.h5`, `.weights.h5`, or `.keras` file containing ExternalLinks= .</td>
<td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9335" target=3D"= _blank" rel=3D"noopener">CVE-2026-9335</a></td>
</tr>

<td class=3D"vendor-product">King Addons for Elementor--King Addons for Ele= mentor</td>
<td>The King Addons for Elementor WordPress plugin before 51.1.76 does not = escape a user-supplied grid setting before reflecting it into an HTML attri= bute in an unauthenticated AJAX response, allowing attackers to execute arb= itrary JavaScript in the browser of a visitor who is tricked into loading a=
crafted page.</td>
<td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14841" target=3D= "_blank" rel=3D"noopener">CVE-2026-14841</a></td>
</tr>

<td class=3D"vendor-product">Kirki--Kirki</td>
<td>The Kirki WordPress plugin before 6.0.13 does not restrict which classe=
s may be instantiated when it deserialises data that unauthenticated users = can store, leading to PHP Object Injection that is triggered when an admini= strator later reviews the stored data. With a suitable gadget chain present=
on the site (via another installed Kirki WordPress plugin before 6.0.13, ,=
or an outdated WordPress version), this could be leveraged to perform a va= riety of attacks, such as remote code execution.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12720" target=3D= "_blank" rel=3D"noopener">CVE-2026-12720</a></td>
</tr>

<td class=3D"vendor-product">Kirki--Kirki</td>
<td>The Kirki WordPress plugin before 6.0.13 does not properly sanitise and=
escape a value taken from the request before using it in a SQL statement, = allowing unauthenticated attackers to perform SQL injection attacks.</td> <td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12721" target=3D= "_blank" rel=3D"noopener">CVE-2026-12721</a></td>
</tr>

<td class=3D"vendor-product">kishan0725--Hospital Management System</td>

<td>kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injectio=
n in /betweendates-detailsreports.php.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-65340" target=3D= "_blank" rel=3D"noopener">CVE-2025-65340</a></td>
</tr>

<td class=3D"vendor-product">kishan0725--Hospital Management System</td>

<td>kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injectio=
n in /hms/doctor/view-patient.php?viewid=3D1.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69942" target=3D= "_blank" rel=3D"noopener">CVE-2025-69942</a></td>
</tr>

<td class=3D"vendor-product">kishan0725--Hospital Management System</td>

<td>kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection=
in get_doctor.php via the parameters doctor and specilizationid.</td>

<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69943" target=3D= "_blank" rel=3D"noopener">CVE-2025-69943</a></td>
</tr>

<td class=3D"vendor-product">kishan0725--Hospital Management System</td>

<td>kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injectio=
n in the view-medhistory.php endpoint via the viewid parameter.</td>

<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69944" target=3D= "_blank" rel=3D"noopener">CVE-2025-69944</a></td>
</tr>

<td class=3D"vendor-product">kishan0725--Hospital Management System</td>

<td>kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injectio=
n in /doctor/edit-patient.php?editid=3D1.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69945" target=3D= "_blank" rel=3D"noopener">CVE-2025-69945</a></td>
</tr>

<td class=3D"vendor-product">kishan0725--Hospital Management System</td>

<td>kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injectio=
n in check_availability.php via the parameters emailid and email.</td>

<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69949" target=3D= "_blank" rel=3D"noopener">CVE-2025-69949</a></td>
</tr>

<td class=3D"vendor-product">Kong--Kubernetes Ingress Controller</td>
<td>Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-s= coped Secret creation privileges to cause a cluster-wide ingress configurat= ion denial of service. KIC collects CA-certificate Secrets across all watch=
ed namespaces using a label selector alone, without ingress-class or namesp= ace restrictions. The CA-certificate primary key is derived from a user-sup= plied field in the Secret. Duplicate CA-certificate IDs cause Kong Gateway =
to reject the entire configuration document and halting all ingress changes=
cluster-wide.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15228" target=3D= "_blank" rel=3D"noopener">CVE-2026-15228</a></td>
</tr>

<td class=3D"vendor-product">Kong--Kubernetes Ingress Controller</td>
<td>Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) allow=
s a user with namespace-scoped Secret creation privileges to cause a cluste= r-wide ingress configuration denial of service. The embedded KIC collects C= A-certificate Secrets across all watched namespaces using a label selector = alone, without ingress-class or namespace restrictions. The CA-certificate = primary key is derived from a user-supplied field in the Secret. Duplicate = CA-certificate IDs cause Kong Gateway to reject the entire configuration do= cument and halting all ingress changes cluster-wide.</td>

<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16543" target=3D= "_blank" rel=3D"noopener">CVE-2026-16543</a></td>
</tr>

<td class=3D"vendor-product">kyndryl-open-source--hashi-vault-js</td> <td>hashi-vault-js is a Node.js module for interacting with the HashiCorp V= ault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier va= lues including name, username, group, role, and version into Vault request = paths and query strings instead of using encodeURIComponent() and URLSearch= Params, allowing path traversal and query parameter injection. This issue i=
s fixed in version 0.5.2.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55100" target=3D= "_blank" rel=3D"noopener">CVE-2026-55100</a></td>
</tr>

<td class=3D"vendor-product">LangGenius--Dify</td>
<td>Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability. This v= ulnerability allows remote attackers to disclose sensitive information on a= ffected installations of Dify. User interaction is required to exploit this=
vulnerability in that the target must visit a malicious page or open a mal= icious file. The specific flaw exists within the OAuth flow handling in the=
AppInitializer component. An attacker can force a redirection to a site th=
at serves malicious content. An attacker can leverage this vulnerability to=
disclose information in the context of the application. Was ZDI-CAN-29196.= </td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18266" target=3D= "_blank" rel=3D"noopener">CVE-2026-18266</a></td>
</tr>

<td class=3D"vendor-product">Legion of the Bouncy Castle Inc.--BC-JAVA</td> <td>In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYST= ALS-Kyber) routines divided secret-derived polynomial coefficients by the m= odulus q: Poly.toMsg, which decodes the decrypted message, and the cipherte=
xt compression routines Poly.compressPoly and PolyVec.compressPolyVec. An a= ttacker able to measure the timing of a large number of decapsulations perf= ormed with the same long-term private key can recover that key. These are t=
he KyberSlash1 (Poly.toMsg) and KyberSlash2 (ciphertext compression) divisi= ons. Compression performed during encapsulation operates on values that bec= ome the public ciphertext and is not affected.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2024-14041" target=3D= "_blank" rel=3D"noopener">CVE-2024-14041</a></td>
</tr>

<td class=3D"vendor-product">Lenxel WP--Lenxel WP</td>
<td>The Lenxel WP WordPress theme through 1.0.31 does not perform any autho= rization or ownership check on its password-reset action, validating only a=
CSRF nonce, allowing unauthenticated attackers to reset the password of an=
y user (including an administrator) and take over the account.</td> <td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12586" target=3D= "_blank" rel=3D"noopener">CVE-2026-12586</a></td>
</tr>

<td class=3D"vendor-product">LG Electronics--SmartShare</td>
<td>Improper neutralization of special elements used in an SQL command ('SQ=
L injection') vulnerability in LG Electronics SmartShare allows SQL Injecti= on. This issue affects SmartShare: through 2.3.1712.1202,=C2=A0which is sup= ported on Microsoft Windows 10 and earlier versions.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15929" target=3D= "_blank" rel=3D"noopener">CVE-2026-15929</a></td>
</tr>

<td class=3D"vendor-product">LifterLMS--LifterLMS</td>
<td>The LifterLMS WordPress plugin before 10.0.10 does not strip event-hand= ler attributes from a course pricing field before storing and rendering it,=
allowing users with a course-editing role to inject JavaScript that execut=
es in the session of an administrator who views the course.</td>

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14207" target=3D= "_blank" rel=3D"noopener">CVE-2026-14207</a></td>
</tr>

<td class=3D"vendor-product">LifterLMS--LifterLMS</td>
<td>The LifterLMS WordPress plugin before 10.0.10 does not perform a capabi= lity check in one of its select2 query AJAX handlers, only verifying that t=
he user is logged in, allowing any authenticated user with subscriber-level=
access to read the titles of internal post types such as coupon codes by s= upplying the post type.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14231" target=3D= "_blank" rel=3D"noopener">CVE-2026-14231</a></td>
</tr>

<td class=3D"vendor-product">Lightbox with PhotoSwipe--Lightbox with PhotoS= wipe</td>
<td>The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not san= itise or escape a link data attribute before rendering it into the image li= ghtbox caption in the browser, allowing users with author-level access and = above (who lack the unfiltered_html capability) to store JavaScript that ru=
ns when a visitor or administrator opens the lightbox.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14833" target=3D= "_blank" rel=3D"noopener">CVE-2026-14833</a></td>
</tr>

<td class=3D"vendor-product">Link Library--Link Library</td>
<td>Improper neutralization of input during web page generation ('cross-sit=
e scripting') vulnerability in Link Library allows Cross-Site Scripting (XS= S). This issue affects Link Library: before 7.9.4.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18197" target=3D= "_blank" rel=3D"noopener">CVE-2026-18197</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: KVM=
: x86: wean fast IN from emulator_pio_in Use __emulator_pio_in() directly f=
or fast PIO instead of bouncing through emulator_pio_in() now that __emulat= or_pio_in() fills "val" when handling in-kernel PIO. vcpu-&gt;arch.pio.coun=
t is guaranteed to be '0', so this a pure nop. emulator_pio_in_emulated is = now the last caller of emulator_pio_in. No functional change intended.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2022-4994" target=3D"= _blank" rel=3D"noopener">CVE-2022-4994</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: bri= dge: cfm: reject invalid CCM interval at configuration time ccm_tx_work_exp= ired() re-arms itself via queue_delayed_work() using the configured exp_int= erval converted by interval_to_us(). When exp_interval is BR_CFM_CCM_INTERV= AL_NONE or out of range, interval_to_us() returns 0, causing the worker to = fire immediately in a tight loop that allocates skbs until OOM. Fix this by=
validating exp_interval at configuration time: - Constrain IFLA_BRIDGE_CFM= _CC_CONFIG_EXP_INTERVAL to the valid range [BR_CFM_CCM_INTERVAL_3_3_MS, BR_= CFM_CCM_INTERVAL_10_MIN] in the netlink policy so userspace cannot set an i= nvalid value. - Reject starting CCM TX in br_cfm_cc_ccm_tx() when exp_inter= val has not yet been configured (defaults to 0 from kzalloc).</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64537" target=3D= "_blank" rel=3D"noopener">CVE-2026-64537</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: ipv=
6: Fix null-ptr-deref in fib6_nh_mtu_change(). fib6_nh_mtu_change() re-fetc= hes idev via __in6_dev_get(arg-&gt;dev) and dereferences idev-&gt;cnf.mtu6 = without a NULL check. addrconf_ifdown() clears dev-&gt;ip6_ptr with RCU_INI= T_POINTER() after rt6_disable_ip() has released tb6_lock, so the RA-driven = MTU walk can observe a NULL idev and oops. The caller rt6_mtu_change_route(=
) guards its own __in6_dev_get(), but this re-fetch is unguarded; nexthop-b= acked routes survive addrconf_ifdown()'s flush, so the walk still reaches i=
t after ip6_ptr is nulled. Return 0 when idev is NULL, matching rt6_mtu_cha= nge_route() and the fib6_mtu() fix in commit 5ad509c1fdad ("ipv6: Fix null-= ptr-deref in fib6_mtu()."). Oops: general protection fault, ... KASAN: null= -ptr-deref in range [0x00000000000002a8-0x00000000000002af] RIP: 0010:fib6_= nh_mtu_change+0x203/0x990 rt6_mtu_change_route+0x141/0x1d0 __fib6_clean_all= +0xd0/0x160 rt6_mtu_change+0xb4/0x100 ndisc_router_discovery+0x24b5/0x2cb0 = icmpv6_rcv+0x12e9/0x1710 ipv6_rcv+0x39b/0x410</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64538" target=3D= "_blank" rel=3D"noopener">CVE-2026-64538</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: ipv=
6: ndisc: fix NULL deref in accept_untracked_na() accept_untracked_na() re-= fetches the inet6_dev with __in6_dev_get(dev) and dereferences idev-&gt;cnf= .accept_untracked_na without a NULL check, even though its only caller ndis= c_recv_na() already fetched and NULL-checked idev for the same device. Both=
reads of dev-&gt;ip6_ptr run in the same RCU read-side critical section, b=
ut a concurrent addrconf_ifdown() can clear dev-&gt;ip6_ptr between them: l= owering the MTU below IPV6_MIN_MTU calls addrconf_ifdown() without the sync= hronize_net() that orders the unregister path, so the re-fetch returns NULL=
and oopses: BUG: KASAN: null-ptr-deref in ndisc_recv_na (net/ipv6/ndisc.c:= 974) Read of size 4 at addr 0000000000000364 Call Trace: &lt;IRQ&gt; ndisc_= recv_na (net/ipv6/ndisc.c:974) icmpv6_rcv (net/ipv6/icmp.c:1193) ip6_protoc= ol_deliver_rcu (net/ipv6/ip6_input.c:479) ip6_input_finish (net/ipv6/ip6_in= put.c:534) ip6_input (net/ipv6/ip6_input.c:545) ip6_mc_input (net/ipv6/ip6_= input.c:635) ipv6_rcv (net/ipv6/ip6_input.c:351) &lt;/IRQ&gt; It is reachab=
le by an unprivileged user via a network namespace. Pass the caller's alrea=
dy validated idev instead of re-fetching it; the idev stays alive for the w= hole RCU critical section, so it is safe even after dev-&gt;ip6_ptr has bee=
n cleared.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64542" target=3D= "_blank" rel=3D"noopener">CVE-2026-64542</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: cry= pto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents pefile_dig= est_pe_contents() computes the trailing-data hash length as pelen - (hashed= _bytes + certs_size). A crafted PE can make the addition exceed pelen, caus= ing the unsigned subtraction to underflow to ~4 GiB. This is passed to cryp= to_shash_update() which reads out of bounds and panics on unmapped vmalloc = guard pages. BUG: unable to handle page fault for address: ffffc900038d8000=
Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:sha256_blocks_generic (lib= /crypto/sha256.c:152) Call Trace: &lt;TASK&gt; __sha256_update (lib/crypto/= sha256.c:208) crypto_sha256_update (crypto/sha256.c:142) verify_pefile_sign= ature (crypto/asymmetric_keys/verify_pefile.c:436) kexec_kernel_verify_pe_s=
ig (kernel/kexec_file.c:151) __do_sys_kexec_file_load (kernel/kexec_file.c:= 406) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_= hwframe (arch/x86/entry/entry_64.S:121) &lt;/TASK&gt; Kernel panic - not sy= ncing: Fatal exception Validate that the addition does not overflow and the=
result does not exceed pelen before the subtraction. Return -ELIBBAD on fa= ilure.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64544" target=3D= "_blank" rel=3D"noopener">CVE-2026-64544</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: Blu= etooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() bpa10x_= setup() sends the vendor command 0xfc0e and passes the response to bt_dev_i= nfo() and hci_set_fw_info() as a "%s" string starting at skb-&gt;data + 1, = without checking the length: bt_dev_info(hdev, "%s", (char *)(skb-&gt;data =
+ 1)); hci_set_fw_info(hdev, "%s", skb-&gt;data + 1); A device that returns=
a one-byte response (status only) leaves skb-&gt;data + 1 past the end of = the data, and the %s walk reads adjacent slab memory until it meets a NUL. = The same happens when the payload is not NUL-terminated within skb-&gt;len.=
The out-of-bounds bytes end up in the kernel log and the firmware-info deb= ugfs file. Print the revision string with a bounded "%.*s" limited to skb-&= gt;len - 1 instead. This keeps the string readable for well-behaved devices=
while never reading past the received data, and does not fail setup, so a = device returning a short or unterminated response keeps working.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64549" target=3D= "_blank" rel=3D"noopener">CVE-2026-64549</a></td>
</tr>

<td class=3D"vendor-product">Linux--Linux</td>
<td>In the Linux kernel, the following vulnerability has been resolved: net=
: psample: fix info leak in PSAMPLE_ATTR_DATA psample open codes nla_put() = presumably to avoid wiping the data with 0s just to override it with packet=
data. This open coding is missing clearing the pad, however, each netlink = attr is padded to 4B and data_len may not be divisible by 4B.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64553" target=3D= "_blank" rel=3D"noopener">CVE-2026-64553</a></td>
</tr>

<td class=3D"vendor-product">Linuxfabrik--monitoring-plugins</td> <td>Linuxfabrik monitoring-plugins provides Python monitoring plugins for I= cinga, Nagios, and related monitoring systems. In version 6.0.0, the logfil=
e check legacy database migration moved a predictable path from /tmp with o= s.rename() and allowed a local user controlling the plugin account to place=
a symlink that would be followed by sqlite3.connect() during a root-run ch= eck.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67433" target=3D= "_blank" rel=3D"noopener">CVE-2026-67433</a></td>
</tr>

<td class=3D"vendor-product">Linuxfabrik--monitoring-plugins</td> <td>linuxfabrik-lib provides Python modules for database access, caching, s= hell execution, and API integrations. Prior to version 6.0.0, lib.url.fetch=
() followed cross-origin redirects while forwarding caller-supplied credent= ial headers other than Authorization and Cookie, allowing a malicious redir= ect-capable server to receive headers such as X-Auth-Token from authenticat=
ed monitoring requests. This issue is fixed in version 6.0.0.</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67435" target=3D= "_blank" rel=3D"noopener">CVE-2026-67435</a></td>
</tr>

<td class=3D"vendor-product">Linuxfabrik--monitoring-plugins</td> <td>Linuxfabrik monitoring-plugins provides Python monitoring plugins for I= cinga, Nagios, and related monitoring systems. In 6.0.0 and earlier, the re= dfish-* plugins built request URLs by concatenating an operator-supplied ba=
se URL with response-supplied @odata.id links, allowing a malicious or comp= romised BMC to redirect authenticated Redfish requests and disclose X-Auth-= Token or HTTP Basic credentials.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67436" target=3D= "_blank" rel=3D"noopener">CVE-2026-67436</a></td>
</tr>

<td class=3D"vendor-product">Login &amp; Register Forms--Login &amp; Regist=
er Forms</td>
<td>The Login &amp; Register Forms WordPress plugin before 3.2.5 does not p= roperly enforce the rate limit on its password-reset verification-code flow=
, keying both the verification code and the per-source attempt counter on a=
n unauthenticated, client-controlled value, allowing unauthenticated attack= ers to reset the limit at will and brute-force the code to take over any ac= count, including administrators, when the verification-code reset mode is e= nabled.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14836" target=3D= "_blank" rel=3D"noopener">CVE-2026-14836</a></td>
</tr>

<td class=3D"vendor-product">login-social--login-social</td>
<td>The login-social WordPress plugin through 1.0.4 does not validate passw= ord-reset requests against a reset key or the requester's identity, and it = issues authentication sessions from unverified third-party sign-in data, al= lowing unauthenticated attackers to reset any user's password or log in as = any existing account, including administrators, and take over the site.</td=

<td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16261" target=3D= "_blank" rel=3D"noopener">CVE-2026-16261</a></td>
</tr>

<td class=3D"vendor-product">lookyloo--lookyloo</td>
<td>A stored cross-site scripting vulnerability existed in the capture tree=
visualization page. The application embedded the serialized capture tree d= irectly into an inline JavaScript block using the Jinja safe filter. Becaus=
e the tree data can contain values derived from captured and potentially at= tacker-controlled web content, a specially crafted value could prematurely = terminate the surrounding &lt;script&gt; element and inject arbitrary HTML =
or JavaScript. The malicious code would execute in the browser of a user vi= ewing the affected capture tree. Successful exploitation could allow an att= acker to perform actions using the victim's authenticated session, access i= nformation available to the victim, or modify application data within the p= ermissions of the affected user. The patch removes the JSON data from the H= TML document and retrieves it through a dedicated API endpoint. The client = then processes the response using response.json(), preventing capture data = from being interpreted as executable content within the original page's HTM=
L or JavaScript context.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66824" target=3D= "_blank" rel=3D"noopener">CVE-2026-66824</a></td>
</tr>

<td class=3D"vendor-product">lookyloo--lookyloo</td>
<td>Lookyloo did not enforce limits on the decompressed size of uploaded ca= pture archives and compressed HAR files. An attacker could submit a special=
ly crafted ZIP, gzip, or zlib-compressed capture containing data that expan=
ds to a very large size during processing. Because the application decompre= ssed this content directly in memory without first limiting the output size=
, processing the malicious capture could exhaust available memory, terminat=
e a web or worker process, or make the Lookyloo instance unavailable. The v= ulnerability affects both full Lookyloo capture archive imports and API sub= missions containing gzip-compressed HAR data. Repeated exploitation could c= ause a persistent denial-of-service condition until the affected processes =
or instance are restarted. The patch introduces: * A 1 GB cumulative uncomp= ressed-size limit for imported capture archives. * Size-limited gzip and zl=
ib decompression for compressed HAR files. * Explicit detection and handlin=
g of suspected zip bombs. * An HTTP 400 response when an oversized compress=
ed HAR file is submitted through the API.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66913" target=3D= "_blank" rel=3D"noopener">CVE-2026-66913</a></td>
</tr>

<td class=3D"vendor-product">LWS Optimize--LWS Optimize</td>
<td>The LWS Optimize WordPress plugin before 3.4 does not perform a capabil= ity check on its cache-clearing actions, allowing any authenticated user, i= ncluding Subscribers, to flush the site's caches and force repeated cache r= ebuilds.</td>
<td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16042" target=3D= "_blank" rel=3D"noopener">CVE-2026-16042</a></td>
</tr>

<td class=3D"vendor-product">Mailgun--Mailgun for WordPress</td>
<td>The Mailgun for WordPress plugin before 2.2.1 does not perform any capa= bility or nonce check on an unauthenticated AJAX action that adds subscribe=
rs to the site owner's configured email service mailing lists, allowing una= uthenticated attackers to enrol arbitrary email addresses into those lists = using the owner's stored API credentials.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14834" target=3D= "_blank" rel=3D"noopener">CVE-2026-14834</a></td>
</tr>

<td class=3D"vendor-product">MainWP Child--MainWP Child</td>
<td>The MainWP Child WordPress plugin before 6.1.2 does not verify the requ= ester's identity in its site-registration request handler when password aut= hentication has been disabled for the targeted account, allowing an unauthe= nticated attacker to obtain a valid authentication session as that account,=
including an administrator, by naming its login in a single registration r= equest.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12255" target=3D= "_blank" rel=3D"noopener">CVE-2026-12255</a></td>
</tr>

<td class=3D"vendor-product">malach-it--boruta</td>
<td>Authentication Bypass by Capture-replay vulnerability in malach-it Boru=
ta allows an attacker who has obtained a previously valid JWT client assert= ion to authenticate as the issuing OAuth client after the assertion has exp= ired. Boruta accepts JWT-based client authentication (client_secret_jwt and=
private_key_jwt token endpoint authentication methods) but never enforces = that the assertion's exp claim is in the future. The pre-check helper Borut= a.Oauth.Request.Base.check_expiration/1 in lib/boruta/oauth/request/base.ex=
only verifies that an exp claim is present (it pattern-matches on the exis= tence of the key and returns success), and the Joken token configuration us=
ed for signature verification, Boruta.Oauth.Authorization.Client.Token.toke= n_config/0 in lib/boruta/oauth/authorization/client.ex, returns an empty ma=
p, so Joken's default exp claim validator is not engaged either. Any attack=
er who obtains a validly-signed client assertion (for example through logs,=
reverse proxies, browser tooling, or other observability surfaces) can rep= lay it indefinitely to authenticate as the client and obtain access tokens = with that client's privileges. This issue affects boruta: from 2.3.0 before=
2.3.7.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53431" target=3D= "_blank" rel=3D"noopener">CVE-2026-53431</a></td>
</tr>

<td class=3D"vendor-product">malach-it--boruta</td>
<td>Server-Side Request Forgery vulnerability in malach-it Boruta allows an=
unauthenticated remote attacker to cause the OAuth/OpenID authorization se= rver to issue outbound HTTP requests to attacker-chosen URIs, including int= ernal services and cloud metadata endpoints. Three code paths fetch remote = URIs supplied by the requester without sufficient validation of the target.=
Boruta.Oauth.Request.Base.fetch_unsigned_request/1 in lib/boruta/oauth/req= uest/base.ex dereferences the OAuth request_uri parameter from the authoriz= ation request via Finch.build(:get, request_uri) |&gt; Finch.request(OpenID= HttpClient). Boruta.Openid.parse_registration_params/2 in lib/boruta/openid= .ex dereferences the jwks_uri supplied in an OpenID Connect dynamic client = registration request. Boruta.Ecto.Clients.refresh_jwk_from_jwks_uri/1 in li= b/boruta/adapters/ecto/clients.ex later refreshes the stored jwks_uri for a=
n existing client. In all three paths the only validation is that the URI p= arses with a scheme (and one of the two request_uri clauses does not even r= estrict the scheme to http or https). The implementations do not require HT= TPS, do not enforce a host or IP allowlist, do not reject loopback, private=
, link-local, or other non-public ranges after DNS resolution, do not cap r= esponse size, and do not constrain redirects. An attacker can therefore ste=
er the server's HTTP client at arbitrary network targets reachable from the=
Boruta host. This issue affects boruta: from 2.3.2 before 2.3.7.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54885" target=3D= "_blank" rel=3D"noopener">CVE-2026-54885</a></td>
</tr>

<td class=3D"vendor-product">malach-it--boruta</td>
<td>Improper Isolation or Compartmentalization vulnerability in malach-it b= oruta (Elixir.Boruta.Openid module) allows attackers to register OpenID Con= nect clients with administrative privileges through the dynamic client regi= stration entry point. Boruta.Openid.register_client/3 forwards caller-suppl= ied registration parameters to the administrative client creation path with= out a public/admin field-level allowlist, so an unauthenticated registrant = can set security-sensitive attributes including supported grant types, auth= orized scopes, PKCE enforcement, public refresh and revocation behavior, to= ken lifetimes, and signing settings. The library does not distinguish betwe=
en metadata a public registrant is allowed to set and administrative contro=
ls that should require operator approval. This vulnerability is associated = with program files lib/boruta/openid.ex and program routines 'Elixir.Boruta= .Openid':register_client/3, 'Elixir.Boruta.Openid':parse_registration_param= s/2. This issue affects boruta from 2.3.0 before 2.3.7.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65635" target=3D= "_blank" rel=3D"noopener">CVE-2026-65635</a></td>
</tr>

<td class=3D"vendor-product">Mapster WP Maps--Mapster WP Maps</td>
<td>The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any=
authorization or post-status check on a public REST endpoint, allowing una= uthenticated users to retrieve the title and full content of any post regar= dless of its status, including unpublished (draft, pending, private, and tr= ashed) posts.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14839" target=3D= "_blank" rel=3D"noopener">CVE-2026-14839</a></td>
</tr>

<td class=3D"vendor-product">Masteriyo LMS--Masteriyo LMS</td>
<td>The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly veri=
fy authorization on an unauthenticated AJAX action used to clear user sessi= ons, allowing unauthenticated attackers to terminate the active sessions (f= orce-logout) of any user on the site, including administrators.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13332" target=3D= "_blank" rel=3D"noopener">CVE-2026-13332</a></td>
</tr>

<td class=3D"vendor-product">Media Manager--TastyIgniter</td>
<td>A stored Cross-Site Scripting (XSS) vulnerability in the file upload fu= nctionality of the Media Manager in TastyIgniter v4.3.0, caused by insuffic= ient validation and sanitization of SVG files. An authenticated user with l=
ow privileges can upload a malicious SVG file containing JavaScript code. W= hen an administrator views that file, the code executes in the context of t= heir browser. By chaining this vulnerability with a Cross-Site Request Forg= ery (CSRF) attack, an attacker can extract the administrator's CSRF token a=
nd perform unauthorized actions-such as modifying credentials-thereby gaini=
ng full control of the administrative account.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14856" target=3D= "_blank" rel=3D"noopener">CVE-2026-14856</a></td>
</tr>

<td class=3D"vendor-product">MemberGlut--MemberGlut</td>
<td>The MemberGlut WordPress plugin before 1.1.5 does not validate the role=
chosen during front-end registration, allowing unauthenticated users to re= gister an account with an arbitrary role, including administrator, leading =
to full site compromise.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12394" target=3D= "_blank" rel=3D"noopener">CVE-2026-12394</a></td>
</tr>

<td class=3D"vendor-product">Mercusys--MB115-4G</td>
<td>Denial-of-service (DoS) vulnerability due to a stack buffer overflow in=
the http_gdpr_decrypt function of the Mercusys MB115-4G device's web inter= face. An unauthenticated attacker could exploit this vulnerability by sendi=
ng a specially crafted request to the /cgi/login endpoint, causing memory c= orruption and the httpd process to crash, resulting in a denial of service = for the web administration service.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12495" target=3D= "_blank" rel=3D"noopener">CVE-2026-12495</a></td>
</tr>

<td class=3D"vendor-product">Meta Box--Meta Box</td>
<td>The Meta Box WordPress plugin before 5.13.1 does not verify that a user=
is authorized to delete the supplied attachment before deleting it, allowi=
ng users with a low-privilege role such as Contributor to permanently delet=
e arbitrary media attachments belonging to other users.</td> <td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15248" target=3D= "_blank" rel=3D"noopener">CVE-2026-15248</a></td>
</tr>

<td class=3D"vendor-product">Milk admin--Milk admin</td>
<td>An issue in the redirect parameter in Milk admin &lt;=3D0.9.8 allows re= mote attackers to redirect users to arbitrary external URLs via a crafted r= equest.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-51564" target=3D= "_blank" rel=3D"noopener">CVE-2026-51564</a></td>
</tr>

<td class=3D"vendor-product">Milk admin--Milk admin</td>
<td>Cross-site scripting (XSS) vulnerability in Modules/Docs/DocsController= .php in Milk admin &lt;=3D0.9.8 allows remote attackers to inject arbitrary=
web script or HTML via the action parameter in a crafted request</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-51565" target=3D= "_blank" rel=3D"noopener">CVE-2026-51565</a></td>
</tr>

<td class=3D"vendor-product">miniOrange 2FA--miniOrange 2FA</td>
<td>The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the = submitted one-time password against the targeted user's stored secret, inst= ead verifying it against an attacker-supplied value, allowing an unauthenti= cated attacker who knows a victim's password to bypass two-factor authentic= ation and gain access to the victim's account, including administrators.</t=

<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12695" target=3D= "_blank" rel=3D"noopener">CVE-2026-12695</a></td>
</tr>

<td class=3D"vendor-product">miniOrange--miniOrange Social Login and Regist=
er (Discord, Google, Twitter, LinkedIn)</td>
<td>The miniOrange Social Login and Register (Discord, Google, Twitter, Lin= kedIn) WordPress plugin before 7.8.0 does not bind the one-time code used b=
y its optional email-verification (Profile Completion) feature to the accou=
nt it was issued for, allowing unauthenticated attackers to obtain a valid = session for any account, including administrators, by requesting a code for=
an email address they control and replaying it against the victim's email = address. Exploitation requires the Profile Completion feature to be enabled=
and social login to be configured.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14300" target=3D= "_blank" rel=3D"noopener">CVE-2026-14300</a></td>
</tr>

<td class=3D"vendor-product">misp--misp</td>
<td>MISP installation scripts generated an Apache HTTP virtual-host configu= ration containing an incorrectly formatted HTTP-to-HTTPS redirect: Redirect=
permanent / https://misp.example Apache's Redirect directive appends any p= ortion of the requested path that follows the matched prefix to the configu= red destination URL. Because the destination did not end with /, attacker-c= ontrolled path content was appended directly to the hostname rather than to=
its URL path. For example, a request resembling: http://misp.example/@atta= cker.example/ could result in a redirect resembling: https://misp.example@a= ttacker.example/ Under standard URL parsing, misp.example is interpreted as=
user information and attacker.example as the destination host. An unauthen= ticated remote attacker could therefore construct a URL hosted under the le= gitimate MISP domain that redirects users to an attacker-controlled website=
. The vulnerability could be used for phishing, credential collection, or p= otentially disclosing sensitive query-string information preserved during t=
he redirect. Exploitation requires a user to follow the crafted HTTP URL. T=
he fix adds the missing trailing slash to the redirect destination, ensurin=
g that appended request data remains part of the path on the configured MIS=
P host. Existing installationsExisting MISP installations should review the=
ir Apache HTTP virtual-host configuration and ensure that the HTTPS redirec=
t destination ends with a trailing slash: Redirect permanent / https://misp= .example/ After updating the configuration, validate it with apachectl conf= igtest and reload or restart Apache for the change to take effect</td> <td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67178" target=3D= "_blank" rel=3D"noopener">CVE-2026-67178</a></td>
</tr>

<td class=3D"vendor-product">Mitsubishi Electric Corporation--MELSEC MX Con= troller MX-R model MXR300-16</td>
<td>Improper Enforcement of Message Integrity During Transmission in a Comm= unication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller=
MX-R model, MELSEC MX Controller MX-F model, Master/local module, CC-Link =
IE TSN interface board, Motion module, Motion Control Board, Block-type rem= ote module, Block-type remote module with safety functions, Analog-Digital = converter module, Digital-Analog converter module, CC-Link IE TSN compatibl=
e coupler, FPGA module, Tension meter, AC Servo MELSERVO-J5, AC Servo MELSE= RVO-JET, Liner Track System MTR-S series Linear track control module, Inver= ter FR-A800/F800/E800 Series, Industrial Robot CR800-D series controller Ne= twork Base Card, CC-Link IE TSN expansion unit, CC-Link IE TSN-CC-Link IE F= ield Network bridge module, CC-Link IE TSN-AnyWireASLINK bridge module, Ene= rgy Measuring Unit CC-Link IE TSN Communication Unit, Industrial Computer M= ELIPC series, GOT3000 Series, CC-Link IE TSN Communication Unit, Motion Con= trol Software, CC-Link IE TSN Communication Software for Windows, Analysis = Support Software MELSOFT VIMA, Master/Local module Designated communication=
LSI DeviceKit, Master/Local module Designated communication LSI, Remote St= ation Communication LSI with GbE-PHY, CC-Link IE TSN Master/Local module De= signated communication LSI SDK, and Remote station software development kit=
allows an attacker with access to a CC-Link IE TSN network to tamper with = communication data (control input/output values) by sending specially craft=
ed packets under specific timing conditions. This could allow the attacker =
to cause a denial-of-service (DoS) condition in the affected product by int= erfering with its control function or causing it to operate incorrectly.</t=

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13584" target=3D= "_blank" rel=3D"noopener">CVE-2026-13584</a></td>
</tr>

<td class=3D"vendor-product">modelcontextprotocol--ruby-sdk</td>
<td>MCP Ruby SDK is the official Ruby SDK for Model Context Protocol server=
s and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTran= sport in the mcp gem does not validate the HTTP Host or Origin request head= ers, which allows a malicious browser page to use DNS rebinding to reach a = locally running MCP server and invoke exposed tools. This issue is fixed in=
version 0.23.0.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63118" target=3D= "_blank" rel=3D"noopener">CVE-2026-63118</a></td>
</tr>

<td class=3D"vendor-product">modelcontextprotocol--ruby-sdk</td>
<td>MCP Ruby SDK is the official Ruby SDK for Model Context Protocol server=
s and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTran= sport in the mcp gem does not bind a session ID to a session owner, allowin=
g an attacker with a stolen session ID to send tools/call requests that exe= cute in the victim's session. This issue is fixed in version 0.23.0.</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67431" target=3D= "_blank" rel=3D"noopener">CVE-2026-67431</a></td>
</tr>

<td class=3D"vendor-product">MotoPress--MotoPress Hotel Booking</td>
<td>The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perf= orm a capability check before returning a booking's full customer details i=
n one of its AJAX actions, allowing any authenticated user with a low-privi= leged account (Subscriber and above) to read the personal data, including n= ame, email, phone, and address, of any customer.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15235" target=3D= "_blank" rel=3D"noopener">CVE-2026-15235</a></td>
</tr>

<td class=3D"vendor-product">MPG--MPG</td>
<td>The MPG WordPress plugin before 4.1.8 does not sanitise and escape a pa= rameter before reflecting it back in the response, allowing unauthenticated=
attackers to perform Reflected Cross-Site Scripting against a victim who i=
s induced to send a crafted request.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13726" target=3D= "_blank" rel=3D"noopener">CVE-2026-13726</a></td>
</tr>

<td class=3D"vendor-product">msgpack--msgpack-ruby</td>
<td>MessagePack for Ruby is an implementation of the MessagePack binary ser= ialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack= /buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after _msgpack_b= uffer_shift_chunk returns an rmem page to the shared pool, allowing a subse= quent Buffer#write and a second MessagePack::Buffer to alias the page and d= isclose or corrupt cross-buffer data. This issue is fixed in version 1.8.2.= </td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54522" target=3D= "_blank" rel=3D"noopener">CVE-2026-54522</a></td>
</tr>

<td class=3D"vendor-product">MSI--MSI Center</td>
<td>MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalati=
on Vulnerability. This vulnerability allows local attackers to escalate pri= vileges on affected installations of MSI Center. An attacker must first obt= ain the ability to execute low-privileged code on the target system in orde=
r to exploit this vulnerability. The specific flaw exists within the NTIOLi= b_X64.sys driver. The issue results from insufficient validation of the ori= gin of commands. An attacker can leverage this vulnerability to escalate pr= ivileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-2= 8935.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-6102" target=3D"= _blank" rel=3D"noopener">CVE-2026-6102</a></td>
</tr>

<td class=3D"vendor-product">N-able--N-central</td>
<td>Authentication bypass using an alternate path or channel vulnerability =
in N-able N-central allows Authentication Bypass. This issue affects N-cent= ral: through 2026.1.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18556" target=3D= "_blank" rel=3D"noopener">CVE-2026-18556</a></td>
</tr>

<td class=3D"vendor-product">N-able--N-central</td>
<td>An incomplete patch for CVE-2026-18556 allows for authentication bypass=
and account takeover in N-central Versions through 2026.3.1</td> <td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18577" target=3D= "_blank" rel=3D"noopener">CVE-2026-18577</a></td>
</tr>

<td class=3D"vendor-product">Narrative Publisher--Narrative Publisher</td> <td>The Narrative Publisher WordPress plugin through 1.0.7 does not restric=
t write access to a REST-exposed post meta field or escape it when renderin=
g, allowing users with contributor-level access and above to store JavaScri=
pt that executes in the browser of any higher-privileged user who views the=
affected post.</td>
<td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16273" target=3D= "_blank" rel=3D"noopener">CVE-2026-16273</a></td>
</tr>

<td class=3D"vendor-product">netty--netty</td>
<td>Netty is an asynchronous, event-driven network application framework. P= rior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebS= ocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket= -Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` head= ers, completing a protocol switch that a proxy would not recognize as an Up= grade request and enabling HTTP request smuggling / protocol-confusion atta= cks. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.<=

<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59898" target=3D= "_blank" rel=3D"noopener">CVE-2026-59898</a></td>
</tr>

<td class=3D"vendor-product">netty--netty</td>
<td>Netty is an asynchronous, event-driven network application framework. P= rior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the = superclass of the production handler `HttpContentCompressor`) maintains a p= er-channel `ArrayDeque&lt;CharSequence&gt;` named `acceptEncodingQueue` tha=
t accumulates attacker-controlled data without any size limit. The queue is=
filled on the I/O thread for every inbound HTTP request and drained only w= hen the application later writes a non-1xx response. This creates a resourc=
e exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to=
flood the connection with requests faster than the application produces re= sponses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Fin= al.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59899" target=3D= "_blank" rel=3D"noopener">CVE-2026-59899</a></td>
</tr>

<td class=3D"vendor-product">netty--netty</td>
<td>Netty is an asynchronous, event-driven network application framework. P= rior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x=
translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2To= HttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/=
2 client supplies both the `:authority` pseudo-header and a literal `host` = header in a single HEADERS frame. The translator maps `:authority` to `Host=
` and separately copies the literal `host` header, producing an `HttpReques=
t` object containing two `Host` headers with attacker-controlled differing = values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Fina= l.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59900" target=3D= "_blank" rel=3D"noopener">CVE-2026-59900</a></td>
</tr>

<td class=3D"vendor-product">netty--netty</td>
<td>Netty is an asynchronous, event-driven network application framework. P= rior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler=
in Netty's compression codec pipeline is vulnerable to a denial-of-service=
attack through a malformed bzip2 stream that permanently captures the even= t-loop thread in an infinite loop. The vulnerability exists in the run-leng=
th encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. T= his issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59901" target=3D= "_blank" rel=3D"noopener">CVE-2026-59901</a></td>
</tr>

<td class=3D"vendor-product">NewStatPress--NewStatPress</td>
<td>The NewStatPress WordPress plugin before 1.4.5 does not sanitise and es= cape data derived from unauthenticated visitor requests before storing it a=
nd later outputting it in one of its widgets, which could allow unauthentic= ated attackers to perform Stored Cross-Site Scripting attacks against users=
viewing the affected widget.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14845" target=3D= "_blank" rel=3D"noopener">CVE-2026-14845</a></td>
</tr>

<td class=3D"vendor-product">ninenines--cowboy</td>
<td>Allocation of Resources Without Limits or Throttling vulnerability in n= inenines cowboy allows an unauthenticated remote attacker to exhaust connec= tion process memory over HTTP/1.1. The HTTP/1.1 handler in cowboy_http enfo= rces the max_headers limit by counting the number of distinct header names =
in a map (maps:size(Headers)). When a request contains multiple header line=
s with the same name, the values are concatenated into a single ever-growin=
g binary stored under that one map key (", " for regular headers, "; " for = cookies), so the map size stays at one and the max_headers cap (default 100=
) is never reached. Because no accumulator bounds the total number of heade=
r lines or the total byte size of the header block (only per-line max_heade= r_name_length and max_header_value_length apply), an unauthenticated client=
can send an arbitrary number of header lines with the same name and grow t=
he connection process's binary memory to arbitrary size within the request = window. The impact per connection is bounded by request_timeout (default 5 = seconds, not reset by header data), and by max_heap_size when set (the offe= nding connection process is killed once its heap grows past the limit). Whe=
n max_heap_size is left at the default (unset), sustained abuse can drive t=
he Erlang VM into out-of-memory conditions. This issue affects cowboy from = 2.0.0-pre.4 before 2.18.0.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65624" target=3D= "_blank" rel=3D"noopener">CVE-2026-65624</a></td>
</tr>

<td class=3D"vendor-product">ninenines--cowlib</td>
<td>Allocation of resources without limits vulnerability in ninenines cowli=
b allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory =
on the vulnerable server (or client) and cause a denial of service. The HPA=
CK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src= /cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl=
and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads cont= inuation octets until it sees one whose high bit is clear, evaluating Int +=
(Value bsl M) at each step with the shift M growing by seven per octet. No=
limit is enforced on the number of continuation octets, on the resulting b=
it width, or on the value; the decoder consumes whatever encoded length the=
peer supplies. Because Erlang integers are immutable, each intermediate Va= lue bsl M and each accumulator update allocates a fresh bignum whose digit = width grows linearly with the number of octets processed so far. Summed acr= oss the whole decode, the transient bignum digit materialization is on the = order of the square of the encoded length. A single maximal HPACK indexed r= epresentation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame=
at Cowboy's default max_frame_size_received can force hundreds of megabyte=
s of transient allocation and garbage-collection churn before the resulting=
header-table index is rejected as invalid. Repeated or concurrent connecti= ons multiply the pressure and can drive the Erlang VM to memory exhaustion.=
Cowlib is the HTTP parser used by Cowboy, RabbitMQ's management plugin, an=
d other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exp= osed endpoint that accepts HPACK or QPACK from an untrusted peer is reachab= le. This issue affects cowlib: from 2.0.0 before 2.19.0.</td> <td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59248" target=3D= "_blank" rel=3D"noopener">CVE-2026-59248</a></td>
</tr>

<td class=3D"vendor-product">nodejs--node</td>
<td>A flaw in Node.js Permission Model enforcement allows `trace_events.cre= ateTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This c=
an lead to confidentiality impact or bypass of the intended security bounda=
ry under affected configurations. This vulnerability affects Node.js **22.x= **, **24.x**, and **26.x**.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56847" target=3D= "_blank" rel=3D"noopener">CVE-2026-56847</a></td>
</tr>

<td class=3D"vendor-product">nodejs--node</td>
<td>A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-arr=
ay key collisions, allowing mutual TLS (mTLS) client identities to be reuse=
d across requests configured with different client certificates. This vulne= rability affects Node.js **26.x**, **24.x**, and **22.x**.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-56850" target=3D= "_blank" rel=3D"noopener">CVE-2026-56850</a></td>
</tr>

<td class=3D"vendor-product">nodejs--node</td>
<td>A flaw in Node.js Permission Model enforcement allows process.report wr= ites (and overwrites) files outside --allow-fs-write paths. This can lead t=
o confidentiality impact or bypass of the intended security boundary under = affected configurations. This vulnerability affects Node.js **22.x**, **24.= x**, and **26.x**.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58039" target=3D= "_blank" rel=3D"noopener">CVE-2026-58039</a></td>
</tr>

<td class=3D"vendor-product">nodejs--node</td>
<td>An incomplete fix has been identified in Node.js: HTTPS Agent TLS sessi=
on reuse skips hostname verification across identity policies (incomplete f=
ix of CVE-2026-48934). This vulnerability affects Node.js **22.x**, **24.x*=
*, and **26.x**.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58040" target=3D= "_blank" rel=3D"noopener">CVE-2026-58040</a></td>
</tr>

<td class=3D"vendor-product">nodejs--node</td>
<td>A flaw in Node.js Permission Model enforcement can over-grant filesyste=
m access across radix-tree prefix boundaries. Under `--permission`, an atta= cker who is granted access to one path can abuse boundary handling to read = from or write to paths outside the intended filesystem allowlist. This vuln= erability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58043" target=3D= "_blank" rel=3D"noopener">CVE-2026-58043</a></td>
</tr>

<td class=3D"vendor-product">Online Scheduling and Appointment Booking Syst= e--Online Scheduling and Appointment Booking System</td>
<td>The Online Scheduling and Appointment Booking System WordPress plugin b= efore 27.8 does not sanitize or properly cast a user-supplied parameter fro=
m its unauthenticated front-end booking requests before using it in a SQL q= uery, allowing unauthenticated attackers to perform SQL injection attacks a=
nd extract sensitive data such as password hashes from the database.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13395" target=3D= "_blank" rel=3D"noopener">CVE-2026-13395</a></td>
</tr>

<td class=3D"vendor-product">open-circle--valibot</td>
<td>Valibot helps validate data using a schema. Versions prior to 1.4.2 can=
throw a TypeError inside its flatten() helper when validation issues conta=
in attacker-controlled object keys such as toString, valueOf, or hasOwnProp= erty. The issue is reachable through normal record() validation. record() i= ntentionally filters __proto__, prototype, and constructor, but it still ac= cepts other own keys that collide with inherited Object.prototype propertie=
s. If the record key schema or value schema rejects such an entry, Valibot = creates an issue path containing that key. Passing the resulting issues to = Valibot's documented flatten() helper causes flatErrors.nested[dotPath] to = resolve to the inherited method instead of an own error array, and the help=
er calls .push(...) on that function. This is not a global prototype pollut= ion issue. The impact is availability/error handling: applications that val= idate user-controlled objects with record() and flatten validation errors f=
or API responses can crash the request path with a TypeError instead of ret= urning structured validation errors. This issue has been fixed in version 1= .4.2.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59952" target=3D= "_blank" rel=3D"noopener">CVE-2026-59952</a></td>
</tr>

<td class=3D"vendor-product">open-iscsi--open-iscsi</td>
<td>An Improper Limitation of a Pathname to a Restricted Directory ('Path T= raversal') vulnerability in open-iscsi allows remote MITM attackers=C2=A0 t=
o create root-owned files outside the database and inject lines into the re= cord. This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae= 1d67c9c8909237e.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44943" target=3D= "_blank" rel=3D"noopener">CVE-2026-44943</a></td>
</tr>

<td class=3D"vendor-product">open-iscsi--open-iscsi</td>
<td>An Incorrect Authorization vulnerability in open-iscsi allows=C2=A0unpr= ivilidged local users to use the isscsiuio control socket. This issue affec=
ts open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.</td=

<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-44944" target=3D= "_blank" rel=3D"noopener">CVE-2026-44944</a></td>
</tr>

<td class=3D"vendor-product">open-iscsi--open-iscsi</td>
<td>A Double Free vulnerability in open-iscsi allows an=C2=A0unauthenticate= d=C2=A0MITM attacker to cause=C2=A0DoS. This issue affects open-iscsi: from=
? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55995" target=3D= "_blank" rel=3D"noopener">CVE-2026-55995</a></td>
</tr>

<td class=3D"vendor-product">OpenSBI--OpenSBI</td>
<td>An issue was discovered in OpenSBI 1.3 allowing attackers to cause a de= nial of service via crafted request to the SBI function #2 or the 'Find and=
configure a matching counter' function of SBI PMU extension.</td>

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-63913" target=3D= "_blank" rel=3D"noopener">CVE-2025-63913</a></td>
</tr>

<td class=3D"vendor-product">OpenSolution--Quick.Cart</td>
<td>Quick.Cart stores hard-coded, plaintext admin credentials in a configur= ation file. This flaw allows attackers with access to the server file syste=
m to retrieve authentication details, potentially leading to privilege esca= lation. The vendor assessed the likelihood of exploitation as very low and = determined that a fix is=C2=A0not necessary. Only version 6.7 was tested bu=
t all versions should be considered as vulnerable.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-41874" target=3D= "_blank" rel=3D"noopener">CVE-2026-41874</a></td>
</tr>

<td class=3D"vendor-product">OpenSolution--Quick.CMS</td>
<td>A Blind SQL injection vulnerability has been identified in Quick.CMS. I= mproper neutralization of input provided by a high-privileged user into mul= tiple fields in administration panel allows for Blind SQL Injection attacks=
. The vendor states that this administration panel already allows for signi= ficant modification capabilities. The SQL injection vulnerability primarily=
enables bypassing front-end validation controls and potential database des= truction. Given the trust model in which this application is designed to be=
administered, remediation of this issue was not deemed necessary by the ve= ndor. This vulnerability has been found in version 6.8, but other versions = might also be vulnerable.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-33385" target=3D= "_blank" rel=3D"noopener">CVE-2026-33385</a></td>
</tr>

<td class=3D"vendor-product">OpenSolution--Quick.CMS</td>
<td>In Quick.CMS, the administrative user interface restricts deletion of t=
he primary language by omitting the corresponding option from the interface=
; however, the underlying language-deletion API endpoint does not enforce a=
n equivalent server-side authorization check. As a result, an authenticated=
administrator can bypass the UI-level restriction and delete the primary l= anguage by sending a direct HTTP request to the API endpoint. Successful de= letion of the primary language results in a Denial of Service (DoS) of appl= ication. Critically, when combined with a separate Cross-Site Request Forge=
ry (CSRF) vulnerability (CVE-2026-1468)=C2=A0an unauthenticated remote atta= cker can craft a malicious link, which if visited by an authenticated admin= istrator, will trigger the DoS condition without direct access to the appli= cation The vendor assessed the likelihood of exploitation as very low and d= etermined that a fix is=C2=A0not necessary.</td>

<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63301" target=3D= "_blank" rel=3D"noopener">CVE-2026-63301</a></td>
</tr>

<td class=3D"vendor-product">OpenSolution--Quick.CMS</td>
<td>Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php = endpoint via the p parameter. An authenticated attacker with admin privileg=
es can include arbitrary files located within the application's directory s= tructure via a crafted HTTP request. Successful exploitation allows disclos= ure of the server's directory structure and absolute file paths (path discl= osure). The vendor assessed the likelihood of exploitation as very low and = determined that a fix is=C2=A0not necessary.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63302" target=3D= "_blank" rel=3D"noopener">CVE-2026-63302</a></td>
</tr>

<td class=3D"vendor-product">OpenSolution--Quick.CMS</td>
<td>A Path Traversal vulnerability exists in Quick.CMS through the URI path=
component of HTTP requests, where the server fails to normalize dot-dot-sl= ash (../) sequences before resolving and serving the requested file. An aut= henticated attacker with admin privileges=C2=A0can use this vulnerability t=
o read contents of files located in the sibling directory of the webroot vi=
a a crafted HTTP request containing ../ sequences in the URI. The vendor as= sessed the likelihood of exploitation as very low and determined that a fix=
is=C2=A0not necessary.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-63303" target=3D= "_blank" rel=3D"noopener">CVE-2026-63303</a></td>
</tr>

<td class=3D"vendor-product">OpenVPN--OpenVPN</td>
<td>OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allow=
s attackers via an off-by-one buffer write in the NTLM proxy authentication=
to potentially cause a crash via a crafted NTLM response from a malicious = proxy server</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11771" target=3D= "_blank" rel=3D"noopener">CVE-2026-11771</a></td>
</tr>

<td class=3D"vendor-product">OpenVPN--OpenVPN</td>
<td>A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.=
0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to ca= use a denial of service (memory exhaustion) via a flood of crafted packets<=

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12932" target=3D= "_blank" rel=3D"noopener">CVE-2026-12932</a></td>
</tr>

<td class=3D"vendor-product">OpenVPN--OpenVPN</td>
<td>A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through=
2.7.4 allows remote authenticated peers to potentially cause a denial of s= ervice or leak memory via crafted packets during TLS session promotion or e= xpiry</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12996" target=3D= "_blank" rel=3D"noopener">CVE-2026-12996</a></td>
</tr>

<td class=3D"vendor-product">OpenVPN--OpenVPN</td>
<td>An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 thro= ugh 2.7.4 allows remote authenticated peers to trigger a use-after-free dur= ing TLS session promotion, potentially leading to a denial of service or me= mory leakage</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13117" target=3D= "_blank" rel=3D"noopener">CVE-2026-13117</a></td>
</tr>

<td class=3D"vendor-product">OpenVPN--OpenVPN</td>
<td>The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 all= ows remote attackers to cause persistent DNS state pollution or a service c= rash via a crafted search domain during the disconnection process</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13379" target=3D= "_blank" rel=3D"noopener">CVE-2026-13379</a></td>
</tr>

<td class=3D"vendor-product">Outstatic CMS--Outstatic CMS</td>
<td>Outstatic CMS &lt;=3D 2.1.9 contains a hardcoded JWT signing secret. Wh=
en the OST_TOKEN_SECRET environment variable is not set, the application fa= lls back to the default value which is publicly visible in the source code = repository. An unauthenticated remote attacker can exploit this by forging = JWT session tokens with arbitrary user data and full administrative permiss= ions.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52539" target=3D= "_blank" rel=3D"noopener">CVE-2026-52539</a></td>
</tr>

<td class=3D"vendor-product">Paid Membership Subscriptions--Paid Membership=
Subscriptions</td>
<td>The Paid Membership Subscriptions WordPress plugin before 3.0.7 does no=
t perform capability or nonce checks on one of its payment-related AJAX act= ions, allowing any authenticated user with Subscriber-level access and abov=
e to disclose the payment details of any member by enumerating the payment = identifier.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14847" target=3D= "_blank" rel=3D"noopener">CVE-2026-14847</a></td>
</tr>

<td class=3D"vendor-product">Paid Membership Subscriptions--Paid Membership=
Subscriptions</td>
<td>The Paid Membership Subscriptions WordPress plugin before 3.0.7 does no=
t protect the member and payment export files it writes to a predictable lo= cation in the uploads directory, allowing unauthenticated users to download=
the exported member and payment data (including PII) while an export artif= act is present.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14849" target=3D= "_blank" rel=3D"noopener">CVE-2026-14849</a></td>
</tr>

<td class=3D"vendor-product">Participants Database--Participants Database</=

<td>The Participants Database WordPress plugin before 2.7.8.4 does not prop= erly sanitize and escape a user-supplied parameter before using it in a SQL=
query, allowing unauthenticated attackers to perform SQL injection attacks= .</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13596" target=3D= "_blank" rel=3D"noopener">CVE-2026-13596</a></td>
</tr>

<td class=3D"vendor-product">PayU CommercePro Plugin--PayU CommercePro Plug= in</td>
<td>The PayU CommercePro Plugin WordPress plugin through 3.8.9 does not ver= ify the payment-gateway signature before applying order modifications, allo= wing unauthenticated attackers to tamper with the totals, shipping and meta= data of arbitrary WooCommerce orders.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13692" target=3D= "_blank" rel=3D"noopener">CVE-2026-13692</a></td>
</tr>

<td class=3D"vendor-product">phoca.cz--Phoca Commander extension for Joomla= </td>
<td>Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Comm= ander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective=
XSS vulnerability.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65764" target=3D= "_blank" rel=3D"noopener">CVE-2026-65764</a></td>
</tr>

<td class=3D"vendor-product">phoca.cz--Phoca Commander extension for Joomla= </td>
<td>Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Com= mander 1.0.0-6.1.1 - Improper limitation of paths for save and download act= ions lead to path traversal vulnerabilities.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65765" target=3D= "_blank" rel=3D"noopener">CVE-2026-65765</a></td>
</tr>

<td class=3D"vendor-product">PhotoSwipe--PhotoSwipe</td>
<td>The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribut=
e of author-supplied link markup as a lightbox caption that is written into=
the page DOM without escaping. Because the title attribute survives the po= st-content sanitization applied to users who lack the unfiltered_html capab= ility, an authenticated user with Author-level access can store a JavaScrip=
t payload that executes in the browser of any visitor, including an adminis= trator, who clicks the link.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13605" target=3D= "_blank" rel=3D"noopener">CVE-2026-13605</a></td>
</tr>

<td class=3D"vendor-product">PHP Group--PHP</td>
<td>Improper escaping of backslashes in attacker-provided parameters would = allow for trivial SQL injection in PHP versions=C2=A0from 8.2.* before 8.2.= 33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* befo=
re 8.5.9.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17543" target=3D= "_blank" rel=3D"noopener">CVE-2026-17543</a></td>
</tr>

<td class=3D"vendor-product">PHP Group--PHP</td>
<td>Attacker-provided inputs to bccomp() could lead to an out-of-bounds wri=
te with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 = and from 8.5.* before 8.5.9.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17544" target=3D= "_blank" rel=3D"noopener">CVE-2026-17544</a></td>
</tr>

<td class=3D"vendor-product">PHP Group--PHP</td>
<td>Circular symbolic links in phar archives could lead to unbounded recurs= ion, exhausting the C stack and crashing the PHP process,=C2=A0in PHP versi= ons=C2=A0from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* bef= ore 8.4.24, and from 8.5.* before 8.5.9.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-7260" target=3D"= _blank" rel=3D"noopener">CVE-2026-7260</a></td>
</tr>

<td class=3D"vendor-product">PHP Jabbers--Appointment Scheduler</td>
<td>An authenticated SQL injection vulnerability has been identified in mul= tiple PHP Jabbers scripts. Improper neutralization of input provided by an = authenticated user into parameters responsible for sorting functions allows=
an attacker to perform SQL Injection attacks. This issue was fixed in the = versions specified in the affected products list.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-67650" target=3D= "_blank" rel=3D"noopener">CVE-2025-67650</a></td>
</tr>

<td class=3D"vendor-product">PHP Jabbers--Appointment Scheduler</td>
<td>A Cross-Site Request Forgery (CSRF) vulnerability has been identified i=
n multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate Same= Site attributes allows an attacker to send unauthorized requests in the con= text of an authenticated user, leading to unauthorized administrative actio= ns, such as creating new admin accounts. This issue was fixed in the versio=
ns specified in the affected products list.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-67651" target=3D= "_blank" rel=3D"noopener">CVE-2025-67651</a></td>
</tr>

<td class=3D"vendor-product">PHP Jabbers--Car Rental Script</td>
<td>A SQL injection vulnerability has been identified in PHP Jabbers -=C2= =A0Car Rental Script . Improper neutralization of input provided by user in=
to parameters responsible for sorting functions allows an unauthenticated a= ttacker to perform SQL Injection attacks. This issue was fixed in version 4= .1.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-67649" target=3D= "_blank" rel=3D"noopener">CVE-2025-67649</a></td>
</tr>

<td class=3D"vendor-product">PHP Jabbers--PHP Poll Script</td>
<td>A SQL injection vulnerability has been identified in the PHP Jabbers - = PHP Poll Script. Improper neutralization of input provided by user to=C2=A0= pjAdminPolls.controller.php endpoint allows an authenticated attacker to pe= rform SQL Injection attacks. This issue was fixed in version 4.1.</td> <td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-46593" target=3D= "_blank" rel=3D"noopener">CVE-2026-46593</a></td>
</tr>

<td class=3D"vendor-product">PHP Jabbers--PHP Poll Script</td>
<td>A reflected cross-site scripting (XSS) vulnerability has been identifie=
d in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a sp= ecially crafted URL that, when opened, results in arbitrary JavaScript exec= ution in the victim's browser. This issue was fixed in version 4.1.</td> <td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-46594" target=3D= "_blank" rel=3D"noopener">CVE-2026-46594</a></td>
</tr>

<td class=3D"vendor-product">Pivotick--Pivotick</td>
<td>Pivotick contains a cross-site scripting vulnerability in the inspect a=
nd edit node modals. Node labels and descriptions originating from graph da=
ta were interpolated directly into HTML used to construct the modal headers=
. An attacker able to supply or modify graph data could insert a malicious = HTML or JavaScript payload into a node's label or description. The payload = would be parsed and executed in the application's origin when a user opened=
the affected node's inspect or edit modal. Successful exploitation could a= llow the attacker to access information available to the victim, modify app= lication data, or perform actions using the victim's active session. The vu= lnerability has been addressed by creating the modal elements without embed= ding graph data in HTML and assigning node labels and descriptions through = textContent.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66919" target=3D= "_blank" rel=3D"noopener">CVE-2026-66919</a></td>
</tr>

<td class=3D"vendor-product">Pivotick--Pivotick</td>
<td>Pivotick contains an uncontrolled-recursion vulnerability when processi=
ng caller-supplied graph and node data. The affected graph algorithms recur= sively traversed graph edges, while the JSON viewer recursively processed e= ach level of a node's data structure. A specially crafted graph containing =
an excessively long path, deeply nested properties, or circular object refe= rences could therefore exhaust the JavaScript call stack when Pivotick calc= ulates a layout or displays a node in the inspection modal. Successful expl= oitation may cause an uncaught exception, freeze the affected page, or cras=
h the browser tab, resulting in a client-side denial of service. No confide= ntiality or integrity impact has been identified. The patch replaces the re= cursive graph traversals with iterative stack-based implementations and lim= its the reachability calculation to 1,000,000 edge traversals. It also limi=
ts JSON rendering to 64 levels and detects circular references before desce= nding further into an object.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66920" target=3D= "_blank" rel=3D"noopener">CVE-2026-66920</a></td>
</tr>

<td class=3D"vendor-product">pivotick--pivotick</td>
<td>Pivotick contains a cross-site scripting vulnerability in the sidebar p= roperty-list component. Values associated with link-like properties, such a=
s url, uri, href, link, website, or homepage, were rendered as hyperlinks w= ithout validating their URL scheme. An attacker able to supply or influence=
node or edge property data could provide a malicious value using the javas= cript: scheme, including variants obfuscated with whitespace or control cha= racters. If a user clicked the generated property link, attacker-controlled=
JavaScript could execute in the context of the Pivotick application. Succe= ssful exploitation could allow the attacker to access information available=
to the victim's browser session or perform actions with the victim's privi= leges. The vulnerability was addressed by normalizing property values and p= reventing URLs with non-allowlisted schemes from being rendered as clickabl=
e links.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66825" target=3D= "_blank" rel=3D"noopener">CVE-2026-66825</a></td>
</tr>

<td class=3D"vendor-product">pivotick--pivotick</td>
<td>Pivotick fails to sanitize attacker-controlled SVG markup supplied thro= ugh the per-node style.svgIcon property before inserting it into the docume= nt. When rendering a graph node, the vulnerable code assigns the SVG icon m= arkup directly to the innerHTML property of a live SVG element. An attacker=
able to influence graph data can provide crafted markup containing executa= ble event handlers, such as an &lt;image&gt; element with an onerror attrib= ute. When a victim loads or renders the malicious graph, the payload may ex= ecute arbitrary JavaScript in the security context of the application embed= ding Pivotick. Successful exploitation could allow the attacker to access a= pplication data available to the victim, modify displayed content, or perfo=
rm actions using the victim's authenticated session. Exploitation requires =
an application using Pivotick to render graph data that is controlled or mo= dified by an attacker.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66918" target=3D= "_blank" rel=3D"noopener">CVE-2026-66918</a></td>
</tr>

<td class=3D"vendor-product">pivotick--pivotick</td>
<td>Pivotick's Markdown node-reference renderer failed to HTML-escape the a= ttacker-controlled nodeName value before interpolating it into both the dat= a-node-name attribute and the body of a generated &lt;span&gt; element. Bec= ause the node-reference tokenizer rejected only square brackets, a crafted = node name could still contain quotation marks, angle brackets, or other HTM=
L metacharacters. An attacker could therefore terminate the quoted attribut=
e or inject additional HTML elements and event-handler attributes. When mal= icious node-reference content is rendered by a consumer that does not apply=
DOMPurify or equivalent sanitization, arbitrary JavaScript may execute in = the victim's browser in the security context of the application. Successful=
exploitation requires a victim to open or render a crafted graph or note a=
nd could allow the attacker to access same-origin information, modify displ= ayed content, or perform actions using the victim's session. The patch reso= lves the issue by applying context-appropriate HTML escaping to node names = before inserting them into either HTML text or quoted attribute values. The=
shared escaping function now encodes ampersands, angle brackets, and both = types of quotation marks.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66921" target=3D= "_blank" rel=3D"noopener">CVE-2026-66921</a></td>
</tr>

<td class=3D"vendor-product">pivotick--pivotick</td>
<td>Pivotick used plain JavaScript objects as lookup tables indexed by call= er-controlled graph node identifiers in its tree-layout and cycle-detection=
components. Node identifiers matching properties inherited from Object.pro= totype, such as constructor, toString, or __proto__, were not handled as or= dinary identifiers. These values could be interpreted as existing inherited=
properties, resolve to values of an unexpected type, or-in the case of __p= roto__ assignments-modify the prototype of an internal lookup object. An at= tacker who can supply graph data containing crafted node identifiers could = consequently cause nodes or edges to be silently omitted, produce incorrect=
hierarchy levels, bypass or corrupt cycle-detection results, or trigger an=
exception that interrupts graph processing and rendering. This affects the=
integrity of graph visualisations and analytics and may cause a client-sid=
e denial-of-service condition. The affected code also failed to safely hand=
le edges whose source node was absent from the supplied node set. Furthermo= re, calculating the maximum tree depth by spreading all level values into M= ath.max() could exceed the JavaScript function-argument limit when processi=
ng a sufficiently large graph, resulting in an exception and denial of serv= ice. The patch replaces identifier-keyed plain objects with Map instances, = ignores invalid edges during tree construction, and calculates the maximum = depth iteratively.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66922" target=3D= "_blank" rel=3D"noopener">CVE-2026-66922</a></td>
</tr>

<td class=3D"vendor-product">pivotick--pivotick</td>
<td>Pivotick did not validate the URL scheme of node imagePath values deriv=
ed from graph data before assigning them to SVG image resources. An attacke=
r able to supply crafted graph data could set an image path to a malicious = URI. When a victim rendered the affected graph, the browser could resolve t=
he attacker-controlled URI and initiate an unintended request or invoke sch= eme-specific handling in the victim's context. Depending on the URI, browse=
r behaviour, and installed protocol handlers, exploitation could disclose l= imited client or network metadata, facilitate rendering-based tracking, or = attempt to access local or internal resources. Exploitation requires a vict=
im to load or render graph data containing the malicious imagePath. The pat=
ch normalizes ASCII whitespace and control characters in URI schemes and re= stricts image paths to relative URLs or the http, https, data, and blob sch= emes.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67173" target=3D= "_blank" rel=3D"noopener">CVE-2026-67173</a></td>
</tr>

<td class=3D"vendor-product">pivotick--pivotick</td>
<td>Pivotick contains a DOM-based cross-site scripting vulnerability in its=
generic UI element resolution and icon-rendering utilities. The tryResolve= HTMLElement function treated any resolved string as HTML markup by assignin=
g it to a &lt;template&gt; element through innerHTML. Strings derived from = untrusted graph properties or custom rendering callbacks could therefore in= troduce arbitrary HTML or SVG elements into the live document. The vulnerab=
le function was used by multiple UI components, including headers, property=
panels, extra panels, and tooltips. Additionally, createIcon inserted call= er-supplied svgIcon markup into a template without sanitization. An applica= tion integrating Pivotick and deriving icon markup from untrusted data coul=
d therefore expose a second script-execution path. An unauthenticated attac= ker able to provide a crafted graph, property value, rendering result, or S=
VG icon could execute JavaScript in another user's browser when the affecte=
d content is displayed or interacted with. Successful exploitation could al= low the attacker to access information available to the victim, manipulate = graph data or application state, and perform actions with the victim's priv= ileges. The patch changes string rendering to use textContent, requiring ca= llers to explicitly return an Element when HTML rendering is intended. It a= lso sanitizes SVG icon markup before inserting it into the DOM.</td> <td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67174" target=3D= "_blank" rel=3D"noopener">CVE-2026-67174</a></td>
</tr>

<td class=3D"vendor-product">Pixel Tag Manager for WooCommerce--Pixel Tag M= anager for WooCommerce</td>
<td>The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 doe=
s not perform an authorization check on one of its AJAX actions, allowing u= nauthenticated users to submit forged e-commerce conversion events to the s= ite's configured server-side advertising conversion APIs using the site's s= tored credentials.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14315" target=3D= "_blank" rel=3D"noopener">CVE-2026-14315</a></td>
</tr>

<td class=3D"vendor-product">Pixelavo--Pixelavo</td>
<td>The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated=
AJAX action, gated only by a nonce that it emits publicly on every front-e=
nd page, that forwards client-supplied event data to the configured Faceboo=
k Conversions API using the administrator's stored access token. This allow=
s an unauthenticated visitor to inject arbitrary conversion events into the=
administrator's Facebook ads account and exhaust the configured API quota.= </td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13604" target=3D= "_blank" rel=3D"noopener">CVE-2026-13604</a></td>
</tr>

<td class=3D"vendor-product">Podlove Podcast Publisher--Podlove Podcast Pub= lisher</td>
<td>The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not pe= rform nonce validation on some of its administrative create and delete acti= ons, allowing attackers to create rogue records or delete legitimate ones v=
ia a forged request (CSRF) when a logged-in administrator is tricked into v= isiting a crafted page.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13729" target=3D= "_blank" rel=3D"noopener">CVE-2026-13729</a></td>
</tr>

<td class=3D"vendor-product">Points and Rewards for WooCommerce--Points and=
Rewards for WooCommerce</td>
<td>The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 d= oes not have authorisation checks in place on a wallet and points update ac= tion that is available to unauthenticated users, and does not verify that t=
he requester owns the account being changed, allowing unauthenticated attac= kers to arbitrarily modify or corrupt (including driving it negative) the s= tored wallet balance and loyalty points of any user. Modifying the wallet b= alance additionally requires the companion Wallet System for WooCommerce Po= ints and Rewards for WooCommerce WordPress plugin before 2.10.1 to be activ= e.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11782" target=3D= "_blank" rel=3D"noopener">CVE-2026-11782</a></td>
</tr>

<td class=3D"vendor-product">POUCO Import Users--POUCO Import Users</td>

<td>The POUCO Import Users WordPress plugin through 1.0.0 does not perform = any capability or nonce checks on AJAX actions available to unauthenticated=
users that create and update WordPress accounts, and it trusts an attacker= -supplied role value, allowing unauthenticated attackers to create a new ad= ministrator account and take over the site.</td>
<td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16256" target=3D= "_blank" rel=3D"noopener">CVE-2026-16256</a></td>
</tr>

<td class=3D"vendor-product">PrestaShop--PrestaShop</td>
<td>PrestaShop module, totadministrativemandate &lt;1.8.1 is vulnerable to = Cross Site Request Forgery (CSRF). The payment validation controller has no=
CSRF token. An attacker can confirm an order in an awaiting status by hija= cking a link.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50986" target=3D= "_blank" rel=3D"noopener">CVE-2026-50986</a></td>
</tr>

<td class=3D"vendor-product">pretix GmbH--pretix</td>
<td>The "quick setup" view presented to users after they first create an ev= ent allows to set up the most critical parts of an event in just a few clic= ks. This view did not properly check that the user has permission to change=
configuration for the given event. An attacker could use a well-timed requ= est to create products, quotas, set bank transfer configuration, or connect=
a stripe account to an event they do not have access to.</td>

<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18028" target=3D= "_blank" rel=3D"noopener">CVE-2026-18028</a></td>
</tr>

<td class=3D"vendor-product">pretix GmbH--pretix-girosolution</td>
<td>Our payment integration with GiroCheckout did not properly validate pay= ment status responses. An attacker could use a successful payment status re= sponse from one payment and supply it to the system for a different payment=
, gaining access to multiple valid tickets with only one payment.</td> <td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18029" target=3D= "_blank" rel=3D"noopener">CVE-2026-18029</a></td>
</tr>

<td class=3D"vendor-product">Printcart Web to Print Product Designer for Wo= oCommerce--Printcart Web to Print Product Designer for WooCommerce</td>
<td>The Printcart Web to Print Product Designer for WooCommerce WordPress p= lugin before 2.5.3 does not restrict a user-supplied URL before fetching it=
server-side and does not enforce a valid authorization check, allowing una= uthenticated attackers to read arbitrary local files (including configurati=
on files containing database credentials and secret keys) and to make serve= r-side requests to internal resources.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-15662" target=3D= "_blank" rel=3D"noopener">CVE-2025-15662</a></td>
</tr>

<td class=3D"vendor-product">ProfileGrid--ProfileGrid</td>
<td>The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which=
group an anonymous visitor may register into through its front-end registr= ation, allowing unauthenticated users to register directly into a privilege=
d group and be granted that group's configured role, up to Administrator wh=
en such a group exists, leading to privilege escalation.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12687" target=3D= "_blank" rel=3D"noopener">CVE-2026-12687</a></td>
</tr>

<td class=3D"vendor-product">ProfileGrid--ProfileGrid</td>
<td>The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a = notification belongs to the requesting user before deleting it, allowing an=
y authenticated user such as a Subscriber to delete other users' notificati= ons by enumerating notification identifiers.</td>
<td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16291" target=3D= "_blank" rel=3D"noopener">CVE-2026-16291</a></td>
</tr>

<td class=3D"vendor-product">Python Packaging Authority--pip</td>
<td>pip would incorrectly handle doubly-encoded package URLs from indexes a= llowing for files to be installed to arbitrary locations on disk even when = installing wheels. This vulnerability requires downloading or installing a = package from a malicious package index to succeed, malicious packages alone=
are not able to exploit this vulnerability. Note that this vulnerability o= nly materially impacts users running `pip download` with the `--only-binary=
` option as installing source distributions from an untrusted index is alre= ady an unsafe operation that executes code during install time.</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13346" target=3D= "_blank" rel=3D"noopener">CVE-2026-13346</a></td>
</tr>

<td class=3D"vendor-product">Python Software Foundation--CPython</td> <td>`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(= n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last= ()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.= find()` is only affected when the first match is near the end=C2=A0 of the = sibling list, such as with `[last()]` or `[last()-N]`;=C2=A0 `.//item[1]` s= hort-circuits after the first match.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-6879" target=3D"= _blank" rel=3D"noopener">CVE-2026-6879</a></td>
</tr>

<td class=3D"vendor-product">Quest--KACE Systems Deployment Appliance</td> <td>An issue was discovered in Quest KACE Systems Deployment Appliance (SMA=
) 11.0.273. If a customer restricts access to the web console by IP address=
or subnets, the API endpoints are not restricted. If credentials/API keys = are known to an attacker, the appliance can still be accessed via the API, = leading to a potential compromise of the entire environment that is configu= red for KACE.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2021-32084" target=3D= "_blank" rel=3D"noopener">CVE-2021-32084</a></td>
</tr>

<td class=3D"vendor-product">Quest--KACE Systems Deployment Appliance</td> <td>An issue was discovered in Quest KACE Systems Deployment Appliance (SMA=
) 11.0.273. It installs with default user credentials. The report and R1 My= SQL accounts have a password of box747, which is publicly known and documen= ted. This allows remote attackers to trivially gain privileged access to th=
e MySQL databases. Sensitive information is stored in the database, such as=
privileged credentials for other systems.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2021-32085" target=3D= "_blank" rel=3D"noopener">CVE-2021-32085</a></td>
</tr>

<td class=3D"vendor-product">Quest--KACE Systems Deployment Appliance</td> <td>An issue was discovered in Quest KACE Systems Deployment Appliance (SMA=
) 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets=
in the MySQL databases. (This key is not unique for each installation.) An=
attacker that gains access to the MySQL server or a backup files can decry=
pt the secrets. Often, the decrypted secrets can be used to escalate privil= eges within KACE, or gain privileged access to unrelated systems or service= s.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2021-32086" target=3D= "_blank" rel=3D"noopener">CVE-2021-32086</a></td>
</tr>

<td class=3D"vendor-product">Quest--KACE Systems Deployment Appliance</td> <td>An issue was discovered in Quest KACE Systems Deployment Appliance (SMA=
) 11.0.273. It installs with default user credentials. The kbftp account ha=
s a password of getbxf, which is publicly known and documented. This allows=
remote attackers to trivially gain privileged access to the FTP service in= terface, which contains MySQL backups. Sensitive information is stored in t=
he database, such as privileged credentials for other systems.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2021-32087" target=3D= "_blank" rel=3D"noopener">CVE-2021-32087</a></td>
</tr>

<td class=3D"vendor-product">Quest--KACE Systems Deployment Appliance</td> <td>An issue was discovered in Quest KACE Systems Deployment Appliance (SMA=
) 11.0.273. Certain API endpoints contain a rate-limiting feature to minimi=
ze a brute-force attack. This protection can be bypassed by removing the kb= oxid cookie.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2021-32088" target=3D= "_blank" rel=3D"noopener">CVE-2021-32088</a></td>
</tr>

<td class=3D"vendor-product">Quiz and Survey Master (QSM)--Quiz and Survey = Master (QSM)</td>
<td>The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does no=
t implement rate limiting or standard failed-login auditing on its front-en=
d credential-check functionality and returns distinct responses for valid a=
nd invalid accounts, allowing unauthenticated attackers to enumerate valid = usernames and to brute-force passwords while bypassing brute-force protecti=
on Quiz and Survey Master (QSM) WordPress plugin before 11.1.3.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14820" target=3D= "_blank" rel=3D"noopener">CVE-2026-14820</a></td>
</tr>

<td class=3D"vendor-product">Quiz and Survey Master (QSM)--Quiz and Survey = Master (QSM)</td>
<td>The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does no=
t perform a capability check before deleting output templates, allowing use=
rs with contributor-level access and above to delete arbitrary templates.</=

<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14821" target=3D= "_blank" rel=3D"noopener">CVE-2026-14821</a></td>
</tr>

<td class=3D"vendor-product">rails--rails</td>
<td>Action Pack is a framework for handling and responding to web requests.=
In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not=
disable libvips operations marked unsafe for untrusted content, allowing a=
crafted upload to invoke such an operation. Consuming applications are aff= ected when configured to use libvips and accept image uploads from untruste=
d users. An unauthenticated attacker may exploit this behavior to read arbi= trary files accessible to the Rails process, including environment variable=
s and application secrets. Exposure of credentials such as secret_key_base =
or external-service tokens may enable remote code execution or lateral move= ment. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.</=

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66066" target=3D= "_blank" rel=3D"noopener">CVE-2026-66066</a></td>
</tr>

<td class=3D"vendor-product">Realtyna Organic IDX plugin + WPL Real Estate-= -Realtyna Organic IDX plugin + WPL Real Estate</td>
<td>The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin befo=
re 5.3.0 does not validate the type of uploaded files, and its file upload = functionality is gated only by an API that is enabled by default and authen= ticated with hardcoded credentials shipped identically across all installat= ions. This makes it possible for unauthenticated attackers to upload arbitr= ary PHP files and achieve remote code execution.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13714" target=3D= "_blank" rel=3D"noopener">CVE-2026-13714</a></td>
</tr>

<td class=3D"vendor-product">RegistrationMagic--RegistrationMagic</td>

<td>The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly=
validate that a one-time password presented in a cookie belongs to the ide= ntity being requested before returning front-end form submissions, allowing=
unauthenticated attackers to read other users' form submission data, inclu= ding personal information.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15255" target=3D= "_blank" rel=3D"noopener">CVE-2026-15255</a></td>
</tr>

<td class=3D"vendor-product">RegistrationMagic--RegistrationMagic</td>

<td>The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform = authorization, ownership or nonce checks on a front-end submission-editing = action, allowing unauthenticated attackers to overwrite other users' form s= ubmissions and the profile fields of the associated non-administrator WordP= ress accounts.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15257" target=3D= "_blank" rel=3D"noopener">CVE-2026-15257</a></td>
</tr>

<td class=3D"vendor-product">remix-run--react-router</td>
<td>React Router is a router for React. Versions 6.0.0 through 7.17.0 are v= ulnerable to Open Redirtect through use of backslashes in &lt;Link&gt; and = useNavigate. This issue is a follow up to CVE-2025-68470 and has been fixed=
in version 7.18.0.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53669" target=3D= "_blank" rel=3D"noopener">CVE-2026-53669</a></td>
</tr>

<td class=3D"vendor-product">remix-run--react-router</td>
<td>React Router is a router for React. In versions 7.0.0 through 7.17.0, t=
he manifest endpoint could be accessed via unauthenticated targeted request=
s that would put heavy load on the server and slow down response times. Thi=
s issue is a follow up to CVE-2026-42342, and does not does not impact Reac=
t Router applications using Declarative Mode (&lt;BrowserRouter&gt;) or Dat=
a Mode (createBrowserRouter/&lt;RouterProvider&gt;). This issue has been fi= xed in version 7.18.0.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55685" target=3D= "_blank" rel=3D"noopener">CVE-2026-55685</a></td>
</tr>

<td class=3D"vendor-product">Remote API--Remote API</td>
<td>The Remote API WordPress plugin through 0.2 does not authenticate a req= uest before deserializing user-supplied input, allowing unauthenticated att= ackers to inject arbitrary PHP objects, which can lead to remote code execu= tion when a suitable gadget chain is present through another installed Remo=
te API WordPress plugin through 0.2.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14602" target=3D= "_blank" rel=3D"noopener">CVE-2026-14602</a></td>
</tr>

<td class=3D"vendor-product">RFC--Hiawatha v.12.1</td>
<td>An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote att= acker to execute arbitrary code via a crafted request</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-51785" target=3D= "_blank" rel=3D"noopener">CVE-2026-51785</a></td>
</tr>

<td class=3D"vendor-product">Rocket.Chat--Rocket.Chat</td>
<td>Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.=
7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bin=
d the validated signature to samlp:Response / saml:Assertion. An attacker c= ould submit a wrapped document carrying forged identity attributes alongsid=
e any valid signature made by the trusted IdP certificate, and log in as an=
arbitrary user.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58066" target=3D= "_blank" rel=3D"noopener">CVE-2026-58066</a></td>
</tr>

<td class=3D"vendor-product">rolandd.com--RO CSVI extension for Joomla</td> <td>Joomla Extension - rolandd.com - Unauthenticated directory creation RO = CSVI &lt; 9.11.0</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65943" target=3D= "_blank" rel=3D"noopener">CVE-2026-65943</a></td>
</tr>

<td class=3D"vendor-product">rolandd.com--RO CSVI extension for Joomla</td> <td>Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers=
RO CSVI &lt; 9.11.0</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65944" target=3D= "_blank" rel=3D"noopener">CVE-2026-65944</a></td>
</tr>

<td class=3D"vendor-product">rolandd.com--RO CSVI extension for Joomla</td> <td>Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers =
RO CSVI &lt; 9.11.0</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65946" target=3D= "_blank" rel=3D"noopener">CVE-2026-65946</a></td>
</tr>

<td class=3D"vendor-product">Roskus--Prospero Flow CRM</td>
<td>Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM=
before 5.3.7 allows authenticated users holding the create or update lead = permission to execute arbitrary JavaScript in the application origin via HT=
ML markup stored in the lead name field, which the view renders through Bla= de's unescaped output directive and inside a JavaScript string literal in a=
n onclick attribute.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59232" target=3D= "_blank" rel=3D"noopener">CVE-2026-59232</a></td>
</tr>

<td class=3D"vendor-product">Roskus--Prospero Flow CRM</td>
<td>Stored Cross-site Scripting (CWE-79) in the email module in Roskus Pros= pero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged us=
er to execute arbitrary JavaScript in another user's browser, including adm= inistrators, leading to session compromise and account takeover, via a payl= oad stored in an email body that is persisted without sanitization and rend= ered unescaped with {!! $email-&gt;body !!} when the recipient opens the me= ssage.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59239" target=3D= "_blank" rel=3D"noopener">CVE-2026-59239</a></td>
</tr>

<td class=3D"vendor-product">Roskus--Prospero Flow CRM</td>
<td>The vulnerability involves an Insecure Direct Object Reference (IDOR) i=
n the `DeleteNotificationController::delete()` method at endpoint `GET /not= ification/delete/{id}`. The flaw allows any authenticated user, regardless =
of company or permissions, to delete notifications belonging to any other u= ser in the system. The controller retrieves the target record with `Notific= ation::findOrFail($id)` and deletes it without validating `user_id` or `com= pany_id` ownership, unlike the sibling `SetNotificationReadAjaxController`,=
which correctly scopes lookups by `Auth::id()`. Because notification ident= ifiers are sequential, an attacker can iterate over IDs to systematically d= elete notifications belonging to any user, denying them visibility of ticke=
t alerts, task assignments, and other system events.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59240" target=3D= "_blank" rel=3D"noopener">CVE-2026-59240</a></td>
</tr>

<td class=3D"vendor-product">RRWO--Data::Entropy</td>
<td>Data::Entropy versions before 0.010 for Perl read remote entropy source=
s over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entrop= y::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP=
. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches=
any non-empty byte string. Any on-path attacker, such as open WiFi, a comp= romised ISP, captive portal, or a hostile egress proxy substitutes the resp= onse and thereby chooses the bytes returned by rand_bits and rand_int for e= very application that selected one of these sources via with_entropy_source=
. The _checkbuf method response is equally attacker-controlled, so the retr= y/sleep behaviour is steerable too.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-18536" target=3D= "_blank" rel=3D"noopener">CVE-2026-18536</a></td>
</tr>

<td class=3D"vendor-product">RRWO--Plack::App::Prerender</td> <td>Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an ar= bitrary host via unvalidated REQUEST_URI concatenation in call. When the re= write base is a plain string, the REQUEST_URI is appended to it, with no ch= eck that the path starts with a forward slash ('/'). When the rewrite base = does not contain a path (which is the standard given in the SYNOPSIS), an a= ttacker can create a request that changes the hostname. A request target st= arting with an at-sign ('@') changes the base to a RFC 3986 userinfo compon= ent. For example, a rewrite base of "https://example.com" with the submitte=
d request "GET @192.168.1.2/" will send a request to "https://example.com@1= 92.168.1.2/", with the rendered content returned to the attacker. This allo=
ws an attacker to access internal or restricted hosts that only the webserv=
er has access to.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17552" target=3D= "_blank" rel=3D"noopener">CVE-2026-17552</a></td>
</tr>

<td class=3D"vendor-product">RT Mega Menu--RT Mega Menu</td>
<td>The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capab= ility check on the AJAX action that saves mega-menu configuration and per-m= enu-item settings; its only gate is a nonce that any logged-in user can rea=
d from a standard admin page. A subscriber-level user can therefore enable = the mega menu on a site menu and store a menu-item style value that is rend= ered, without output escaping, into a style attribute on the public navigat= ion. By breaking out of that attribute the user persists a JavaScript event=
handler that executes for every visitor who hovers the navigation, includi=
ng administrators, leading to session/site takeover.</td>
<td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15385" target=3D= "_blank" rel=3D"noopener">CVE-2026-15385</a></td>
</tr>

<td class=3D"vendor-product">Samsung Mobile--Samsung Mobile Devices</td>

<td>Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allow=
s remote attackers to potentially execute arbitrary code.</td> <td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-21047" target=3D= "_blank" rel=3D"noopener">CVE-2026-21047</a></td>
</tr>

<td class=3D"vendor-product">SBECK--Date::Manip</td>
<td>Date::Manip versions through 6.99 for Perl return corrupted dates via n= on-ASCII decimal digits that pass the numeric range tests in check. The par=
se regexes capture year, month and day with the `\d` shorthand, which on a = character string matches the whole Unicode decimal digit property `\p{Nd}` = and not just `[0-9]`. Date::Manip::Base::check then validates the captured = fields with numeric comparisons alone (`$y&lt;1 || $y&gt;9999`, `$m&lt;1 ||=
$m&gt;12`, `$d&lt;1 || $d&gt;$days`), and _parse_check stores the numified=
fields (`$y+0`). Perl truncates a string at the first character that is no=
t an ASCII digit, so a field whose leading characters are ASCII digits numi= fies to an in-range prefix and satisfies every test: a year field of three = ASCII digits followed by U+0664 ARABIC-INDIC DIGIT FOUR numifies to 202, gi= ving the year 0202, and one non-ASCII digit in the month or day field shift=
s those fields the same way. The hour, minute and second fields match expli= cit ASCII character classes (`0?[0-9]`, `[0-5][0-9]`) and do not shift, tho= ugh a non-ASCII digit in a fractional hour or minute field truncates the fr= action. Any caller that passes an untrusted character string to ParseDate()=
or Date::Manip::Date-&gt;parse() can get back a date that differs from the=
string it parsed, with no parse error. Where the parsed date gates logic s= uch as an expiry check or a retention window, the shift goes unnoticed.</td=

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-60074" target=3D= "_blank" rel=3D"noopener">CVE-2026-60074</a></td>
</tr>

<td class=3D"vendor-product">SBECK--Date::Manip</td>
<td>Date::Manip versions through 6.99 for Perl allow CPU exhaustion via qua= dratic backtracking in the unanchored time substitution in _parse_time. _pa= rse_time removes a time from anywhere in the string with the unanchored sub= stitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of=
time patterns reached through a leading `(?:$atrx|^|\s+)`. The engine ther= efore retries the match at every position of an interior whitespace run: at=
each start position the leading `\s+` consumes the rest of the run greedil=
y, the time alternation fails because the run holds no digits, and the engi=
ne backtracks a space at a time across the run before advancing the start p= osition, which is quadratic in the length of the run. No time need be prese=
nt in the string for this to happen, only a long run of whitespace, and the=
parse time rises about fourfold for each doubling of the run: a few kiloby= tes of whitespace costs seconds of CPU per parse and tens of kilobytes cost=
s minutes. Any caller that passes an untrusted string of unbounded length t=
o ParseDate(), Date::Manip::Date-&gt;parse() or -&gt;parse_time() can be ma=
de to spend unbounded CPU in a single parse, a denial of service.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-60075" target=3D= "_blank" rel=3D"noopener">CVE-2026-60075</a></td>
</tr>

<td class=3D"vendor-product">Schneider Electric--EcoStruxure Cybersecurity = Admin Expert</td>
<td>CWE-522 Insufficiently Protected Credentials vulnerability exists that = could cause authentication bypass and unauthorized credential modification,=
potentially leading to compromise of managed devices, when a local privile= ged attacker leverages weaknesses in the handling and protection of stored = credentials within the application.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14354" target=3D= "_blank" rel=3D"noopener">CVE-2026-14354</a></td>
</tr>

<td class=3D"vendor-product">Schneider Electric--IGSS Definition (Def.exe)<=

<td>CWE-787 Out-of-bounds write vulnerability exists that could cause loss =
of data or potentially risk arbitrary code execution when a malicious CGF f= ile is imported to IGSS Definition.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12927" target=3D= "_blank" rel=3D"noopener">CVE-2026-12927</a></td>
</tr>

<td class=3D"vendor-product">Schneider Electric--SCADAPack 47x</td> <td>CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerabi= lity that could cause arbitrary code execution, denial of service and loss =
of confidentiality &amp; integrity when communicating over the Modbus TCP p= rotocol.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-0667" target=3D"= _blank" rel=3D"noopener">CVE-2026-0667</a></td>
</tr>

<td class=3D"vendor-product">Search Atlas SEO--Search Atlas SEO</td>
<td>The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a = capability or nonce check in one of its AJAX handlers, allowing any authent= icated user such as a Subscriber to invoke the site's Google Indexing API i= ntegration, submitting or removing the site's URLs from Google's index and = consuming its indexing quota.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15252" target=3D= "_blank" rel=3D"noopener">CVE-2026-15252</a></td>
</tr>

<td class=3D"vendor-product">SGLang--SGLang</td>
<td>SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tenso=
rs via bypass of SafeUnpickler's incomplete denylist, allowing arbitrary co= mmand execution through crafted base64-encoded pickle payloads.</td>

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15969" target=3D= "_blank" rel=3D"noopener">CVE-2026-15969</a></td>
</tr>

<td class=3D"vendor-product">SGLang--SGLang</td>
<td>SGLang contains an RCE vulnerability when the optional dumper subsystem=
is enabled, allowing for a sandbox escape when DUMPER_SERVER_PORT is set, = enabling code execution on inference requests.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15971" target=3D= "_blank" rel=3D"noopener">CVE-2026-15971</a></td>
</tr>

<td class=3D"vendor-product">SGLang--SGLang</td>
<td>SGLang contains an SSRF and local file read in the multimodal generatio=
n endpoint /v1/chat/completions due to unsanitized image_url, allowing acce=
ss to internal metadata, secrets, and services.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15974" target=3D= "_blank" rel=3D"noopener">CVE-2026-15974</a></td>
</tr>

<td class=3D"vendor-product">SGLang--SGLang</td>
<td>SGLang contains a RCE vulnerability when attempting to load model weigh=
ts from a HuggingFace repository, specifically within the /update_weights_f= rom_disk, where torch.load(..., weights_only=3DFalse) fallback enables pick=
le deserialization of .bin files.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15976" target=3D= "_blank" rel=3D"noopener">CVE-2026-15976</a></td>
</tr>

<td class=3D"vendor-product">SGLang--SGLang</td>
<td>SGLang contains a credential leakage vulnerability in the /server_info = endpoint, which will return API keys and SSL keyfile information when only = the --admin-api-key is configured.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15977" target=3D= "_blank" rel=3D"noopener">CVE-2026-15977</a></td>
</tr>

<td class=3D"vendor-product">SGLang--SGLang</td>
<td>SGLang contains a model weight exfiltration vulnerability when no API k= eys are configured, as SGLang will expose two endpoints that allow a remote=
attacker to trigger distributed weight broadcasting using NCCL and then tr= iggering data transfer, attackers can exfiltrate all model weights.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15978" target=3D= "_blank" rel=3D"noopener">CVE-2026-15978</a></td>
</tr>

<td class=3D"vendor-product">ShinyStat Analytics--ShinyStat Analytics</td> <td>The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform=
any authorization check on one of its REST API endpoints, allowing unauthe= nticated users to retrieve information about non-published (e.g. draft, pen= ding or private) WooCommerce products.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11351" target=3D= "_blank" rel=3D"noopener">CVE-2026-11351</a></td>
</tr>

<td class=3D"vendor-product">ShopMonitor.io--ShopMonitor.io</td>
<td>The ShopMonitor.io WordPress plugin before 1.2.0 does not properly rest= rict its email-rerouting test mode, gating it behind a trusted-source check=
that is satisfiable with client-supplied request headers, allowing unauthe= nticated attackers to redirect outgoing emails, including the WordPress adm= inistrator password-reset email, to an address they control and take over t=
he administrator account.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14919" target=3D= "_blank" rel=3D"noopener">CVE-2026-14919</a></td>
</tr>

<td class=3D"vendor-product">Simple Restrict--Simple Restrict</td>
<td>The Simple Restrict WordPress plugin before 1.2.9 does not enforce its = content-restriction permission check on the REST API the way it does on the=
front end, relying there on a generic capability check instead of the Simp=
le Restrict WordPress plugin before 1.2.9's own permission system, allowing=
users with contributor-level access or above to read the content of restri= cted posts and pages they were never granted access to.</td>

<td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15939" target=3D= "_blank" rel=3D"noopener">CVE-2026-15939</a></td>
</tr>

<td class=3D"vendor-product">Simply Schedule Appointments--Simply Schedule = Appointments</td>
<td>Simply Schedule Appointments is vulnerable to unauthenticated Stored Cr= oss-Site Scripting in all versions up to and including 1.6.12.2. The root c= ause is a sanitization-ordering defect: the rendered notification content i=
s decoded back into live HTML after it has already passed through the Simpl=
y Schedule Appointments WordPress plugin before 1.6.12.4's wp_kses_post() f= ilter, so a double-encoded payload survives intake and is reintroduced as a=
n executable element at render time.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13400" target=3D= "_blank" rel=3D"noopener">CVE-2026-13400</a></td>
</tr>

<td class=3D"vendor-product">Simply Schedule Appointments--Simply Schedule = Appointments</td>
<td>The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does = not correctly restrict a bulk appointment operation to the requester's own = records, allowing unauthenticated users to retrieve the personal data of al=
l appointments across the site and, on premium editions, to permanently del= ete them.</td>
<td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16540" target=3D= "_blank" rel=3D"noopener">CVE-2026-16540</a></td>
</tr>

<td class=3D"vendor-product">Sina Extension for Elementor--Sina Extension f=
or Elementor</td>
<td>The Sina Extension for Elementor WordPress plugin before 3.10.2 does no=
t escape a value reconstructed from request input in one of its unauthentic= ated AJAX handlers before reflecting it into the HTML response, allowing un= authenticated attackers to execute arbitrary JavaScript in the browser of a= nyone who triggers a crafted request.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14190" target=3D= "_blank" rel=3D"noopener">CVE-2026-14190</a></td>
</tr>

<td class=3D"vendor-product">Smart Manager--Smart Manager</td>
<td>The Smart Manager WordPress plugin before 8.92.0 does not properly enco=
de a post field before rendering it into an HTML attribute in its managemen=
t grid, allowing users with the Contributor role or above to inject JavaScr= ipt that executes in the browser session of an administrator who views the = grid.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14203" target=3D= "_blank" rel=3D"noopener">CVE-2026-14203</a></td>
</tr>

<td class=3D"vendor-product">SMS Alert--SMS Alert</td>
<td>The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile v= erified" session flag to the phone number that was actually verified: after=
an attacker verifies an OTP sent to their own phone, the signup/login hand= ler reads a fresh, attacker-supplied phone number to select the account and=
logs them in. An unauthenticated attacker can therefore log in as any user=
, including an administrator, who has a billing phone on file.</td> <td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15206" target=3D= "_blank" rel=3D"noopener">CVE-2026-15206</a></td>
</tr>

<td class=3D"vendor-product">so-fancy--diff-so-fancy</td>
<td>diff so fancy does not properly sanitize non SGR terminal control seque= nces before outputting diff data. The application only strips ANSI SGR sequ= ences while allowing other control characters, including carriage return (\=
r) and escape sequences (e.g., OSC, CSI), to pass through unsanitized. An a= ttacker can embed malicious control sequences in filenames, diff metadata, =
or file content that are rendered directly in the terminal during diff view= ing. This can lead to output manipulation, including filename spoofing, ter= minal screen clearing, and clipboard injection via supported escape sequenc= es. Successful exploitation may mislead users during code review, alter ter= minal state, or result in unintended command execution through clipboard hi= jacking. This issue has been fixed in the commit=C2=A09c81294</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50642" target=3D= "_blank" rel=3D"noopener">CVE-2026-50642</a></td>
</tr>

<td class=3D"vendor-product">Sourcecodester--Advocate Office Management Sys= tem</td>
<td>https://www.sourcecodester.com Advocate office management system 1.0 is=
affected by: SQL Injection. The impact is: execute arbitrary code (remote)=
. The component is: control/activate_case.php,?id=3D1. The attack vector is=
: A SQL Injection vulnerability exists in the activate_case.php in paramete=
r id endpoint of Advocate office management system. Unsanitized user input =
in the specified parameter is interpolated directly into an SQL query, allo= wing attackers to infer or extract data and, in some cases, execute stacked= /time-based payloads. =C3=82=C2=B6=C3=82=C2=B6 Affected Component &amp; Par= ameter Affected Endpoint URL: http://localhost/advocate/kortex_lite/control= /activate_case.php?id=3D1 HTTP Method: GET Vulnerable File: activate_case.p=
hp Parameter: id Vector Location: GET Injection Techniques (as identified b=
y sqlmap) Type: error-based Title: MySQL &gt;=3D 5.1 AND error-based - WHER=
E, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE) Payload: id=3D1 AND E= XTRACTVALUE(6268,CONCAT(0x5c,0x71766b6a71,(SELECT (ELT(6268=3D6268,1))),0x7= 16a7a6b71)) Type: time-based blind Title: MySQL &gt;=3D 5.0.12 AND time-bas=
ed blind (query SLEEP) Payload: id=3D1 AND (SELECT 4464 FROM (SELECT(SLEEP(= 5)))aHqo) Proof of Concept (Burp Repeater)</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-67406" target=3D= "_blank" rel=3D"noopener">CVE-2025-67406</a></td>
</tr>

<td class=3D"vendor-product">Sourcecodester--CASAP Automated Enrollment Sys= tem</td>
<td>Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to S=
QL Injection in update_class.php via the parameter class_name.</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-67403" target=3D= "_blank" rel=3D"noopener">CVE-2025-67403</a></td>
</tr>

<td class=3D"vendor-product">Sourcecodester--CASAP Automated Enrollment Sys= tem</td>
<td>Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to S=
QL Injection in save_stud.php via the parameters fname, lname, and student_= class.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-67404" target=3D= "_blank" rel=3D"noopener">CVE-2025-67404</a></td>
</tr>

<td class=3D"vendor-product">Sourcecodester--CASAP Automated Enrollment Sys= tem</td>
<td>Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to S=
QL Injection in update_password.php via the parameter new_password.</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-67405" target=3D= "_blank" rel=3D"noopener">CVE-2025-67405</a></td>
</tr>

<td class=3D"vendor-product">Sourcecodester--CASAP Automated Enrollment Sys= tem</td>
<td>Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to S=
QL Injection in update_student.php via parameters fname and student_class.<=

<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-67407" target=3D= "_blank" rel=3D"noopener">CVE-2025-67407</a></td>
</tr>

<td class=3D"vendor-product">Sourcecodester--CASAP Automated Enrollment Sys= tem</td>
<td>Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to S=
QL Injection in /save_user.php via the parameter status.</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-67408" target=3D= "_blank" rel=3D"noopener">CVE-2025-67408</a></td>
</tr>

<td class=3D"vendor-product">Sourcecodester--Fantastic Blog CMS</td> <td>Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scrip= ting (XSS) in pageEditMember.php via the address field.</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-65337" target=3D= "_blank" rel=3D"noopener">CVE-2025-65337</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Modern Loan Management System<=

<td>SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL I= njection in ajaxData.php via the parameters district_id , division_id, regi= on_id, and ward_id.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69946" target=3D= "_blank" rel=3D"noopener">CVE-2025-69946</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Modern Loan Management System<=

<td>SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL I= njection in /admin/delete_group.php?id=3D1.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69948" target=3D= "_blank" rel=3D"noopener">CVE-2025-69948</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Tailor Management System</td> <td>SourceCodester Tailor Management System 1.0 is vulnerable to SQL Inject= ion in addmeasurement.php?id=3D1.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69941" target=3D= "_blank" rel=3D"noopener">CVE-2025-69941</a></td>
</tr>

<td class=3D"vendor-product">SourceCodester--Tailor Management System</td> <td>SourceCodester Tailor Management System 1.0 is vulnerable to SQL Inject= ion in customeredit.php?id=3D1.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2025-69947" target=3D= "_blank" rel=3D"noopener">CVE-2025-69947</a></td>
</tr>

<td class=3D"vendor-product">sparklemotion--sqlite3-ruby</td>
<td>sqlite3 provides Ruby bindings for the SQLite3 embedded database. In ve= rsion 2.9.4 and earlier, redefining a SQLite function with a different arit=
y frees the previously registered function handler while SQLite may still r= eference it, resulting in a use-after-free. This issue is fixed in version = 2.9.5.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54619" target=3D= "_blank" rel=3D"noopener">CVE-2026-54619</a></td>
</tr>

<td class=3D"vendor-product">sparklemotion--sqlite3-ruby</td>
<td>sqlite3 provides Ruby bindings for the SQLite3 embedded database. From = 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be fr= eed while still referenced during aggregation, resulting in a use-after-fre=
e. This issue is fixed in version 2.9.5.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54620" target=3D= "_blank" rel=3D"noopener">CVE-2026-54620</a></td>
</tr>

<td class=3D"vendor-product">Spectra Legacy--Spectra Legacy</td>
<td>The Spectra Legacy WordPress plugin before 2.20.0 does not validate or = escape several block style attributes before using them to build the CSS it=
outputs on the front end, allowing users with the Contributor role and abo=
ve to inject arbitrary CSS into the pages that render the affected block. T=
he injected styles are served to anonymous visitors of those pages and can = force external resource loads, deface/redress the page, or exfiltrate data = via CSS attribute selectors. JavaScript execution is not possible at this r= ole (the script-tag breakout is removed by KSES), so the impact is limited =
to CSS injection.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-10827" target=3D= "_blank" rel=3D"noopener">CVE-2026-10827</a></td>
</tr>

<td class=3D"vendor-product">Streamit--Streamit</td>
<td>The Streamit WordPress theme through 4.5.0 does not perform any authori= zation or nonce verification on one of its unauthenticated AJAX routes, whi=
ch invokes an attacker-supplied PHP function with an attacker-supplied argu= ment array, allowing unauthenticated attackers to call arbitrary functions = (for example to create an administrator account), leading to privilege esca= lation and remote code execution.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13423" target=3D= "_blank" rel=3D"noopener">CVE-2026-13423</a></td>
</tr>

<td class=3D"vendor-product">Streamsoft--Business Intelligence</td> <td>Streamsoft Business Intelligence (BI) stores users' passwords in plaint= ext form in the database This issue was fixed in version=C2=A06.8.0.0, user=
s were also requested to change their password on the first login.</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-50641" target=3D= "_blank" rel=3D"noopener">CVE-2026-50641</a></td>
</tr>

<td class=3D"vendor-product">Support Genix--Support Genix</td>
<td>The Support Genix WordPress plugin before 1.4.48 does not properly auth= orize access to support-ticket attachment downloads, allowing unauthenticat=
ed users who obtain the stored attachment file name to download other users=
' private ticket attachments.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14862" target=3D= "_blank" rel=3D"noopener">CVE-2026-14862</a></td>
</tr>

<td class=3D"vendor-product">Support Genix--Support Genix</td>
<td>The Support Genix WordPress plugin before 1.4.48 does not prevent direc= tory traversal in its ticket-attachment download route, allowing unauthenti= cated attackers to read arbitrary files with an allowlisted extension - inc= luding other users' private ticket attachments - from the server.</td> <td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15932" target=3D= "_blank" rel=3D"noopener">CVE-2026-15932</a></td>
</tr>

<td class=3D"vendor-product">Sync Post--Sync Post With Other Site</td>

<td>The Sync Post With Other Site WordPress plugin before 1.9.3 does not co= rrectly enforce the page-editing capability on a REST route that creates an=
d updates posts, because of an operator-precedence flaw in its authorizatio=
n check. An authenticated user holding only the post-editing capability (su=
ch as a Contributor) can create, publish, and overwrite arbitrary Pages, in= cluding modifying content authored by higher-privileged users.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14923" target=3D= "_blank" rel=3D"noopener">CVE-2026-14923</a></td>
</tr>

<td class=3D"vendor-product">Tablesome Table--Tablesome Table</td>
<td>The Tablesome Table WordPress plugin before 1.1.31 does not perform any=
authentication, capability, or nonce checks in one of its AJAX actions, al= lowing unauthenticated users to create new published posts and to overwrite=
arbitrary existing posts and pages.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14924" target=3D= "_blank" rel=3D"noopener">CVE-2026-14924</a></td>
</tr>

<td class=3D"vendor-product">tbc--tbc</td>
<td>Full details and mitigation steps are currently restricted and will be = published at a later date.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43829" target=3D= "_blank" rel=3D"noopener">CVE-2026-43829</a></td>
</tr>

<td class=3D"vendor-product">tbc--tbc</td>
<td>Full details and mitigation steps are currently restricted and will be = published at a later date.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43830" target=3D= "_blank" rel=3D"noopener">CVE-2026-43830</a></td>
</tr>

<td class=3D"vendor-product">tbc--tbc</td>
<td>Full details and mitigation steps are currently restricted and will be = published at a later date.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43831" target=3D= "_blank" rel=3D"noopener">CVE-2026-43831</a></td>
</tr>

<td class=3D"vendor-product">tbc--tbc</td>
<td>Full details and mitigation steps are currently restricted and will be = published at a later date.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43832" target=3D= "_blank" rel=3D"noopener">CVE-2026-43832</a></td>
</tr>

<td class=3D"vendor-product">tbc--tbc</td>
<td>Full details and mitigation steps are currently restricted and will be = published at a later date.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-43833" target=3D= "_blank" rel=3D"noopener">CVE-2026-43833</a></td>
</tr>

<td class=3D"vendor-product">Tenda--W6-S 1.0.0.4</td>
<td>Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerab= ility in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses=
sprintf to copy user-controlled 'GO' and 'index' parameters into a 64-byte=
stack buffer without length restriction, leading to stack overflow.</td> <td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67822" target=3D= "_blank" rel=3D"noopener">CVE-2026-67822</a></td>
</tr>

<td class=3D"vendor-product">The Events Calenda--The Events Calendar</td> <td>The Events Calendar WordPress plugin before 6.16.5.1 does not perform a=
n authorization check on one of its Event Aggregator import REST API routes=
and skips an integrity check for a particular status value, allowing unaut= henticated attackers to mark existing import records as failed and to store=
arbitrary content in a hidden comment record.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13390" target=3D= "_blank" rel=3D"noopener">CVE-2026-13390</a></td>
</tr>

<td class=3D"vendor-product">The HDF Group--HDF5</td>
<td>Heap-based buffer overflow in the SOHM list-index deserialization code =
in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial o=
f service (crash) via a crafted HDF5 file whose shared-message list index d= eclares a num_messages count exceeding list_max, triggering out-of-bounds h= eap reads and writes in H5SM__cache_list_deserialize and H5SM__cache_list_v= erify_chksum.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17572" target=3D= "_blank" rel=3D"noopener">CVE-2026-17572</a></td>
</tr>

<td class=3D"vendor-product">The HDF Group--HDF5</td>
<td>A double free vulnerability was discovered in the HDF5 library. Process= ing a crafted HDF5 file containing an oversized chunk size field via h5repa=
ck may cause the application to abort due to a double free.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17573" target=3D= "_blank" rel=3D"noopener">CVE-2026-17573</a></td>
</tr>

<td class=3D"vendor-product">The HDF Group--HDF5</td>
<td>HDF5 contains a NULL pointer dereference vulnerability. Processing a cr= afted HDF5 file containing an attribute with an invalid variable-length dat= atype type field may cause the application to crash when the attribute is r= ead.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-17574" target=3D= "_blank" rel=3D"noopener">CVE-2026-17574</a></td>
</tr>

<td class=3D"vendor-product">Theme Demo Import--Theme Demo Import</td>

<td>The Demo Import WordPress plugin through 1.1.3 does not validate the ty=
pe of files uploaded during demo-content import (the WordPress file-type te=
st is disabled), allowing high-privilege users (Administrator by default, i= ncluding non-super-admin site administrators on multisite) to upload execut= able PHP files to the uploads directory.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13157" target=3D= "_blank" rel=3D"noopener">CVE-2026-13157</a></td>
</tr>

<td class=3D"vendor-product">thorsten--phpMyFAQ</td>
<td>phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the=
existing_image field during category updates, allowing authenticated attac= kers to delete arbitrary files by exploiting insufficient sanitization in I= mage::delete(). Attackers can delete the database.php configuration file to=
disable the installation gate and access the public setup wizard to create=
new superadmin accounts.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66397" target=3D= "_blank" rel=3D"noopener">CVE-2026-66397</a></td>
</tr>

<td class=3D"vendor-product">thorsten--phpMyFAQ</td>
<td>phpMyFAQ before v4.1.6 contains a remote code execution vulnerability i=
n the configuration API that allows authenticated administrators with CONFI= GURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by=
manipulating the upgrade.lastDownloadedPackage setting. Attackers can uplo=
ad a malicious ZIP file as an attachment, point the updater configuration t=
o its stored path, and extract it into the application root to achieve code=
execution as the web server user.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-66398" target=3D= "_blank" rel=3D"noopener">CVE-2026-66398</a></td>
</tr>

<td class=3D"vendor-product">thumbor--thumbor</td>
<td>Thumbor is an open-source photo thumbnail service by globo.com. Prior t=
o 7.8.0, file_loader decodes percent-encoded path segments after its root-b= oundary validation, allowing traversal outside FILE_LOADER_ROOT_PATH throug=
h watermark or frame filter input. This issue is fixed in 7.8.0.</td> <td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-53502" target=3D= "_blank" rel=3D"noopener">CVE-2026-53502</a></td>
</tr>

<td class=3D"vendor-product">Tigera--Calico</td>
<td>When Calico's shared debug server is enabled (disabled by default), the=
Calico kube-controllers and Goldmane components bind their Go pprof debug = listener to 0.0.0.0 without authentication. Any pod with network reachabili=
ty to the listener can retrieve the process heap, goroutine stacks (includi=
ng function arguments), and command-line arguments. Depending on the proces= s's in-memory state, the heap may contain sensitive material. The debug lis= tener is opt-in but is unsafe when enabled because it offers no authenticat= ion and no safe localhost-only binding option.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-41186" target=3D= "_blank" rel=3D"noopener">CVE-2026-41186</a></td>
</tr>

<td class=3D"vendor-product">Tigera--Calico</td>
<td>Calico's apiserver wraps tier-scoped resources so that every operation = runs through AuthorizeTierOperation, but the Delete override on NetworkPoli= cy, GlobalNetworkPolicy, and their staged variants is not invoked for Delet= eCollection requests. A user holding the deletecollection verb or wildcard = verbs on tier-scoped policy resources can bulk-delete policies in tiers the=
y otherwise have no rights on, breaking the tier authorization boundary.</t=

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-41187" target=3D= "_blank" rel=3D"noopener">CVE-2026-41187</a></td>
</tr>

<td class=3D"vendor-product">Tigera--Calico</td>
<td>Calico's Application Layer Policy (disabled by default), which enforces=
HTTP rules through Dikastes, fails to perform URL path normalization. As a=
result, HTTP requests using path-traversal segments, encoded slashes, or r= epeated slashes are not correctly evaluated by Prefix path rules. Dikastes = authorizes the request under the permitted prefix while the downstream work= load or a fronting proxy normalizes the path and serves the restricted endp= oint. An attacker with network access and no special RBAC can potentially r= each HTTP endpoints the policy was intended to restrict.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-6540" target=3D"= _blank" rel=3D"noopener">CVE-2026-6540</a></td>
</tr>

<td class=3D"vendor-product">tourmaster--tourmaster</td>
<td>The tourmaster WordPress plugin before 5.4.8 does not perform a nonce c= heck when storing a custom-filter label taken from a request parameter, and=
does not escape that label when echoing it on the filter admin page, allow= ing an unauthenticated attacker to trick a logged-in administrator into sto= ring JavaScript that then executes in the admin area (stored Cross-Site Scr= ipting via CSRF).</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14239" target=3D= "_blank" rel=3D"noopener">CVE-2026-14239</a></td>
</tr>

<td class=3D"vendor-product">TP-Link Systems Inc.--AXE75 V1</td>
<td>An OS command injection vulnerability exists in the VPN module of TP-Li=
nk AXE75 V1 routers. This vulnerability allows an adjacent, authenticated a= ttacker to execute arbitrary commands on the device by importing a speciall=
y crafted VPN client configuration file. The issue arises from=C2=A0imprope=
r filtering of special characters.=C2=A0 Successful exploitation of this vu= lnerability may enable an attacker to gain full control of the affected dev= ice, potentially compromising configuration integrity, network security, an=
d service availability.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-9044" target=3D"= _blank" rel=3D"noopener">CVE-2026-9044</a></td>
</tr>

<td class=3D"vendor-product">TP-Link Systems Inc.--TL-WR850N v3</td>
<td>A hardcoded credential vulnerability exists in the firmware of multiple=
TP-Link routers (TL-WR845N v4, TL-WR850N v3, Archer C20 v6 &amp; Archer MR= 200 v5). =C2=A0Authentication-related credential material is embedded withi=
n a password file in the firmware image and may be recovered through firmwa=
re analysis. Successful exploitation could result in unauthorized access to=
privileged functions on affected devices.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12001" target=3D= "_blank" rel=3D"noopener">CVE-2026-12001</a></td>
</tr>

<td class=3D"vendor-product">TP-Link Systems Inc.--TL-WR940N v6</td>
<td>The TL-WR940N v6 router contains a vulnerability in its RTSP connection=
tracking module that can lead to a stack-based buffer overflow. The issue = occurs when a LAN client initiates a connection to a malicious RTSP server = controlled by an attacker. A specially crafted RTSP message may trigger imp= roper memory handling within the kernel module Successful exploitation of t= his vulnerability may result in a denial-of-service (DoS) condition or allo=
w remote code execution (RCE), potentially leading to full compromise of th=
e device. This vulnerability can be exploited by an unauthenticated attacke=
r under the device's default configuration.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12935" target=3D= "_blank" rel=3D"noopener">CVE-2026-12935</a></td>
</tr>

<td class=3D"vendor-product">traefik--traefik</td>
<td>Traefik versions &gt;=3D v3.7.0 and &lt;=3D v3.7.7 contain a path trave= rsal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget=
middleware (generated from the nginx.ingress.kubernetes.io/rewrite-target = annotation). When an Ingress path uses a regex that captures attacker-contr= olled text without requiring a path separator (e.g., path /api(.*) with rew= rite target /$1), a crafted request such as /api../admin matches the public=
router, is rewritten to a dot-segment traversal path (/../admin), and is f= orwarded without post-replacement normalization validation. A backend that = normalizes dot segments resolves the path to a protected endpoint (e.g., /a= dmin) reachable only through a separate router secured with BasicAuth, Dige= stAuth, or ForwardAuth, resulting in route-level authentication bypass. The=
issue is fixed in v3.7.8.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67309" target=3D= "_blank" rel=3D"noopener">CVE-2026-67309</a></td>
</tr>

<td class=3D"vendor-product">TrueBooker--TrueBooker</td>
<td>The TrueBooker WordPress plugin before 1.2.4 does not validate account = ownership when resetting a user's password through one of its front-end acc= ount handlers, allowing unauthenticated attackers to set an arbitrary passw= ord on any account, including an administrator, and take over the site.</td=

<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14545" target=3D= "_blank" rel=3D"noopener">CVE-2026-14545</a></td>
</tr>

<td class=3D"vendor-product">Tutor LMS--Tutor LMS</td>
<td>The Tutor LMS WordPress plugin before 4.0.0 does not properly verify th=
at a user has access to the course a Q&amp;A thread belongs to before retur= ning or writing to that thread, allowing authenticated users with subscribe= r-level access and above who can access any single course to read the Q&amp=
;A threads of other courses and to inject replies into them.</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14310" target=3D= "_blank" rel=3D"noopener">CVE-2026-14310</a></td>
</tr>

<td class=3D"vendor-product">ueberauth--guardian</td>
<td>Allocation of Resources Without Limits or Throttling in ueberauth guard= ian allows denial of service via unbounded atom creation from attacker-infl= uenced binary input. Guardian.Plug.Keys derives connection and session name= space keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in=
lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_&lt= ;input&gt;", and the derived helpers claims_key/1, resource_key/1, and toke= n_key/1 create a second atom on top of that. key_from_other/1 likewise conv= erts a regex-captured binary through String.to_atom/1. The public specs adv= ertise String.t() as a valid argument, so passing a string is documented us= age, and higher-level entry points such as Guardian.Plug.current_token(conn=
, key: key) thread the caller-supplied key straight into these functions. S= tring.to_atom/1 creates a brand-new atom for every previously unseen binary=
, atoms are never garbage collected, and the BEAM atom table is fixed at ro= ughly 1,048,576 entries by default. An application that routes attacker-inf= luenced data (a tenant identifier, header, or other request input) into a G= uardian key therefore mints one permanent atom per distinct value. A modest=
stream of varied, unauthenticated input permanently consumes the atom tabl=
e and crashes the BEAM node, taking down every application running on it. T= his issue affects guardian: from 0.1.0 before 2.4.1.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54894" target=3D= "_blank" rel=3D"noopener">CVE-2026-54894</a></td>
</tr>

<td class=3D"vendor-product">ueberauth--guardian</td>
<td>Allocation of Resources Without Limits or Throttling in ueberauth guard= ian allows denial of service via unbounded atom creation from attacker-cont= rolled binary input. Guardian.Permissions.AtomEncoding encodes permission s= copes by passing arbitrary binaries to String.to_atom/1. When encode/3 in l= ib/guardian/permissions/atom_encoding.ex is called with a list, each binary=
entry is handled by the encode_value/3 binary clause, which calls String.t= o_atom(value) with no allow-list check. The perm_set argument (the applicat= ion's small, finite set of legitimate permission names) is discarded, so an=
y external string flows straight into atom creation. This encoder is select=
ed with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncodi=
ng and reached through the imported encode/3 entry point. String.to_atom/1 = creates a brand-new atom for every previously unseen binary, atoms are neve=
r garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 = entries by default. An application that funnels attacker-influenced permiss= ion scopes (from a request body, a JWT claim, or other external input) into=
encode/3 therefore mints one permanent atom per distinct value. A modest s= tream of varied, unauthenticated input permanently consumes the atom table = and crashes the BEAM node with system_limit, taking down every application = running on it. The default encoder is Guardian.Permissions.BitwiseEncoding,=
which is not affected. This issue affects guardian: from 2.0.0 before 2.4.= 1.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55733" target=3D= "_blank" rel=3D"noopener">CVE-2026-55733</a></td>
</tr>

<td class=3D"vendor-product">ueberauth--guardian</td>
<td>Allocation of Resources Without Limits or Throttling vulnerability in u= eberauth guardian (Guardian.Permissions module) allows a denial of service = via BEAM atom-table exhaustion. This vulnerability is associated with progr=
am file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.P= ermissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_per= missions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permission= s!/2. The Guardian.Permissions mixin installs a public encode_permissions!/=
1 function on every module that does use Guardian.Permissions. For each key=
of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(= k)) before any validation runs. The integer-value clause of do_encode_permi= ssions!/2 then short-circuits straight to encoding without validating the k=
ey against the configured permission set, so a key with an integer value is=
interned as a fresh atom with no exception raised. Atoms are never garbage=
collected and the BEAM atom table is a fixed-size resource (default roughl=
y 1,048,576 entries), so each unique attacker-chosen key permanently consum=
es one slot. An attacker who can influence a permission map that reaches en= code_permissions!/1 (for example a permissions map read from a request body=
and passed into token issuance via encode_permissions_into_claims!/2) can = mint an unbounded number of atoms and exhaust the atom table, crashing the = entire BEAM node and every service running on it. The sibling decode_permis= sions/1 is not affected because it skips keys absent from the configured pe= rmission set. This issue affects guardian: from 2.0.0 before 2.4.1.</td> <td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55734" target=3D= "_blank" rel=3D"noopener">CVE-2026-55734</a></td>
</tr>

<td class=3D"vendor-product">ueberauth--guardian</td>
<td>Improper Verification of Cryptographic Signature in ueberauth guardian = allows an unauthenticated attacker to revoke a victim's session with a forg=
ed token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token w= ith peek/1, which performs no signature verification (it only base64-decode=
s the JWT header and payload). The resulting unverified claims are forwarde=
d directly to the configured token module's revoke callback and the impleme= ntation's on_revoke callback, a state-mutating sink. The sibling operations=
refresh/2 and exchange/4 both call decode_and_verify first, so the signatu=
re is checked before anything acts on the claims; revoke/3 is the only stat= e-mutating path that acts on claims without verifying the signature. An att= acker who knows or guesses a victim's identifying claim values (jti, sub) c=
an forge a JWT carrying those claims, sign it with an arbitrary key, and su= bmit it to any endpoint that funnels a caller-supplied token into Guardian.= revoke/3 (the standard logout / session-revocation pattern). When the token=
module mutates state keyed by the claims (whitelist deletion or blacklist = insertion, for example a GuardianDb-style store), the victim's legitimate s= ession is evicted. This is an unauthenticated session-revocation denial of = service; the attacker never needs the signing secret. This issue affects gu= ardian: from 1.0.0 before 2.4.1.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-55735" target=3D= "_blank" rel=3D"noopener">CVE-2026-55735</a></td>
</tr>

<td class=3D"vendor-product">ufirstgroup--ymlr</td>
<td>Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup = ymlr (Elixir.Ymlr module) allows attackers to inject arbitrary content into=
generated YAML documents through document comments. Ymlr.document!/2 inter= polates each caller-supplied comment string into the output behind a single=
# prefix without validating it or escaping line breaks. Because a YAML com= ment is terminated by a line break, the first carriage return or line feed =
in the comment string ends the comment context and everything after it is e= mitted at column 0 of the document body. An attacker who controls text that=
the host application passes as a comment can forge top-level mapping keys,=
override values the application itself set, and emit --- or ... markers th=
at split the output into additional documents. Downstream consumers of the = generated YAML, such as configuration loaders, deployment manifests, CI pip= elines and data importers, parse the injected content as legitimate data. T=
he same clause backs Ymlr.document/2, Ymlr.documents!/2 and Ymlr.documents/=
2, so every document encoding entry point is affected. This vulnerability i=
s associated with program files lib/ymlr.ex and program routines 'Elixir.Ym= lr':document!/2, 'Elixir.Ymlr':documents!/2. This issue affects ymlr from 0= .0.1 before 5.1.6.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65636" target=3D= "_blank" rel=3D"noopener">CVE-2026-65636</a></td>
</tr>

<td class=3D"vendor-product">Ultimate Addons for WPBakery Page Builder--Ult= imate Addons for WPBakery Page Builder</td>
<td>The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3= .21.5's shared link-rendering function, Ultimate_VC_Addons::uavc_link_init(= ),</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14921" target=3D= "_blank" rel=3D"noopener">CVE-2026-14921</a></td>
</tr>

<td class=3D"vendor-product">Ultimate Addons for WPBakery Page Builder--Ult= imate Addons for WPBakery Page Builder</td>
<td>The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3= .21.4 does not perform a capability or nonce check before deleting a site's=
custom-uploaded icon font packs, allowing unauthenticated attackers to per= manently delete all of a site's custom icon fonts with a single request.</t=

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15382" target=3D= "_blank" rel=3D"noopener">CVE-2026-15382</a></td>
</tr>

<td class=3D"vendor-product">Ultimate Member--Ultimate Member</td>
<td>The Ultimate Member WordPress plugin before 2.12.1 does not filter admi= nistrator-level capabilities from the roles it makes selectable on its regi= stration forms, and its post-registration safeguard against elevated accoun=
ts is disabled by default, allowing unauthenticated users to register with =
a site-defined role that carries administrator capabilities and gain admini= strative access, when such a role exists and a role-selection field is pres= ent on a published registration form.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12251" target=3D= "_blank" rel=3D"noopener">CVE-2026-12251</a></td>
</tr>

<td class=3D"vendor-product">User Frontend--User Frontend: AI Powered Front= end Post Submission, User Directory, User Profile, Membership &amp; User Re= gistration</td>
<td>The User Frontend: AI Powered Frontend Post Submission, User Directory,=
User Profile, Membership &amp; User Registration WordPress plugin before 4= .3.8 does not correctly verify ownership before deleting an attachment, all= owing unauthenticated attackers to permanently delete author-less attachmen=
ts such as guest uploads and User Frontend: AI Powered Frontend Post Submis= sion, User Directory, User Profile, Membership &amp; User Registration Word= Press plugin before 4.3.8-installed placeholder media.</td>

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14568" target=3D= "_blank" rel=3D"noopener">CVE-2026-14568</a></td>
</tr>

<td class=3D"vendor-product">User Profile Builder--User Profile Builder</td=

<td>The User Profile Builder WordPress plugin before 3.16.4 does not correc= tly bind the automatic login performed after user registration to the newly=
created account, allowing unauthenticated attackers to obtain an authentic= ated session for an arbitrary existing user, including administrators, on s= ites using a supported but non-default configuration.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15368" target=3D= "_blank" rel=3D"noopener">CVE-2026-15368</a></td>
</tr>

<td class=3D"vendor-product">UsersWP--UsersWP</td>
<td>The UsersWP WordPress plugin before 1.2.67 does not validate the select=
ed authentication provider in its two-factor login handler, allowing an att= acker who already knows a user's credentials to bypass the second authentic= ation factor and log in as that user.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13690" target=3D= "_blank" rel=3D"noopener">CVE-2026-13690</a></td>
</tr>

<td class=3D"vendor-product">veraPDF--veraPDF-parser</td>
<td>veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.3= 1.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-= parser/src/main/java/org/verapdf/pd/font/cmap/CMapParser.java and veraPDF-p= arser/src/main/java/org/verapdf/parser/postscript/PSOperator.java, where a = crafted Type 0 font /Encoding or /ToUnicode CMap stream can execute unbound=
ed PostScript array allocation or a zero-increment for loop and exhaust val= idator memory or CPU. This issue is fixed in versions 1.30.2 and 1.31.23.</=

<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54080" target=3D= "_blank" rel=3D"noopener">CVE-2026-54080</a></td>
</tr>

<td class=3D"vendor-product">veraPDF--veraPDF-parser</td>
<td>veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.3= 1.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-= parser/src/main/java/org/verapdf/pd/font/type1/Type1FontProgram.java and ve= raPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java, w= here a crafted Type 1 font /FontDescriptor /FontFile program can execute un= bounded PostScript array allocation, a zero-increment for loop, or self-rec= ursive toExecute user dictionary lookups and exhaust validator memory, CPU,=
or stack. This issue is fixed in versions 1.30.2 and 1.31.23.</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54081" target=3D= "_blank" rel=3D"noopener">CVE-2026-54081</a></td>
</tr>

<td class=3D"vendor-product">veraPDF--veraPDF-validation</td>
<td>veraPDF validation model is an implementation of the veraPDF validation=
model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains =
an XML External Entity (XXE) vulnerability in validation-model/src/main/jav= a/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in getRichTextString= OrStreamEntryStringRepresentation(), where a crafted PDF containing a malic= ious rich-text /RC or /RV entry can cause external entity expansion and ref= lect local file contents into the validation report. This issue is fixed in=
versions 1.30.2 and 1.31.71.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54078" target=3D= "_blank" rel=3D"noopener">CVE-2026-54078</a></td>
</tr>

<td class=3D"vendor-product">veraPDF--veraPDF-validation</td>
<td>veraPDF validation provides PDF/A and PDF/UA validation, feature report= ing, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-va= lidation contains an XML External Entity (XXE) vulnerability in validation-= model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the g= etdynamicRender() method, where a crafted PDF containing a malicious XFA st= ream can cause external entity expansion during PDF/UA-1 validation and all=
ow local file disclosure or outbound server-side requests. This issue is fi= xed in versions 1.30.2 and 1.31.71.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54079" target=3D= "_blank" rel=3D"noopener">CVE-2026-54079</a></td>
</tr>

<td class=3D"vendor-product">vercel--next.js</td>
<td>Next.js is a React framework for building full-stack web applications. =
In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requ= ests targeting Next.js applications using App Router with at least one Serv=
er Action can lead to excessive CPU usage blocking processing of further re= quests in the same process. This issue has been fixed in versions 15.5.21 a=
nd 16.2.11.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64641" target=3D= "_blank" rel=3D"noopener">CVE-2026-64641</a></td>
</tr>

<td class=3D"vendor-product">vercel--next.js</td>
<td>Next.js is a React framework for building full-stack web applications. =
In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js appl= ications using App Router built with Turbopack and a single entry in config= .i18n.locales can bypass middleware/proxy based authentication. This issue = has been fixed in version 16.2.11.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64642" target=3D= "_blank" rel=3D"noopener">CVE-2026-64642</a></td>
</tr>

<td class=3D"vendor-product">vercel--next.js</td>
<td>Next.js is a React framework for building full-stack web applications. =
In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js appl= ications using App Router, Server Actions (use server) or use cache endpoin=
ts can be disclosed bypassing any authentication on the pages where these e= ndpoints are usually used. Server Action IDs can be disclosed to unauthenti= cated users via publicly served client artifacts (for example, static chunk=
s containing action references). Affected users are applications using App = Router and Server Actions. By itself, this disclosure is typically a recon/= enumeration primitive; however, it can increase risk when combined with oth=
er weaknesses. This issue has been fixed in versions 15.5.21 and 16.2.11.</=

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64643" target=3D= "_blank" rel=3D"noopener">CVE-2026-64643</a></td>
</tr>

<td class=3D"vendor-product">vercel--next.js</td>
<td>Next.js is a React framework for building full-stack web applications. =
In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-ho= sting Next.js with the default image loader, the Image Optimization API can=
optimize remotely hosted images if configured (not enabled by default). If=
those images contain malicious content, they can cause CPU exhaustion in /= _next/image endpoints.Only config.images.remotePatterns is affected, and ju=
st the patterns in that array, whereas config.images.unoptimized: true, con= fig.images.loader: 'custom', and Vercel are not impacted. This issue has be=
en fixed in versions 15.5.21 and 16.2.11.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64644" target=3D= "_blank" rel=3D"noopener">CVE-2026-64644</a></td>
</tr>

<td class=3D"vendor-product">vercel--next.js</td>
<td>Next.js is a React framework for building full-stack web applications. =
In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites()=
or redirects() rule that builds its external destination hostname from req= uest-controlled input can be pointed at an arbitrary hostname, regardless o=
f the rule's hostname suffix. For a rewrite, Next.js proxies the request to=
that arbitrary host and serves the response from the application's origin,=
leading to Server-Side Request forgery. A redirects() rule configured this=
way is vulnerable to an Open Redirect. This issue has been fixed in versio=
ns 15.5.21 and 16.2.11.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64645" target=3D= "_blank" rel=3D"noopener">CVE-2026-64645</a></td>
</tr>

<td class=3D"vendor-product">vercel--next.js</td>
<td>Next.js is a React framework for building full-stack web applications. =
In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests tar= geting Next.js applications using App Router with at least one Server Actio=
n can lead to excessive memory consumption if that Server Actions uses the = Edge runtime. This issue has been fixed in versions 15.5.21 and 16.2.11.</t=

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64646" target=3D= "_blank" rel=3D"noopener">CVE-2026-64646</a></td>
</tr>

<td class=3D"vendor-product">vercel--next.js</td>
<td>Next.js is a React framework for building full-stack web applications. =
In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-sid=
e fetch with a request body may return a cached response body from a differ= ent request to the same URL but different body. Confidential data in the PO= ST's response body would then leak to unauthorized requests. Though the req= uest itself will not be deduped. This is only an issue when receiving reque=
st bodies with a content type charset other than UTF-8. For example, the UT= F-16 byte sequences for =C3=AC=E2=80=9A=C6=92=C3=AC=E2=80=9A=C6=92 and =C3= =AC=E2=80=9E=E2=80=9E=C3=AC=E2=80=9E=E2=80=9E in the request body would sha=
re the same cache. This issue has been fixed in versions 15.5.21 and 16.2.1= 1.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64647" target=3D= "_blank" rel=3D"noopener">CVE-2026-64647</a></td>
</tr>

<td class=3D"vendor-product">vercel--next.js</td>
<td>Next.js is a React framework for building full-stack web applications. =
In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-sid=
e fetch with a request body may return a cached response body from a differ= ent request to the same URL but different body. Confidential data in the PO= ST's response body would then leak to unauthorized requests. Though the req= uest itself will not be deduped. This only applies to fetch calls with a re= quest that has a different init than the one passed to fetch. A safe reques=
t would be: fetch(new Request(init), init). An unsafe request would be: fet= ch(new Request(init), aDifferentInit). This issue has been fixed in version=
s 15.5.21 and 16.2.11.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64648" target=3D= "_blank" rel=3D"noopener">CVE-2026-64648</a></td>
</tr>

<td class=3D"vendor-product">vercel--next.js</td>
<td>Next.js is a React framework for building full-stack web applications. =
In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Serve=
r Action forwards or redirects a request, an attacker can cause the server =
to send that outbound request to a malicious host (Server-Side Request Forg= ery). This requires the attacker's request to control Host-associated heade= rs. In some configurations, it's also possible to obtain internal values th=
at weaken middleware/proxy authorization. Applications that use Server Acti= ons are affected when the incoming host header is not fixed to a trusted va= lue. This typically occurs on custom servers, or on deployments not behind =
a proxy that pins the host. Managed hosting pins the host upstream and is n=
ot affected; next start and standalone output do the same from version 14.2=
onward. This issue has been fixed in versions 15.5.21 and 16.2.11.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-64649" target=3D= "_blank" rel=3D"noopener">CVE-2026-64649</a></td>
</tr>

<td class=3D"vendor-product">VPS.org--Supabase template</td>
<td>Deployment of the VPS.org one-click Supabase template deploys a Postgre= SQL instance that is published on all interfaces (0.0.0.0:5432) with a defa= ult database password set to "postgres". Because Docker installs its own ip= tables rules, this exposure bypasses a standard host UFW configuration.</td=

<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16503" target=3D= "_blank" rel=3D"noopener">CVE-2026-16503</a></td>
</tr>

<td class=3D"vendor-product">VPS.org--Zulip template</td>
<td>Deployment of the VPS.org one-click Zulip template deploys a hardcoded = application signing key, a default database password ("zulip"), and DISABLE= _HTTPS=3DTrue.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16504" target=3D= "_blank" rel=3D"noopener">CVE-2026-16504</a></td>
</tr>

<td class=3D"vendor-product">wazuh--wazuh</td>
<td>Wazuh workflows before 44bf114 contain a shell injection vulnerability =
in GitHub Actions that allows attackers to execute arbitrary commands by su= bmitting pull requests with crafted VERSION.json files. Attackers can injec=
t shell metacharacters into environment variables that are directly interpo= lated into run steps, enabling command execution and exfiltration of secret=
s including GITHUB_TOKEN and AWS credentials on self-hosted runners.</td> <td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-67308" target=3D= "_blank" rel=3D"noopener">CVE-2026-67308</a></td>
</tr>

<td class=3D"vendor-product">WebPros--cPanel</td>
<td>HTTP Smuggling in cPanel allows potential leak of credentials.</td>

<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58047" target=3D= "_blank" rel=3D"noopener">CVE-2026-58047</a></td>
</tr>

<td class=3D"vendor-product">WebPros--cPanel</td>
<td>Improper preservation of SQL mode when renaming databases in cPanel all= ows execution of SQL in root context.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-58048" target=3D= "_blank" rel=3D"noopener">CVE-2026-58048</a></td>
</tr>

<td class=3D"vendor-product">webtoffee-cookie-consent--webtoffee-cookie-con= sent</td>
<td>The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not per= form authorization checks on several of its REST API routes, allowing unaut= henticated attackers to export and delete stored visitor consent records, c= reate posts, and modify the webtoffee-cookie-consent WordPress plugin befor=
e 3.5.3's licensing state.</td>
<td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13389" target=3D= "_blank" rel=3D"noopener">CVE-2026-13389</a></td>
</tr>

<td class=3D"vendor-product">withastro--astro</td>
<td>Astro is a web framework for content-driven websites. In versions 3.10.=
0 through 7.0.3, when a transition:persist, transition:scope, or transition= :persist-props directive is applied to a client-hydrated (client:*) compone= nt, Astro copied the directive value onto the rendered &lt;astro-island&gt;=
element without HTML-escaping it. If a developer reflects attacker-control= led input into one of these directives, an attacker can break out of the at= tribute and inject arbitrary HTML/JavaScript into the server-rendered outpu=
t, resulting in reflected cross-site scripting (XSS). Exploitation requires=
the application developer to have written a non-idiomatic pattern - passin=
g untrusted, request-derived input directly into a transition directive. As= tro applications that do not route untrusted input into these directives ar=
e unaffected. This issue has been fixed in version 7.0.4.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59727" target=3D= "_blank" rel=3D"noopener">CVE-2026-59727</a></td>
</tr>

<td class=3D"vendor-product">withastro--astro</td>
<td>Astro is a web framework for content-driven websites. Versions prior to=
7.0.6 are vulnerable to XSS through unescaped spread attribute names in re= nderHTMLElement. The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an = INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribut=
e names containing "' &gt;/=3D or whitespace are dropped. A second attribut= e-rendering path, renderHTMLElement() in packages/astro/src/runtime/server/= render/dom.ts, has its own inline attribute loop that does not go through a= ddAttribute() and was not updated. It interpolates the attribute name unesc= aped and only escapes the value, so untrusted prop keys spread onto a nativ= e-HTMLElement-subclass component can still break out of the attribute conte= xt. This issue has been fixed in version 7.0.6.</td>

<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59729" target=3D= "_blank" rel=3D"noopener">CVE-2026-59729</a></td>
</tr>

<td class=3D"vendor-product">withastro--astro</td>
<td>Astro is a web framework for content-driven websites. In versions 8.1.0=
through 11.0.1, when trailingSlash: 'always' is configured, the @astrojs/n= ode standalone server's static file handler appends a trailing slash to req= uest paths and issues a 301 redirect. Paths beginning with /\ (slash-backsl= ash) were not recognized as internal paths, so the handler would echo the r=
aw path back in the Location header. Because browsers treat \ as / per the = WHATWG URL specification, the resulting redirect could resolve to an extern=
al host. Preconditions for exploitation: trailingSlash: 'always' must be se=
t (non-default; the default is 'ignore'), the request path must not have a = file extension in its final segment, and an attacker must deliver the craft=
ed link to a user. This issue has been fixed in version 11.0.2.</td> <td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-59730" target=3D= "_blank" rel=3D"noopener">CVE-2026-59730</a></td>
</tr>

<td class=3D"vendor-product">WOLF--WOLF</td>
<td>The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capa= bility check on one of its AJAX actions, allowing an unauthenticated attack=
er to trick a logged-in administrator into writing arbitrary content, inclu= ding a malicious script, into a post via a cross-site request, resulting in=
stored Cross-Site Scripting.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14234" target=3D= "_blank" rel=3D"noopener">CVE-2026-14234</a></td>
</tr>

<td class=3D"vendor-product">WooCommerce--Event Booking Manager for WooComm= erce</td>
<td>The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7=
does not prevent the deserialization of user-controlled input in some of i=
ts event content fields, allowing users with Contributor-level access and a= bove to inject PHP objects. No POP chain is present in the Event Booking Ma= nager for WooCommerce WordPress plugin before 5.3.7 itself, but if one is p= resent via another installed Event Booking Manager for WooCommerce WordPres=
s plugin before 5.3.7 or , this could lead to actions such as arbitrary fil=
e deletion, sensitive data retrieval, or remote code execution. This is an = incomplete fix of the Event Booking Manager for WooCommerce WordPress plugi=
n before 5.3.7's earlier object-injection advisories.</td>
<td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16062" target=3D= "_blank" rel=3D"noopener">CVE-2026-16062</a></td>
</tr>

<td class=3D"vendor-product">WooCommerce--Event Booking Manager for WooComm= erce</td>
<td>The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7=
does not sanitise or escape event timeline content submitted by users with=
post-editing access before storing it and rendering it on the public event=
page, allowing users with the Author role and above to inject arbitrary Ja= vaScript that executes in the browser of any visitor viewing the event, inc= luding administrators.</td>
<td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16063" target=3D= "_blank" rel=3D"noopener">CVE-2026-16063</a></td>
</tr>

<td class=3D"vendor-product">WooCommerce--Event Booking Manager for WooComm= erce</td>
<td>The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7=
does not properly verify authorization on the object being modified when q= uick-editing events, only checking a global capability, allowing users with=
the Contributor role and above to modify the title and publication status =
of arbitrary posts and pages on the site, including content they do not own= .</td>
<td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16064" target=3D= "_blank" rel=3D"noopener">CVE-2026-16064</a></td>
</tr>

<td class=3D"vendor-product">WooCommerce--Product Attachment for WooCommerc= e</td>
<td>The Product Attachment for WooCommerce WordPress plugin before 2.3.3 do=
es not perform any authorization check before streaming media library files=
, allowing unauthenticated users to download any attachment - including pri= vate or unlinked uploads - by enumerating its numeric ID.</td> <td>2026-08-02</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-16285" target=3D= "_blank" rel=3D"noopener">CVE-2026-16285</a></td>
</tr>

<td class=3D"vendor-product">WooCommerce--Product Feed Manager For WooComme= rce</td>
<td>The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 = does not properly sanitise and escape product-feed custom filter rules befo=
re using them in a SQL query, allowing users with the Contributor role and = above to perform SQL injection attacks.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15258" target=3D= "_blank" rel=3D"noopener">CVE-2026-15258</a></td>
</tr>

<td class=3D"vendor-product">WordPress--WeChat WordPress plugin</td>
<td>The =C3=A5=C2=BE=C2=AE=C3=A4=C2=BF=C2=A1=C3=A4=C2=BA=C5=92=C3=A7=C2=BB= =C2=B4=C3=A7=C2=A0=C2=81=C3=A7=E2=84=A2=C2=BB=C3=A9=E2=84=A2=E2=80=A0 WordP= ress plugin through 1.3 does not properly validate WeChat webhook requests,=
as its signature check always passes, and it discloses the generated login=
code in the webhook response. This allows an unauthenticated attacker to f= orge a login event for any existing username, read the login code, and rede=
em it through an unauthenticated AJAX action to log in as that user, includ= ing an administrator, without a password.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13597" target=3D= "_blank" rel=3D"noopener">CVE-2026-13597</a></td>
</tr>

<td class=3D"vendor-product">WP Delicious--WP Delicious</td>
<td>The WP Delicious WordPress plugin before 1.10.2 does not perform an aut= horization check on one of its AJAX actions, allowing unauthenticated users=
to modify limited post metadata (a like counter and an associated identifi=
er list) on arbitrary posts, including inflating the counter and growing th=
e stored metadata without bound.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14305" target=3D= "_blank" rel=3D"noopener">CVE-2026-14305</a></td>
</tr>

<td class=3D"vendor-product">WP Ghost (Hide My WP Ghost)--WP Ghost (Hide My=
WP Ghost)</td>
<td>The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not=
verify that client IP information comes from a trusted proxy before trusti=
ng attacker-controllable HTTP headers, allowing unauthenticated attackers t=
o spoof their IP address to bypass the WP Ghost (Hide My WP Ghost) WordPres=
s plugin before 7.0.05's own brute-force protection and to downgrade its fi= rewall by matching a hardcoded whitelisted IP range.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11870" target=3D= "_blank" rel=3D"noopener">CVE-2026-11870</a></td>
</tr>

<td class=3D"vendor-product">WP Go Maps--WP Go Maps</td>
<td>The WP Go Maps WordPress plugin before 10.1.04 does not properly saniti=
se and escape a parameter before using it in a SQL query, allowing unauthen= ticated users to perform SQL injection attacks.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15381" target=3D= "_blank" rel=3D"noopener">CVE-2026-15381</a></td>
</tr>

<td class=3D"vendor-product">WP Hotel Booking--WP Hotel Booking</td>
<td>The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise an=
d escape a search parameter on an administrative listing before using it in=
a SQL query, allowing users holding the WP Hotel Booking WordPress plugin = before 2.3.2's booking-management roles to perform SQL injection attacks.</=

<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15153" target=3D= "_blank" rel=3D"noopener">CVE-2026-15153</a></td>
</tr>

<td class=3D"vendor-product">WP Photo Album Plus--WP Photo Album Plus</td> <td>WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all=
versions up to, and including, 9.2.03.001 through a decode-after-sanitize = (double-encoding) flaw in the photo-comment pipeline. On write, `wppa_do_co= mment()` sanitizes the comment with `wppa_filter_html()` (wp_kses) followed=
by `wp_strip_all_tags()` (`wppa-functions.php:2623-2624`). Because `wp_str= ip_all_tags()` only removes *real* tags, an attacker who submits a **double=
HTML-entity-encoded** payload (e.g. `&amp;amp;lt;img src=3D... onload=3D..= .&amp;amp;gt;`) passes the write filters as harmless entity text and is sto= red one decode-level down (`&amp;lt;img ... onload=3D...&amp;gt;`).</td> <td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14922" target=3D= "_blank" rel=3D"noopener">CVE-2026-14922</a></td>
</tr>

<td class=3D"vendor-product">WP Real IP-based Access Control--WP Real IP-ba= sed Access Control</td>
<td>The WP Real IP-based Access Control WordPress plugin through 1.3.1 does=
not perform any capability or nonce checks before storing one of its optio=
n values, and does not escape that value on output on its settings page, al= lowing unauthenticated users to store arbitrary JavaScript that executes in=
the context of any administrator who views the page.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14592" target=3D= "_blank" rel=3D"noopener">CVE-2026-14592</a></td>
</tr>

<td class=3D"vendor-product">WP Travel Engine--WP Travel Engine</td>
<td>The WP Travel Engine WordPress plugin before 6.8.2 does not perform a c= apability check on an AJAX action that updates a WP Travel Engine WordPress=
plugin before 6.8.2 option, allowing unauthenticated users to overwrite a = site-wide WP Travel Engine WordPress plugin before 6.8.2 option (the public=
nonce that gates the action is served to anonymous visitors).</td> <td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12500" target=3D= "_blank" rel=3D"noopener">CVE-2026-12500</a></td>
</tr>

<td class=3D"vendor-product">WP Travel--WP Travel</td>
<td>The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Ins= tant Payment Notifications through the PayPal post-back handshake before ma= rking a booking paid, allowing unauthenticated attackers to forge a notific= ation that flips an arbitrary pending booking to a paid and booked state at=
an attacker-chosen amount.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13143" target=3D= "_blank" rel=3D"noopener">CVE-2026-13143</a></td>
</tr>

<td class=3D"vendor-product">WP Travel--WP Travel</td>
<td>The WP Travel WordPress plugin before 11.8.1 does not verify that the b= ooking requested on its customer account dashboard belongs to the current u= ser, allowing any logged-in user to read another customer's booking details=
, including billing address information, by supplying an arbitrary booking = identifier.</td>
<td>2026-07-30</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-13145" target=3D= "_blank" rel=3D"noopener">CVE-2026-13145</a></td>
</tr>

<td class=3D"vendor-product">wp-graphql--wp-graphql</td>
<td>WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until = 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an = unauthenticated caller distinguish existing author-class accounts through t=
he sendPasswordResetEmail mutation and obtain public profile fields. This i= ssue is fixed in version 2.15.1.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54768" target=3D= "_blank" rel=3D"noopener">CVE-2026-54768</a></td>
</tr>

<td class=3D"vendor-product">wp-media-folder-addon--wp-media-folder-addon</=

<td>The wp-media-folder-addon WordPress plugin through 4.1.6 does not valid= ate a user-supplied parameter before using it in a file read operation in t=
wo AJAX actions available to unauthenticated users, leading to Arbitrary Fi=
le Disclosure and Server-Side Request Forgery on sites where a cloud storag=
e connection has been configured. This is an incomplete fix of CVE-2026-969=
0, whose patch hardened only one of the affected cloud-storage handlers and=
left the others unpatched.</td>
<td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-11974" target=3D= "_blank" rel=3D"noopener">CVE-2026-11974</a></td>
</tr>

<td class=3D"vendor-product">WPBot--WPBot</td>
<td>The WPBot WordPress plugin before 8.5.2 does not validate administrator= -configured field identifiers before using them in a SQL query, allowing us= ers with administrator access to perform SQL injection that executes when a=
visitor triggers a search.</td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14189" target=3D= "_blank" rel=3D"noopener">CVE-2026-14189</a></td>
</tr>

<td class=3D"vendor-product">wpForo Forum--wpForo Forum</td>
<td>The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and es= cape a user profile field before outputting it inside an HTML attribute on = the public participant profile page, allowing users with a subscriber-level=
account to inject JavaScript that executes in the browser of any visitor w=
ho views the profile, including a logged-in administrator.</td>

<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12696" target=3D= "_blank" rel=3D"noopener">CVE-2026-12696</a></td>
</tr>

<td class=3D"vendor-product">wpForo Forum--wpForo Forum</td>
<td>The wpForo Forum WordPress plugin before 3.1.2 does not verify that an =
AI chat conversation belongs to the requesting user before deleting its mes= sages, allowing users with a subscriber-level account to permanently delete=
the stored AI chat message history of any other user.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-12697" target=3D= "_blank" rel=3D"noopener">CVE-2026-12697</a></td>
</tr>

<td class=3D"vendor-product">xdan--jodit</td>
<td>Jodit Editor is a WYSIWYG editor with a built-in file browser &amp; ima=
ge editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not nor= malize foreign SVG or MathML script node names, allowing a script element n= ested directly in SVG or MathML to remain in editor.value and execute when = content is loaded. This issue is fixed in version 4.13.6.</td>

<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-65841" target=3D= "_blank" rel=3D"noopener">CVE-2026-65841</a></td>
</tr>

<td class=3D"vendor-product">Xen--Xen</td>
<td>Xenstore, to have an up-to-date picture of the entire system, wants to = know of domains appearing and disappearing. To make this more robust, a new=
XEN_DOMCTL_get_domain_state was introduced. The management of the bitmap u= nderlying that operation is tied into the binding of the VIRQ_DOM_EXC virtu=
al IRQ. Unfortunately an error path there would tear down the bitmap even i=
n cases when it wasn't set up. Unprivileged domains can trigger that error = path.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-42492" target=3D= "_blank" rel=3D"noopener">CVE-2026-42492</a></td>
</tr>

<td class=3D"vendor-product">Xen--Xen</td>
<td>Addressing certain issues, in particular related to operations which ma=
y take excessively long and therefore would need preemption, has turned out=
overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly av= ailable, the decision was to deprecate the functionality, while still retai= ning it for people to use at their own (security) risk. Memory-wise small e= nough guests may still be okay to run.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-42493" target=3D= "_blank" rel=3D"noopener">CVE-2026-42493</a></td>
</tr>

<td class=3D"vendor-product">Xen--Xen</td>
<td>[This CNA information record relates to multiple CVEs; the text explain=
s which aspects/vulnerabilities correspond to which CVE.] The directory and=
Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several leng= ths directly from attacker-controlled on-disk fields without validating the=
m: * The directory loop itself assumes a good record length. This is CVE-20= 26-42494. * The calculation of the System Use area may underflow. This is C= VE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) recor=
d length. This is CVE-2026-62423. * The Rock Ridge NM record processing ass= umes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE recor=
d processing assumes a good size and offset. This is CVE-2026-62425.</td> <td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-42494" target=3D= "_blank" rel=3D"noopener">CVE-2026-42494</a></td>
</tr>

<td class=3D"vendor-product">Xen--Xen</td>
<td>[This CNA information record relates to multiple CVEs; the text explain=
s which aspects/vulnerabilities correspond to which CVE.] The directory and=
Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several leng= ths directly from attacker-controlled on-disk fields without validating the=
m: * The directory loop itself assumes a good record length. This is CVE-20= 26-42494. * The calculation of the System Use area may underflow. This is C= VE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) recor=
d length. This is CVE-2026-62423. * The Rock Ridge NM record processing ass= umes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE recor=
d processing assumes a good size and offset. This is CVE-2026-62425.</td> <td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-42495" target=3D= "_blank" rel=3D"noopener">CVE-2026-42495</a></td>
</tr>

<td class=3D"vendor-product">Xen--Xen</td>
<td>[This CNA information record relates to multiple CVEs; the text explain=
s which aspects/vulnerabilities correspond to which CVE.] The directory and=
Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several leng= ths directly from attacker-controlled on-disk fields without validating the=
m: * The directory loop itself assumes a good record length. This is CVE-20= 26-42494. * The calculation of the System Use area may underflow. This is C= VE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) recor=
d length. This is CVE-2026-62423. * The Rock Ridge NM record processing ass= umes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE recor=
d processing assumes a good size and offset. This is CVE-2026-62425.</td> <td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62423" target=3D= "_blank" rel=3D"noopener">CVE-2026-62423</a></td>
</tr>

<td class=3D"vendor-product">Xen--Xen</td>
<td>[This CNA information record relates to multiple CVEs; the text explain=
s which aspects/vulnerabilities correspond to which CVE.] The directory and=
Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several leng= ths directly from attacker-controlled on-disk fields without validating the=
m: * The directory loop itself assumes a good record length. This is CVE-20= 26-42494. * The calculation of the System Use area may underflow. This is C= VE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) recor=
d length. This is CVE-2026-62423. * The Rock Ridge NM record processing ass= umes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE recor=
d processing assumes a good size and offset. This is CVE-2026-62425.</td> <td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62424" target=3D= "_blank" rel=3D"noopener">CVE-2026-62424</a></td>
</tr>

<td class=3D"vendor-product">Xen--Xen</td>
<td>[This CNA information record relates to multiple CVEs; the text explain=
s which aspects/vulnerabilities correspond to which CVE.] The directory and=
Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several leng= ths directly from attacker-controlled on-disk fields without validating the=
m: * The directory loop itself assumes a good record length. This is CVE-20= 26-42494. * The calculation of the System Use area may underflow. This is C= VE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) recor=
d length. This is CVE-2026-62423. * The Rock Ridge NM record processing ass= umes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE recor=
d processing assumes a good size and offset. This is CVE-2026-62425.</td> <td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62425" target=3D= "_blank" rel=3D"noopener">CVE-2026-62425</a></td>
</tr>

<td class=3D"vendor-product">Xen--Xen</td>
<td>[This CNA information record relates to multiple CVEs; the text explain=
s which aspects/vulnerabilities correspond to which CVE.] To manage the sys= tem, sysctl and platform operations are used by the control domain or a pos= sible Xenstore domain. Some of these operations may not be executed in para= llel, so a system-wide lock each is used. The way those locks are acquired = is, however, not providing any fairness. Furthermore, with XSM/Flask in use=
, the lock acquire will, for some operations, occur ahead of any permission=
checking. The sysctl issue is CVE-2026-62426. The platform-op issue is CVE= -2026-62427.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62426" target=3D= "_blank" rel=3D"noopener">CVE-2026-62426</a></td>
</tr>

<td class=3D"vendor-product">Xen--Xen</td>
<td>[This CNA information record relates to multiple CVEs; the text explain=
s which aspects/vulnerabilities correspond to which CVE.] To manage the sys= tem, sysctl and platform operations are used by the control domain or a pos= sible Xenstore domain. Some of these operations may not be executed in para= llel, so a system-wide lock each is used. The way those locks are acquired = is, however, not providing any fairness. Furthermore, with XSM/Flask in use=
, the lock acquire will, for some operations, occur ahead of any permission=
checking. The sysctl issue is CVE-2026-62426. The platform-op issue is CVE= -2026-62427.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62427" target=3D= "_blank" rel=3D"noopener">CVE-2026-62427</a></td>
</tr>

<td class=3D"vendor-product">Xen--Xen</td>
<td>When grant-copy operations are processed, the respective grant may or m=
ay not already be in use by another operation (a mapping or another copy). = For all copy operations the referenced guest frame is looked up. When anoth=
er operation is already active for the grant (the grant is "pinned"), what =
is being supplied back to actually carry out permission checks and copy ope= ration may not be consistent: The permission check may be carried out on a = page different from the one involved in the copy.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62428" target=3D= "_blank" rel=3D"noopener">CVE-2026-62428</a></td>
</tr>

<td class=3D"vendor-product">Xen--Xen</td>
<td>Accessing the vNUMA configuration data of a guest is still possible whe=
n domain destruction has already started. The cleaning up of that configura= tion information is not synchronized with its retrieval by a device model c= ontrolling the guest.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62429" target=3D= "_blank" rel=3D"noopener">CVE-2026-62429</a></td>
</tr>

<td class=3D"vendor-product">Xen--Xen</td>
<td>Accesses to the CMOS memory contents are done using an indirect IO port=
pair. Therefore Xen needs to cache the guest chosen index, and one of the = usages of the index didn't take the necessary locking to avoid concurrent c= hanges. As a result, a guest could change the index after it being checked,=
causing a subsequent out-of-bound read access to the contents of an array.= </td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62430" target=3D= "_blank" rel=3D"noopener">CVE-2026-62430</a></td>
</tr>

<td class=3D"vendor-product">Xen--Xen</td>
<td>The logic to handle periodic Viridian STIMERs performs a division with =
an unchecked user-controlled divisor value, that can be set to zero to caus=
e a #DE fault.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62431" target=3D= "_blank" rel=3D"noopener">CVE-2026-62431</a></td>
</tr>

<td class=3D"vendor-product">Xen--Xen</td>
<td>The EVTCHNOP_expand_array hypercall checks for whether FIFO event chann= els are enabled, but without holding the correct lock. It can race with EVT= CHNOP_reset, resulting in dereferencing a NULL pointer.</td> <td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62432" target=3D= "_blank" rel=3D"noopener">CVE-2026-62432</a></td>
</tr>

<td class=3D"vendor-product">Xen--Xen</td>
<td>Parts of the DM_OP handling code assumes the caller has provided the re= quired number of buffers for the given operation without any checking being=
done. As a result, certain operations might access stack rubble as structu= res are possibly uninitialized.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62433" target=3D= "_blank" rel=3D"noopener">CVE-2026-62433</a></td>
</tr>

<td class=3D"vendor-product">Xen--Xen</td>
<td>A guest started with Populated on Demand enabled (PoD) can attempt to r= eclaim pages which aren't regular guest RAM. This can cause corruption of m= emory management state in Xen.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62434" target=3D= "_blank" rel=3D"noopener">CVE-2026-62434</a></td>
</tr>

<td class=3D"vendor-product">Xen--Xen</td>
<td>[This CNA information record relates to multiple CVEs; the text explain=
s which aspects/vulnerabilities correspond to which CVE.] With the introduc= tion of Grant Table v2 came the requirement to be able to switch between ve= rsions. Switching from v1 to v2 reduces the number of valid grant reference=
s, as a bigger shared entry structure is then needed while the shared table=
doesn't change size. Switching from v2 back to v1 the status frames, which=
are separate in v2, go away. Code holding, but intermediately dropping and=
then re-acquiring the grant table lock, sometimes wrongly assumes that sai=
d properties wouldn't change across the window in time where the lock is no=
t being held. The v1 -&gt; v2 issue is CVE-2026-62435. The v2 -&gt; v1 issu=
e is CVE-2026-62436.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62435" target=3D= "_blank" rel=3D"noopener">CVE-2026-62435</a></td>
</tr>

<td class=3D"vendor-product">Xen--Xen</td>
<td>[This CNA information record relates to multiple CVEs; the text explain=
s which aspects/vulnerabilities correspond to which CVE.] With the introduc= tion of Grant Table v2 came the requirement to be able to switch between ve= rsions. Switching from v1 to v2 reduces the number of valid grant reference=
s, as a bigger shared entry structure is then needed while the shared table=
doesn't change size. Switching from v2 back to v1 the status frames, which=
are separate in v2, go away. Code holding, but intermediately dropping and=
then re-acquiring the grant table lock, sometimes wrongly assumes that sai=
d properties wouldn't change across the window in time where the lock is no=
t being held. The v1 -&gt; v2 issue is CVE-2026-62435. The v2 -&gt; v1 issu=
e is CVE-2026-62436.</td>
<td>2026-07-28</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-62436" target=3D= "_blank" rel=3D"noopener">CVE-2026-62436</a></td>
</tr>

<td class=3D"vendor-product">XMLRPC-C--XMLRPC-C</td>
<td>XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a refl= ected cross-site scripting (XSS) vulnerability in the error page component.= </td>
<td>2026-07-27</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-15928" target=3D= "_blank" rel=3D"noopener">CVE-2026-15928</a></td>
</tr>

<td class=3D"vendor-product">xxl-job--xxl-job v3.4.0</td>
<td>A Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigg=
er component of xxl-job v3.4.0 allows authenticated attackers to scan resou= rces via supplying a crafted HTTP request.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52371" target=3D= "_blank" rel=3D"noopener">CVE-2026-52371</a></td>
</tr>

<td class=3D"vendor-product">YOP Poll--YOP Poll</td>
<td>The YOP Poll WordPress plugin before 7.0.6 does not validate the connec= tion's origin IP address and instead trusts client-controlled forwarding he= aders when enforcing its per-IP vote restriction, allowing unauthenticated = attackers to bypass the vote limit and cast unlimited votes on a public pol= l.</td>
<td>2026-08-01</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-14840" target=3D= "_blank" rel=3D"noopener">CVE-2026-14840</a></td>
</tr>

<td class=3D"vendor-product">zitadel--zitadel</td>
<td>ZITADEL is an open source identity management platform. From 2.43.0 thr= ough 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the ema=
il and phone self-management API paths in internal/command/user_v2_email.go=
, internal/command/user_v2_phone.go, and internal/command/user_v2_human.go = allowed users to request returned verification codes without the required p= ermission, allowing users to claim ownership of email addresses or phone nu= mbers they do not control and bypass email-based or phone-based security po= licies. This issue is fixed in versions 3.4.11 and 4.15.1.</td> <td>2026-07-29</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-54693" target=3D= "_blank" rel=3D"noopener">CVE-2026-54693</a></td>
</tr>

<td class=3D"vendor-product">=C2=A0libiec61850--libiec61850 v1.6</td>
<td>An issue in the parseGoosePayload() function (/goose/goose_receiver.c) =
of libiec61850 v1.6 allows attackers to bypass authentication via a capture=
d GOOSE frame.</td>
<td>2026-07-31</td>
<td>not yet calculated</td>
<td><a href=3D"https://www.cve.org/CVERecord?id=3DCVE-2026-52134" target=3D= "_blank" rel=3D"noopener">CVE-2026-52134</a></td>
</tr>
</tbody>
</table>
<p><a href=3D"#top">Back to top</a></p>
</div>
</div>
</div>
<style>body {
font-size: 1em; font-family: Arial, Verdana, sans-serif; font-weight: norma=
l; font-style: normal; color: #333333;
}
</style>
=20


<div id=3D"mail_footer">
<p style=3D"text-align: center;"><span style=3D"font-size: 10.0pt; colo=
r: #757575;">Having trouble viewing this message?=C2=A0</span><a href=3D"ht= tps://content.govdelivery.com/accounts/USDHSCISA/bulletins/423638a" target= =3D"_blank" rel=3D"noopener">View it as a webpage</a>.=C2=A0<a href=3D"http= s://content.govdelivery.com/accounts/USDHS/bulletins/292141e" target=3D"_bl= ank" rel=3D"noopener"></a><span style=3D"font-size: 10.0pt; color: #757575;= "></span></p>
<p style=3D"text-align: center;"><span style=3D"font-size: 10.0pt; color: #= 757575;">You are subscribed to updates from the </span><a href=3D"https://w= ww.cisa.gov"><span style=3D"font-size: 10.0pt;">Cybersecurity and Infrastru= cture Security Agency</span></a><span style=3D"font-size: 10.0pt; color: #7= 57575;"> (CISA)<br></span><a href=3D"https://public.govdelivery.com/account= s/USDHSCISA/subscriber/edit?preferences=3Dtrue#tab1" target=3D"_blank" rel= =3D"noopener"><span style=3D"font-size: 10.0pt; color: #00568c;">Manage Sub= scriptions</span></a>=C2=A0=C2=A0<span style=3D"font-size: 10.0pt; color: #= 757575;">|=C2=A0=C2=A0</span><a href=3D"https://www.cisa.gov/privacy-policy=
" target=3D"_blank" rel=3D"noopener"><span style=3D"font-size: 10.0pt; colo=
r: #00568c;">Privacy Policy</span></a><span style=3D"font-size: 10.0pt; col= or: #757575;">=C2=A0=C2=A0|=C2=A0 <a href=3D"https://subscriberhelp.granicu= s.com/s/article/Subscriber-Help-Center" target=3D"_blank" rel=3D"noopener">= Help</a><a href=3D"https://insights.govdelivery.com/Communications/Subscrib= er_Help_Center" target=3D"_blank" rel=3D"noopener"></a></span><span style= =3D"font-size: 10.0pt; color: #757575;"></span></p>
<p style=3D"text-align: center;"><span style=3D"font-size: 10.0pt; color: #= 757575;">Connect with CISA: <br></span><a href=3D"https://www.facebook.com/= CISA" target=3D"_blank" rel=3D"noopener"><span style=3D"font-size: 10.0pt; = color: #00568c;">Facebook</span></a><span style=3D"font-size: 10.0pt; color=
: #757575;">=C2=A0 |=C2=A0 </span><a href=3D"https://twitter.com/CISAgov" t= arget=3D"_blank" rel=3D"noopener"><span style=3D"font-size: 10.0pt; color: = #00568c;">Twitter</span></a><span style=3D"font-size: 10.0pt; color: #75757= 5;">=C2=A0 |=C2=A0 </span><a href=3D"https://Instagram.com/cisagov" target= =3D"_blank" rel=3D"noopener"><span style=3D"font-size: 10.0pt; color: #0056= 8c;">Instagram</span></a><span style=3D"font-size: 10.0pt; color: #757575;"= >=C2=A0 |=C2=A0 </span><a href=3D"https://www.linkedin.com/company/cybersec= urity-and-infrastructure-security-agency" target=3D"_blank" rel=3D"noopener= "><span style=3D"font-size: 10.0pt; color: #00568c;">LinkedIn</span></a><sp=
an style=3D"font-size: 10.0pt; color: #757575;">=C2=A0 |=C2=A0=C2=A0 </span= ><a href=3D"https://www.youtube.com/channel/UCxyq9roe-npgzrVwbpoAy0A" targe= t=3D"_self"><span style=3D"font-size: 10.0pt; color: #00568c;">YouTube</spa= n></a><span style=3D"font-size: 10.0pt; color: #757575;"></span></p>

</div>
<div id=3D"tagline">
<hr>
<table style=3D"width: 100%;" border=3D"0" cellspacing=3D"0" cellpadding=3D=

<tbody>

<td style=3D"color: #757575; font-size: 10px; font-family: Arial;" width=3D= "89%">This email was sent to cisa@toolazy.synchro.net using Granicus Commun= ications Cloud, on behalf of: Cybersecurity and Infrastructure Security Age= ncy =C2=B7 707 17th St, Suite 4000 =C2=B7 Denver, CO 80202</td>
<td align=3D"right" width=3D"11%"><a href=3D"https://granicus.com/solution/= digital-communication-engagement/" target=3D"_blank" rel=3D"noopener"><img = src=3D"https://content.govdelivery.com/images/govd-logo-dark.png" border=3D= "0" alt=3D"GovDelivery logo" width=3D"115"></a></td>
</tr>
</tbody>
</table>
<style type=3D"text/css">body .abe-column-block { min-height: 5px; } table.= gd_combo_table img {margin-left:10px; margin-right:10px;} table.gd_combo_ta= ble div.govd_image_display img, table.gd_combo_table td.gd_combo_image_cell=
img {margin-left:0px; margin-right:0px;}</style>

</div>
</td>
</tr>
</table>

<img alt=3D"" src=3D"https://links-2.govdelivery.com/CI0/0101019fc8300b64-a= 5996cc4-eab7-4402-8101-ec368d82a960-000000/icbMhHs225OzJufUbaR2lwelhypEl9Qu= 4aeDBCdSbp0=3D452" style=3D"display: none; width: 1px; height: 1px;">
</body>
</html>

--===============5520073085980316267==--

--===============6114063095565349875==--