# CVEs published 2026-07-06

196 CVEs were published on July 6, 2026: 30 critical, 77 high. Days are UTC.

- [CVE-2024-56141](https://cve.now/CVE-2024-56141.md): Minosoft has IV equal to key (CVSS 5.0, Bixilon Minosoft)
- [CVE-2026-53648](https://cve.now/CVE-2026-53648.md): FOSSBilling: Downloadable product files can be overwritten through filename collisions (CVSS 5.1, FOSSBilling)
- [CVE-2026-53647](https://cve.now/CVE-2026-53647.md): FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get\_info endpoint (CVSS 6.9, FOSSBilling)
- [CVE-2026-13356](https://cve.now/CVE-2026-13356.md): Interrupted navigation could allow address bar origin spoofing in Firefox for iOS (CVSS 6.3, Mozilla Firefox for iOS)
- [CVE-2026-53646](https://cve.now/CVE-2026-53646.md): FOSSBilling: Client password reset token reuse allows persistent account takeover (CVSS 7.7, FOSSBilling)
- [CVE-2026-53645](https://cve.now/CVE-2026-53645.md): FOSSBilling's missing self-edit prevention in staff permission management allows persistent privilege escalation (CVSS 8.5, FOSSBilling)
- [CVE-2026-53644](https://cve.now/CVE-2026-53644.md): FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders (CVSS 8.6, FOSSBilling)
- [CVE-2026-53643](https://cve.now/CVE-2026-53643.md): FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpoints (CVSS 8.7, FOSSBilling)
- [CVE-2026-53642](https://cve.now/CVE-2026-53642.md): FOSSBilling: Unverified clients can access client-area pages when email confirmation is required (CVSS 5.3, FOSSBilling)
- [CVE-2026-53641](https://cve.now/CVE-2026-53641.md): FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal (CVSS 4.8, FOSSBilling)
- [CVE-2026-53640](https://cve.now/CVE-2026-53640.md): FOSSBilling missing authorization checks on read-only admin API endpoints expose sensitive staff, client, and redirect data (CVSS 2.3, FOSSBilling)
- [CVE-2026-43928](https://cve.now/CVE-2026-43928.md): FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpayment (CVSS 2.3, FOSSBilling)
- [CVE-2026-43927](https://cve.now/CVE-2026-43927.md): FOSSBilling has race condition in cart checkout that bypasses promo code usage limits (CVSS 6.9, FOSSBilling)
- [CVE-2026-43925](https://cve.now/CVE-2026-43925.md): FOSSBilling: Mass assignment of group\_id in guest client registration allows unauthorized promo code use (CVSS 6.9, FOSSBilling)
- [CVE-2026-43921](https://cve.now/CVE-2026-43921.md): FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization (CVSS 8.9, FOSSBilling)
- [CVE-2026-42153](https://cve.now/CVE-2026-42153.md): Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container (CVSS 8.8, coollabsio coolify)
- [CVE-2026-34167](https://cve.now/CVE-2026-34167.md): Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor (CVSS 5.0, coollabsio coolify)
- [CVE-2026-34049](https://cve.now/CVE-2026-34049.md): Coolify: Command Injection via unsanitized MongoDB collection names in database backup (CVSS 3.3, coollabsio coolify)
- [CVE-2026-34599](https://cve.now/CVE-2026-34599.md): Coolify: Authenticated Remote Code Execution in GetLogs Livewire Component (CVSS 8.8, coollabsio coolify)
- [CVE-2026-43918](https://cve.now/CVE-2026-43918.md): Suspended or inactive FOSSBilling accounts can retain or regain access through existing sessions, API tokens, and password reset flows (CVSS 8.7, FOSSBilling)
- [CVE-2026-42204](https://cve.now/CVE-2026-42204.md): Coolify: Authenticated RCE via SHELL\_SAFE\_COMMAND\_PATTERN regression → host root (CVSS 8.8, coollabsio coolify)
- [CVE-2026-59710](https://cve.now/CVE-2026-59710.md): showdown - Stored XSS via Unescaped Table Header ID Attribute Injection (CVSS 5.3, showdown)
- [CVE-2026-42148](https://cve.now/CVE-2026-42148.md): Coolify: Command Injection via Unescaped Version String in Docker Build (CVSS 3.8, coollabsio coolify)
- [CVE-2026-34153](https://cve.now/CVE-2026-34153.md): Coolify LocalFileVolume fs\_path command injection enables RCE (CVSS 8.8, coollabsio coolify)
- [CVE-2026-41899](https://cve.now/CVE-2026-41899.md): Coolify unauthenticated feedback endpoint allows Discord webhook abuse (CVSS 6.5, coollabsio coolify)
- [CVE-2026-34050](https://cve.now/CVE-2026-34050.md): Coolify Settings/Updates Livewire component missing instance administrator authorization (CVSS 6.5, coollabsio coolify)
- [CVE-2026-32718](https://cve.now/CVE-2026-32718.md): Coolify read-scoped API tokens can perform state-changing validation operations (CVSS 6.5, coollabsio coolify)
- [CVE-2026-59711](https://cve.now/CVE-2026-59711.md): showdown - Cross-Site Scripting via Unescaped Metadata Title in completeHTMLDocument (CVSS 5.3, showdown)
- [CVE-2026-42331](https://cve.now/CVE-2026-42331.md): FOSSBilling missing authorization in guest Invoice API endpoints (CVSS 7.7, FOSSBilling)
- [CVE-2026-14468](https://cve.now/CVE-2026-14468.md): Path traversal allows arbitrary file read in Terraform Enterprise container (CVSS 7.7, HashiCorp Terraform Enterprise)
- [CVE-2026-33734](https://cve.now/CVE-2026-33734.md): FOSSBilling has improper SQL neutralization in \`Massmailer\` recipient filters (CVSS 6.9, FOSSBilling)
- [CVE-2026-42341](https://cve.now/CVE-2026-42341.md): FOSSBilling has an unauthenticated payment bypass via IPN callback forgery (CVSS 9.2, FOSSBilling)
- [CVE-2026-34038](https://cve.now/CVE-2026-34038.md): Coolify authenticated remote command injection leading to RCE and secret exfiltration (CVSS 9.9, coollabsio coolify)
- [CVE-2026-59712](https://cve.now/CVE-2026-59712.md): Leantime - JSON-RPC API Broken Access Control via users.getUser (CVSS 8.6, Leantime)
- [CVE-2026-59713](https://cve.now/CVE-2026-59713.md): Leantime - OIDC Login CSRF via Unconditional State Verification Stub (CVSS 8.6, Leantime)
- [CVE-2026-54763](https://cve.now/CVE-2026-54763.md): Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth (CVSS 7.8, traefik · github.com/traefik/traefik +2)
- [CVE-2026-14471](https://cve.now/CVE-2026-14471.md): Authenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-registry (CVSS 8.1, AWS MCP Gateway & Registry)
- [CVE-2026-54765](https://cve.now/CVE-2026-54765.md): Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port (CVSS 6.3, traefik · github.com/traefik/traefik/v3 +2)
- [CVE-2026-54764](https://cve.now/CVE-2026-54764.md): ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false (CVSS 6.9, traefik · github.com/traefik/traefik/v2 +2)
- [CVE-2026-57572](https://cve.now/CVE-2026-57572.md): Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser\_config.extra\_args (CVSS 10.0, unclecode crawl4ai · crawl4ai)
- [CVE-2026-57573](https://cve.now/CVE-2026-57573.md): Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint (CVSS 8.6, unclecode crawl4ai · crawl4ai)
- [CVE-2026-57571](https://cve.now/CVE-2026-57571.md): Crawl4AI arbitrary file write via download filename path traversal (CVSS 9.6, unclecode crawl4ai · crawl4ai)
- [CVE-2026-25271](https://cve.now/CVE-2026-25271.md): Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-25268](https://cve.now/CVE-2026-25268.md): Stack-based Buffer Overflow in WLAN Host (CVSS 8.8, Qualcomm Snapdragon)
- [CVE-2026-21384](https://cve.now/CVE-2026-21384.md): Out-of-bounds Write in Camera Driver (CVSS 5.3, Qualcomm Snapdragon)
- [CVE-2026-21383](https://cve.now/CVE-2026-21383.md): Reusing a Nonce, Key Pair in Encryption in HLOS (CVSS 7.1, Qualcomm Snapdragon)
- [CVE-2026-21379](https://cve.now/CVE-2026-21379.md): Buffer Over-read in Windows Compute (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-21370](https://cve.now/CVE-2026-21370.md): Out-of-bounds Write in Camera Driver (CVSS 5.3, Qualcomm Snapdragon)
- [CVE-2026-21369](https://cve.now/CVE-2026-21369.md): Out-of-bounds Write in Camera Driver (CVSS 5.3, Qualcomm Snapdragon)
- [CVE-2026-21368](https://cve.now/CVE-2026-21368.md): Out-of-bounds Write in Camera Driver (CVSS 5.3, Qualcomm Snapdragon)
- [CVE-2025-59617](https://cve.now/CVE-2025-59617.md): Use After Free in Computer Vision (CVSS 6.6, Qualcomm Snapdragon)
- [CVE-2025-59616](https://cve.now/CVE-2025-59616.md): Use After Free in Computer Vision (CVSS 6.6, Qualcomm Snapdragon)
- [CVE-2025-59615](https://cve.now/CVE-2025-59615.md): Use After Free in Computer Vision (CVSS 6.6, Qualcomm Snapdragon)
- [CVE-2026-55514](https://cve.now/CVE-2026-55514.md): vLLM denial of service via prompt embeds on M-RoPE models (CVSS 7.1, vllm-project vllm · vllm)
- [CVE-2026-55574](https://cve.now/CVE-2026-55574.md): vLLM: ReDoS via structured\_outputs.regex compiled without timeout in xgrammar and outlines backends (CVSS 8.7, vllm-project vllm · vllm)
- [CVE-2026-55727](https://cve.now/CVE-2026-55727.md): A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow… (CVSS 7.5, Genetec Security Center)
- [CVE-2026-50135](https://cve.now/CVE-2026-50135.md): Hugo: Symlink confinement bypass in resources.Get (CVSS 6.9, gohugoio hugo · github.com/gohugoio/hugo)
- [CVE-2026-54234](https://cve.now/CVE-2026-54234.md): vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection (CVSS 7.5, vllm-project vllm · vllm)
- [CVE-2026-48267](https://cve.now/CVE-2026-48267.md): DNG SDK | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe DNG Software Development Kit)
- [CVE-2026-50134](https://cve.now/CVE-2026-50134.md): Hugo: security.http.urls allow-list bypass via HTTP redirects (CVSS 6.3, gohugoio hugo · github.com/gohugoio/hugo)
- [CVE-2026-14898](https://cve.now/CVE-2026-14898.md): The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses. (CVSS 6.5, OpenAI Codex desktop app for macOS)
- [CVE-2026-55646](https://cve.now/CVE-2026-55646.md): vLLM speech-to-text endpoints allocate full upload before enforcing the audio file-size limit (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2026-59089](https://cve.now/CVE-2026-59089.md): Gimp: gimp: denial of service via integer overflow in playstation tim loader (CVSS 5.5, gimp · Red Hat Enterprise Linux)
- [CVE-2026-53763](https://cve.now/CVE-2026-53763.md): OP-TEE has AES-GCM 32-bit integer overflow in length counters that breaks authentication guarantee (CVSS 3.8, OP-TEE optee\_os)
- [CVE-2026-44362](https://cve.now/CVE-2026-44362.md): OP-TEE's subkey rollback protection can be bypassed with older subkey versions (CVSS 5.5, OP-TEE optee\_os)
- [CVE-2026-42546](https://cve.now/CVE-2026-42546.md): OP-TEE has missing OPTEE\_MSG\_ATTR\_TYPE\_MASK in cleanup\_shm\_refs() leaks mobj references (CVSS 3.8, OP-TEE optee\_os)
- [CVE-2026-50133](https://cve.now/CVE-2026-50133.md): Hugo: XSS via text/html content files (CVSS 5.1, gohugoio hugo · github.com/gohugoio/hugo)
- [CVE-2026-41516](https://cve.now/CVE-2026-41516.md): OP-TEE: Hisilicon HPRE PKCS#1 v1.5 Decryption Padding Oracle (CVSS 2.5, OP-TEE optee\_os)
- [CVE-2026-58403](https://cve.now/CVE-2026-58403.md): Hugo symlink confinement bypass in os.ReadFile (CVSS 5.9, gohugoio hugo · github.com/gohugoio/hugo)
- [CVE-2026-41515](https://cve.now/CVE-2026-41515.md): OP-TEE: RSA-OAEP padding oracle in NXP CAAM driver enables plaintext recovery (CVSS 2.5, OP-TEE optee\_os)
- [CVE-2026-14536](https://cve.now/CVE-2026-14536.md): Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user… (CVSS 7.3, Devolutions Server)
- [CVE-2026-58402](https://cve.now/CVE-2026-58402.md): Hugo default code block renderer XSS via unescaped code-fence language (CVSS 5.1, gohugoio hugo · github.com/gohugoio/hugo)
- [CVE-2026-11405](https://cve.now/CVE-2026-11405.md): Hidden backdoor authentication mechanism in multiple versions of Tenda firmware allows admin access to web management interface (CVSS 9.8, Tenda firmware)
- [CVE-2026-58404](https://cve.now/CVE-2026-58404.md): Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings (CVSS 4.6, gohugoio hugo · github.com/gohugoio/hugo)
- [CVE-2026-41514](https://cve.now/CVE-2026-41514.md): OP-TEE: RSA-OAEP padding oracle in Hisilicon HPRE driver enables plaintext recovery (CVSS 2.5, OP-TEE optee\_os)
- [CVE-2026-54291](https://cve.now/CVE-2026-54291.md): Silent channel-binding authentication downgrade via unsupported certificate algorithms (CVSS 8.2, pgjdbc · org.postgresql:postgresql)
- [CVE-2026-55379](https://cve.now/CVE-2026-55379.md): Pillow BdfFontFile\`: \`Image.new()\` called without \`\_decompression\_bomb\_check()\` — bomb protection bypass via font loading (CVSS 7.5, python-pillow Pillow · pillow)
- [CVE-2026-55380](https://cve.now/CVE-2026-55380.md): Pillow GdImageFile decompression bomb protection bypass (CVSS 7.5, python-pillow Pillow · pillow)
- [CVE-2026-54060](https://cve.now/CVE-2026-54060.md): Pillow: \`FontFile.compile()\`: \`Image.new()\` called without \`\_decompression\_bomb\_check()\` (CVSS 7.5, python-pillow Pillow · pillow)
- [CVE-2026-54059](https://cve.now/CVE-2026-54059.md): Pillow: PcfFontFile.\_load\_bitmaps()\`: \`Image.frombytes()\` called without \`\_decompression\_bomb\_check()\` — bomb protection bypass via PCF… (CVSS 7.5, python-pillow Pillow · pillow)
- [CVE-2026-55798](https://cve.now/CVE-2026-55798.md): Pillow: WindowsViewer.get\_command() OS command injection via unescaped shell path (CVSS 4.5, python-pillow Pillow · pillow)
- [CVE-2026-9181](https://cve.now/CVE-2026-9181.md): Directory Traversal in ArcGIS Server (CVSS 9.8, Esri ArcGIS Server)
- [CVE-2026-9182](https://cve.now/CVE-2026-9182.md): Unvalidated File Upload vulnerability in ArcGIS Server. (CVSS 9.8, Esri ArcGIS Server)
- [CVE-2026-13753](https://cve.now/CVE-2026-13753.md): Certain HP DeskJet All in One – Potential Information Disclosure (CVSS 7.5, HP DeskJet 2820 AIO Printer · HP DeskJet 2823 AIO Print… +45)
- [CVE-2026-12154](https://cve.now/CVE-2026-12154.md): Reviews Widgets for Google, Yelp & TripAdvisor \<= 2.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'page\_id' Shortcode… (CVSS 6.4, widgetpack Reviews Widgets for Google, TripAdvisor, Yelp &…)
- [CVE-2026-41434](https://cve.now/CVE-2026-41434.md): OP-TEE has unbounded recursion in sanitize\_client\_object() (CVSS 3.3, OP-TEE optee\_os)
- [CVE-2026-48614](https://cve.now/CVE-2026-48614.md): An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives… (CVSS 9.9, WebPros Plesk)
- [CVE-2026-40257](https://cve.now/CVE-2026-40257.md): OP-TEE has SHA-3 accelerated finalize heap overflow (CVSS 5.5, OP-TEE optee\_os)
- [CVE-2025-53831](https://cve.now/CVE-2025-53831.md): DrawIO for ownCloud 10 is vulnerable to Stored XSS (CVSS 8.2, DrawIO for ownCloud · ownCloud)
- [CVE-2026-48316](https://cve.now/CVE-2026-48316.md): ColdFusion | Improper Input Validation (CWE-20) (CVSS 10.0, Adobe ColdFusion)
- [CVE-2026-40141](https://cve.now/CVE-2026-40141.md): High-Severity Vulnerability In Web Application Component of BeyondTrust Remote Support and Privileged Remote Access (CVSS 8.5, BeyondTrust Remote Support · BeyondTrust Privilege Remote A…)
- [CVE-2026-40140](https://cve.now/CVE-2026-40140.md): High-Severity Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote Access (CVSS 8.7, BeyondTrust Remote Support · BeyondTrust Privileged Remote…)
- [CVE-2026-40139](https://cve.now/CVE-2026-40139.md): Critical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote Access (CVSS 9.2, BeyondTrust Remote Support · BeyondTrust Privileged Remote…)
- [CVE-2026-40138](https://cve.now/CVE-2026-40138.md): Critical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote Access (CVSS 9.2, BeyondTrust Remote Support · BeyondTrust Privileged Remote…)
- [CVE-2026-43825](https://cve.now/CVE-2026-43825.md): Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModel (CVSS 7.3, Apache Software Foundation org.apache.opennlp:opennlp-ml-li…)
- [CVE-2026-5268](https://cve.now/CVE-2026-5268.md): SFTP Server Authentication Weakness (CVSS 9.1, CIENA 6500 S-Series · CIENA 6500 T-Series +2)
- [CVE-2026-59195](https://cve.now/CVE-2026-59195.md): pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node\_modules/.pnpm-config (CVSS 8.2, pnpm)
- [CVE-2026-59196](https://cve.now/CVE-2026-59196.md): pnpm: hoisted install imports lockfile alias outside node\_modules (CVSS 7.1, pnpm)
- [CVE-2025-53830](https://cve.now/CVE-2025-53830.md): Anti-Virus for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF) (CVSS 9.1, Anti-Virus for ownCloud · ownCloud)
- [CVE-2026-59194](https://cve.now/CVE-2026-59194.md): pnpm: patch-remove could delete project-selected files outside the patches directory (CVSS 7.1, pnpm)
- [CVE-2025-53829](https://cve.now/CVE-2025-53829.md): ownCloud 10 is vulnerable to Relative Path Traversal (CVSS 8.0, ownCloud)
- [CVE-2025-53828](https://cve.now/CVE-2025-53828.md): SharePoint for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF) (CVSS 8.5, owncloud SharePoint · ownCloud)
- [CVE-2026-13122](https://cve.now/CVE-2026-13122.md): OpenVPN version 2.6.0 through 2.6.20 and 2.7\_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed… (CVSS 5.9, OpenVPN)
- [CVE-2025-53827](https://cve.now/CVE-2025-53827.md): ownCloud Core: Updater has an exposed dangerous method or function (CVSS 9.1, ownCloud Core)
- [CVE-2026-59152](https://cve.now/CVE-2026-59152.md): Arbitrary server-side file read in LangSmith SDK TracingMiddleware (CVSS 5.0, langchain-ai langsmith-sdk · langsmith)
- [CVE-2026-58203](https://cve.now/CVE-2026-58203.md): NestedSecretsSettingsSource follows symlinks outside secrets\_dir, enabling local file read and bypassing secrets\_dir\_max\_size (CVSS 5.3, pydantic-settings)
- [CVE-2026-13698](https://cve.now/CVE-2026-13698.md): A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7\_alpha1 through 2.7.4 allows remote attackers with a… (CVSS 6.0, OpenVPN)
- [CVE-2026-54893](https://cve.now/CVE-2026-54893.md): Email-derived URL path injection in the Swoosh Microsoft Graph adapter (CVSS 2.1, swoosh)
- [CVE-2026-58380](https://cve.now/CVE-2026-58380.md): Gimp: gimp: stack buffer overflow in pnmscanner\_gettoken() (CVSS 7.3, Red Hat Enterprise Linux)
- [CVE-2026-7185](https://cve.now/CVE-2026-7185.md): Unauthorized access to files in T-Systems products (CVSS 6.0, T-Systems Archivo · T-Systems MyTAO +2)
- [CVE-2026-13708](https://cve.now/CVE-2026-13708.md): Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers in i\_readjpeg\_wiol (CVSS 7.5, TONYC Imager::File::JPEG)
- [CVE-2026-13705](https://cve.now/CVE-2026-13705.md): Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run… (CVSS 7.1, TONYC Imager)
- [CVE-2025-15668](https://cve.now/CVE-2025-15668.md): GPAC MP4Box box\_code\_base.c sgpd\_del\_entry heap-based overflow (CVSS 4.8, GPAC)
- [CVE-2025-15667](https://cve.now/CVE-2025-15667.md): GPAC MP4Box avc\_ext.c gf\_isom\_nalu\_sample\_rewrite double free (CVSS 4.8, GPAC)
- [CVE-2026-4249](https://cve.now/CVE-2026-4249.md): Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption (CVSS 8.6, WSO2 Universal Gateway · WSO2 Traffic Manager +2)
- [CVE-2025-8591](https://cve.now/CVE-2025-8591.md): Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification (CVSS 6.1, WSO2 Identity Server · WSO2 API Manager +5)
- [CVE-2026-6901](https://cve.now/CVE-2026-6901.md): Untrusted Search Path (CVSS 7.7, B&R Industrial Automation APROL)
- [CVE-2026-49297](https://cve.now/CVE-2026-49297.md): Apache Airflow Google provider: Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOperator +… (CVSS 8.1, Apache Software Foundation apache-airflow-providers-google…)
- [CVE-2026-6900](https://cve.now/CVE-2026-6900.md): Improper Certificate Validation (CVSS 7.4, B&R Industrial Automation APROL)
- [CVE-2026-44937](https://cve.now/CVE-2026-44937.md): SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components (CVSS 8.3, SUSE Rancher · github.com/rancher/fleet)
- [CVE-2026-46588](https://cve.now/CVE-2026-46588.md): Apache Camel: CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input (CVSS 7.3, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-46587](https://cve.now/CVE-2026-46587.md): Apache Camel: Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input (CVSS 7.3, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-49042](https://cve.now/CVE-2026-49042.md): Apache Camel: langchain4j-tools: filter tool argument headers against declared parameters (CVSS 7.3, Apache Software Foundation Apache Camel · org.apache.cam… +2)
- [CVE-2026-44936](https://cve.now/CVE-2026-44936.md): Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml (CVSS 5.0, SUSE Rancher · github.com/rancher/fleet)
- [CVE-2026-56810](https://cve.now/CVE-2026-56810.md): mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode\_body/5 (CVSS 8.7, elixir-mint mint · mint)
- [CVE-2026-58226](https://cve.now/CVE-2026-58226.md): Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax (CVSS 8.7, elixir-mint hpax · hpax)
- [CVE-2026-12686](https://cve.now/CVE-2026-12686.md): Incorrect authorisation in Adiss’s Biloop (CVSS 9.3, Adiss Biloop)
- [CVE-2026-9165](https://cve.now/CVE-2026-9165.md): Stackrox: stackrox: unbounded graphql query depth allows authenticated denial of service (CVSS 7.7, Red Hat Advanced Cluster Security)
- [CVE-2026-44934](https://cve.now/CVE-2026-44934.md): Exposed tokens in SUSE Rancher AI Agent logs (CVSS 7.0, SUSE Rancher)
- [CVE-2026-24013](https://cve.now/CVE-2026-24013.md): Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC (CVSS 9.1, Apache Software Foundation Apache IoTDB · apache-iotdb)
- [CVE-2026-24012](https://cve.now/CVE-2026-24012.md): Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query (CVSS 7.5, Apache Software Foundation Apache IoTDB · apache-iotdb)
- [CVE-2026-43866](https://cve.now/CVE-2026-43866.md): Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder (CVSS 7.3, Apache Software Foundation org.apache.camel:camel-jms ·… +6)
- [CVE-2026-24014](https://cve.now/CVE-2026-24014.md): Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write (CVSS 9.8, Apache Software Foundation Apache IoTDB · apache-iotdb)
- [CVE-2026-43867](https://cve.now/CVE-2026-43867.md): Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream… (CVSS 9.8, Apache Software Foundation org.apache.camel:camel-pqc · org…)
- [CVE-2026-56140](https://cve.now/CVE-2026-56140.md): Apache Camel AWS2 SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy to align it with sibling components (CVSS 9.8, Apache Software Foundation org.apache.camel:camel-aws2-sns…)
- [CVE-2026-56139](https://cve.now/CVE-2026-56139.md): Apache Camel Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in… (CVSS 5.3, Apache Software Foundation org.apache.camel:camel-undertow…)
- [CVE-2026-55994](https://cve.now/CVE-2026-55994.md): Apache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a… (CVSS 7.5, Apache Software Foundation org.apache.camel:camel-iggy · or…)
- [CVE-2026-55993](https://cve.now/CVE-2026-55993.md): Apache Camel Atmosphere Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a… (CVSS 7.5, Apache Software Foundation org.apache.camel:camel-atmospher…)
- [CVE-2026-1433](https://cve.now/CVE-2026-1433.md): uniFLOW Universal Login Manager (ULM) Standalone Improper Protection of Sensitive Information Leads to Information Disclosure (CVSS 4.8, NT-ware uniFLOW ULM (Universal Login Manager) Standalone)
- [CVE-2026-53913](https://cve.now/CVE-2026-53913.md): Apache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the… (CVSS 9.8, Apache Software Foundation org.apache.camel:camel-keycloak…)
- [CVE-2026-49365](https://cve.now/CVE-2026-49365.md): Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack… (CVSS 5.3, Apache Software Foundation org.apache.camel:camel-netty-htt…)
- [CVE-2026-49099](https://cve.now/CVE-2026-49099.md): Apache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to influence… (CVSS 5.3, Apache Software Foundation org.apache.camel:camel-salesforc…)
- [CVE-2026-49098](https://cve.now/CVE-2026-49098.md): Apache Camel: Camel-Kafka: The kafka.OVERRIDE\_TOPIC (and other kafka.\*) Exchange header constants used non-Camel-prefixed names that… (CVSS 5.3, Apache Software Foundation org.apache.camel:camel-kafka · o…)
- [CVE-2026-49097](https://cve.now/CVE-2026-49097.md): Apache Camel: Camel-IRC: The irc.sendTo (and other irc.\*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP… (CVSS 6.5, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-49086](https://cve.now/CVE-2026-49086.md): Apache Camel Dapr: Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers… (CVSS 6.5, Apache Software Foundation org.apache.camel:camel-dapr · or…)
- [CVE-2026-48206](https://cve.now/CVE-2026-48206.md): Apache Camel JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to drive… (CVSS 5.3, Apache Software Foundation Apache Camel JIRA · org.apache.c…)
- [CVE-2026-48205](https://cve.now/CVE-2026-48205.md): Apache Camel DNS: The dns. and term Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing… (CVSS 9.1, Apache Software Foundation org.apache.camel:camel-dns · org…)
- [CVE-2026-48204](https://cve.now/CVE-2026-48204.md): Apache Camel: Camel-MongoDB-GridFS: The gridfs. control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing… (CVSS 9.8, Apache Software Foundation org.apache.camel:camel-mongodb-g…)
- [CVE-2026-48203](https://cve.now/CVE-2026-48203.md): Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header… (CVSS 9.1, Apache Software Foundation org.apache.camel:camel-solr · or…)
- [CVE-2026-46726](https://cve.now/CVE-2026-46726.md): Apache Camel Vertx Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without… (CVSS 7.5, Apache Software Foundation org.apache.camel:camel-vertx-web…)
- [CVE-2026-46592](https://cve.now/CVE-2026-46592.md): Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that… (CVSS 7.5, Apache Software Foundation org.apache.camel:camel-cxf-so… +1)
- [CVE-2026-46591](https://cve.now/CVE-2026-46591.md): Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause… (CVSS 8.2, Apache Software Foundation org.apache.camel:camel-neo4j · o…)
- [CVE-2026-46590](https://cve.now/CVE-2026-46590.md): Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with… (CVSS 8.8, Apache Software Foundation org.apache.camel:camel-pqc · org…)
- [CVE-2026-46585](https://cve.now/CVE-2026-46585.md): Apache Camel Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN\_LUCENE\_DOCS) that bypass the HTTP header… (CVSS 7.5, Apache Software Foundation org.apache.camel:camel-lucene ·…)
- [CVE-2026-46584](https://cve.now/CVE-2026-46584.md): Apache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail session properties, allowing an attacker to… (CVSS 3.7, Apache Software Foundation org.apache.camel:camel-mail · or…)
- [CVE-2026-46457](https://cve.now/CVE-2026-46457.md): Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a… (CVSS 7.5, Apache Software Foundation org.apache.camel:camel-nats · or…)
- [CVE-2026-46456](https://cve.now/CVE-2026-46456.md): Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a… (CVSS 9.8, Apache Software Foundation org.apache.camel:camel-aws2-sqs…)
- [CVE-2026-46455](https://cve.now/CVE-2026-46455.md): Apache Camel: Camel-Keycloak: The access-token validity window is not verified because the IS\_ACTIVE check is missing from the… (CVSS 9.8, Apache Software Foundation org.apache.camel:camel-keycloak…)
- [CVE-2026-46454](https://cve.now/CVE-2026-46454.md): Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing… (CVSS 9.8, Apache Software Foundation org.apache.camel:camel-cometd ·…)
- [CVE-2026-46453](https://cve.now/CVE-2026-46453.md): Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering… (CVSS 5.3, Apache Software Foundation org.apache.camel:camel-elasticse…)
- [CVE-2026-43865](https://cve.now/CVE-2026-43865.md): Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution (CVSS 8.1, Apache Software Foundation org.apache.camel:camel-hazelcast…)
- [CVE-2026-42527](https://cve.now/CVE-2026-42527.md): Apache Camel: Permissive default ObjectInputFilter pattern admits java.net. and enables DNS-based information disclosure (CVSS 8.1, Apache Software Foundation org.apache.camel:camel · org… +11)
- [CVE-2026-40859](https://cve.now/CVE-2026-40859.md): Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is… (CVSS 8.1, Apache Software Foundation org.apache.camel:camel-vertx-… +1)
- [CVE-2026-40047](https://cve.now/CVE-2026-40047.md): Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in… (CVSS 9.1, Apache Software Foundation org.apache.camel:camel-docling ·…)
- [CVE-2026-14809](https://cve.now/CVE-2026-14809.md): PROG MIS｜Prog Management System - SQL Injection (CVSS 8.7, PROG MIS Prog Management System)
- [CVE-2026-14808](https://cve.now/CVE-2026-14808.md): PROG MIS｜Prog Management System - Exposure of Sensitive Information (CVSS 9.3, PROG MIS Prog Management System)
- [CVE-2026-14807](https://cve.now/CVE-2026-14807.md): PROG MIS｜ERP App - Use of Hard-coded Credentials (CVSS 9.3, PROG MIS ERP App)
- [CVE-2026-14802](https://cve.now/CVE-2026-14802.md): react create-react-app react-dev-utils openBrowser.js startBrowserProcess os command injection (CVSS 6.9, create-react-app · react-dev-utils)
- [CVE-2026-14801](https://cve.now/CVE-2026-14801.md): GPAC TeXML File load\_text.c txtin\_probe\_duration divide by zero (CVSS 4.8, GPAC)
- [CVE-2026-14800](https://cve.now/CVE-2026-14800.md): imhamzaazam ecommerceFlask cross-site request forgery (CVSS 5.3, imhamzaazam ecommerceFlask)
- [CVE-2026-6382](https://cve.now/CVE-2026-6382.md): Multiple elFinder Plugins - Authenticated OS Command Injection (CVSS 9.1, FileOrganizer · Advanced File Manager +2)
- [CVE-2026-12083](https://cve.now/CVE-2026-12083.md): Admin and Site Enhancements \< 8.8.4 - Unauthenticated Administrator-Role Restoration via reset-for Parameter (CVSS 8.1, Admin and Site Enhancements · admin-site-enhancements-pro)
- [CVE-2026-11962](https://cve.now/CVE-2026-11962.md): FileOrganizer \< 1.2.0 - Authenticated Arbitrary File Upload via elFinder File Operations (CVSS 8.8, FileOrganizer)
- [CVE-2026-11855](https://cve.now/CVE-2026-11855.md): Simple Membership \< 4.7.5 - Unauthenticated Stored XSS via Stripe Webhook API Version (CVSS 8.8, Simple Membership)
- [CVE-2026-11766](https://cve.now/CVE-2026-11766.md): Ultimate Member \< 2.12.0 - Subscriber+ Stored XSS via Custom Textarea Profile Fields (CVSS 8.0, Ultimate Member)
- [CVE-2026-10830](https://cve.now/CVE-2026-10830.md): AllCoach \< 1.0.2 - Unauthenticated Account Takeover (CVSS 8.8, AllCoach)
- [CVE-2024-6228](https://cve.now/CVE-2024-6228.md): WANotifier \< 2.6 - Subscriber+ LFI (CVSS 7.5, Notifications for Forms & WordPress Actions)
- [CVE-2026-14799](https://cve.now/CVE-2026-14799.md): CodeAstro Ecommerce Website my\_account.php sql injection (CVSS 5.3, CodeAstro Ecommerce Website)
- [CVE-2026-14798](https://cve.now/CVE-2026-14798.md): CodeAstro Apartment Visitor Management System visitor-entry.php sql injection (CVSS 5.3, CodeAstro Apartment Visitor Management System)
- [CVE-2026-14797](https://cve.now/CVE-2026-14797.md): CodeAstro Apartment Visitor Management System edit-apartment.php sql injection (CVSS 5.3, CodeAstro Apartment Visitor Management System)
- [CVE-2026-14796](https://cve.now/CVE-2026-14796.md): CodeAstro Apartment Visitor Management System report.php sql injection (CVSS 5.3, CodeAstro Apartment Visitor Management System)
- [CVE-2026-14795](https://cve.now/CVE-2026-14795.md): CodeAstro Apartment Visitor Management System action-visitor.php sql injection (CVSS 5.3, CodeAstro Apartment Visitor Management System)
- [CVE-2026-14794](https://cve.now/CVE-2026-14794.md): Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization (CVSS 5.3, Craft CMS · craftcms/cms)
- [CVE-2026-14793](https://cve.now/CVE-2026-14793.md): Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization (CVSS 5.3, Craft CMS · craftcms/cms)
- [CVE-2026-14792](https://cve.now/CVE-2026-14792.md): Formbricks Survey actions.ts access control (CVSS 6.9, Formbricks)
- [CVE-2026-14791](https://cve.now/CVE-2026-14791.md): crater-invoice-inc crater Invoice Note InvoicesRequest.php getFormattedString cross site scripting (CVSS 5.1, crater-invoice-inc crater)
- [CVE-2026-14790](https://cve.now/CVE-2026-14790.md): GPAC Media File write\_nhml.c nhmldump\_send\_frame null pointer dereference (CVSS 4.8, GPAC)
- [CVE-2026-14789](https://cve.now/CVE-2026-14789.md): radareorg radare2 Memory64ListStream mdmp.c stack-based overflow (CVSS 4.8, radareorg radare2)
- [CVE-2026-14788](https://cve.now/CVE-2026-14788.md): radareorg radare2 cfile.c r\_core\_bin\_load use after free (CVSS 4.8, radareorg radare2)
- [CVE-2026-14803](https://cve.now/CVE-2026-14803.md): Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder (CVSS 6.5, SRI Mojo::JSON)
- [CVE-2026-14787](https://cve.now/CVE-2026-14787.md): radareorg radare2 pb Print cmd\_print.inc cmd\_print integer overflow (CVSS 4.8, radareorg radare2)
- [CVE-2026-14786](https://cve.now/CVE-2026-14786.md): radareorg radare2 str.c r\_str\_word\_get0set integer overflow (CVSS 4.8, radareorg radare2)
- [CVE-2026-14784](https://cve.now/CVE-2026-14784.md): vxcontrol PentAGI Docker API client.go sandbox (CVSS 5.3, vxcontrol PentAGI)
- [CVE-2026-38973](https://cve.now/CVE-2026-38973.md): mrubyc through release3.4.1 was found to contain an out-of-bounds read in builtin missing-method lookup inside mrbc\_find\_method(). (CVSS 4.4)
- [CVE-2026-38976](https://cve.now/CVE-2026-38976.md): mrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in op\_super() / OP\_SUPER due to a missing runtime guard… (CVSS 7.5)
- [CVE-2026-38979](https://cve.now/CVE-2026-38979.md): ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI. (CVSS 5.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2026-07-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.