CVEs published July 20, 2026
266 CVEs were published on July 20, 2026: 45 critical, 101 high. Browse them by severity, product and exploitation status.
- Published
- 266
- Critical
- 45
- High
- 101
- Medium
- 112
- Low
- 3
- Unrated
- 5
- Now in CISA KEV
- 0
- Fix available
- 167
Most affected products
- surrealdb
- 30
- neutrinolabs xrdp
- 10
- datacycle-engine dataCycle-CORE
- 9
- Linux
- 9
- freescout-help-desk freescout
- 8
- Google Chrome
- 7
- Jovancoding Network-AI · network-ai
- 7
- themexpert.com Quix Page Builder Pro extension for Joomla
- 6
- axllent mailpit · github.com/axllent/mailpit
- 5
- bestpractical rt
- 5
Critical 45
- CVE-2026-15901Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to potentially exploit heap corruption via a…Google Chrome
- CVE-2026-15900Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox…Google Chrome
- CVE-2026-15899Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox…Google Chrome
- CVE-2026-64625AVideo before 29.0 OS Command Injection via execAsyncWWBN AVideo
- CVE-2026-53595FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQLfreescout-help-desk freescout
- CVE-2026-13380VSee Clinic and API Exposes Cleartext SFTP Credentials in Unauthenticated HTTP ResponsesVSee Clinic
- CVE-2026-44231RT: Privilege escalation and information disclosure via REST 2.0 user collection endpointbestpractical rt
- CVE-2026-63766GPT-SoVITS 20250606v2pro OS Command Injection via webui.pyRVC-Boss GPT-SoVITS
- CVE-2026-16337Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms dotCMS
- CVE-2026-63767ktransformers Unauthenticated Pickle Deserialization RCE via ZMQkvcache-ai ktransformers
- CVE-2026-61425Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0balbooa.com Gridbox extension for Joomla
- CVE-2026-61424Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2dj-extensions.com DJ-Classifieds extension for Joomla
- CVE-2026-62414Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2joomlack.fr Page Builder CK extension for Joomla
- CVE-2026-61900Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6dj-extensions.com jDownloads extension for Joomla
- CVE-2026-60034Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0themexpert.com JMedia extension for Joomla
- CVE-2026-60032Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0themexpert.com JMedia extension for Joomla
- CVE-2026-64193Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERRORNLNETLABS Net::DNS
- CVE-2026-39878Chamilo stored XSS via user registration leads to admin account takeoverchamilo-lms
- CVE-2026-41252xrdp: lib_palette_update Heap Buffer Overflow & RCEneutrinolabs xrdp
- CVE-2026-35048Piwigo RCE via PHP Code Injection into Config File in InstallerPiwigo
- CVE-2026-54051Network-AI has an an OS Command Injection issueJovancoding Network-AI · network-ai
- CVE-2026-35198HeyForm vulnerable to stored XSS via form field titlesheyform
- CVE-2026-46428lettre has TLS hostname verification disabled when using Boring TLS backendlettre
- CVE-2026-46412Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud wormbeproduct-org-nestjs-auth · @beproduct/nestjs-auth
- CVE-2026-62183Apache Syncope: User self-service privilege escalationApache Software Foundation org.apache.syncope.core:syncope-…
Show all 45 entriesShow fewer entries
- CVE-2026-57308Apache Syncope: SQL injection vulnerability in Audit Events searchApache Software Foundation Apache Syncope
- CVE-2026-53421Apache Syncope: Remote Code Execution via Scripted ConnectorApache Software Foundation Apache Syncope
- CVE-2026-53405Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTaskApache Software Foundation org.apache.syncope.ext.flowable:…
- CVE-2026-63071Apache Syncope: RCE via Groovy Sandbox bypassApache Software Foundation org.apache.syncope.core:syncope-…
- CVE-2026-12701Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexportRed Hat Ansible Automation Platform 2.5 for RHEL · Red H… +7
- CVE-2026-57309Blind SQL Injection in Windu CMSJCD Windu CMS
- CVE-2026-64622Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInboxJovancoding Network-AI
- CVE-2026-64621FreeRDP before 3.28.0 Double-Free via selectedmonitorsFreeRDP
- CVE-2026-64620FreeRDP before 3.28.0 Heap Buffer Overflow via crypto_rsa_commonFreeRDP
- CVE-2026-63756SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Conditionsurrealdb
- CVE-2026-16242Hypershift: konnectivity proxy-server accepts agent connections without validating client certificatesRed Hat multicluster engine for Kubernetes · Red Hat Ope… +3
- CVE-2026-16235Crypt::Password versions through 0.28 for Perl generate insecure random values for saltsDRSTEVE Crypt::Password
- CVE-2026-13147Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apisKirki
- CVE-2024-51311The Tenda TX9 V22.03.02.05 firmware has a stack overflow vulnerability in the sub_4418CC function of the file /goform/SetNetControlList.
- CVE-2024-51312The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EEE0 function of the file /goform/SetStaticRouteCfg.
- CVE-2024-51313The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EA38 function of the file /goform/SetVirtualServerCfg.
- CVE-2024-51314The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_424CE0 function of the file /goform/setMacFilterCfg.
- CVE-2024-51315The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_425964 function of the file /goform/SetOnlineDevName
- CVE-2026-51027An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component.
- CVE-2026-52656An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute…
High 101
- CVE-2026-63728Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Featuregitleaks
- CVE-2026-55833Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncationnetty · io.netty:netty-codec-http
- CVE-2026-55831Netty SPDY SETTINGS frame count materializes unbounded settings mapnetty · io.netty:netty-codec-http
- CVE-2026-15905Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap corruption via a…Google Chrome
- CVE-2026-15904Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in…Google Chrome
- CVE-2026-15903Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a…Google Chrome
- CVE-2026-15902Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a…Google Chrome
- CVE-2026-57495AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)@agenticmail/core · @agenticmail/claudecode +2
- CVE-2026-57494AgenticMail: Cross-agent task authorization bypass in AgenticMail API@agenticmail/api
- CVE-2026-47255AgenticMail API/storage and outbound relay hardening@agenticmail/api · @agenticmail/core
- CVE-2026-64624FreeRDP RDP File Parser Remote Code Execution via CLI OptionsFreeRDP
- CVE-2026-55550NextCRM has RBAC Bypass in MCP Product Tools that Allows Low-Privileged Users to Modify the CRM Product Catalogpdovhomilja nextcrm-app
- CVE-2026-55544NextCRM has BOLA/IDOR in MCP Campaign Tools that Allows Cross-User Campaign Disclosure and Tamperingpdovhomilja nextcrm-app
- CVE-2026-47130NextCRM has a BOLA/IDOR in PATCH /api/crm/contacts/[id] that allows Cross-Tenant CRM Data Tamperingpdovhomilja nextcrm-app
- CVE-2026-47129NextCRM has Broken Access Control in Server Actions that allows any authenticated user to deactivate/activate arbitrary accountspdovhomilja nextcrm-app
- CVE-2026-56623Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on WindowsApache Software Foundation org.apache.sshd:sshd-git
- CVE-2026-56624Apache MINA SSHD: SSH certificate options lack validationsApache Software Foundation org.apache.sshd:sshd-core
- CVE-2026-56452Apache MINA SSHD: Path traversal in SCP file receptionApache Software Foundation org.apache.sshd:sshd-scp
- CVE-2026-47198Paymenter: URL parameter injection bypasses paid plan limits at checkoutPaymenter · paymenter/paymenter
- CVE-2026-13381VSee Clinic and API Insecure Direct Object Reference in File API Allows Unauthorized File Access and DeletionVSee Clinic
- CVE-2026-53593FreeScout Vulnerable to Authenticated Remote Code Execution via incomplete upload extension denylist (.pht) — bypass of CVE-2025-48471freescout-help-desk freescout
- CVE-2026-53591FreeScout Vulnerable to Unauthenticated Conversation Thread Injection via HMAC Length Bypass in FetchEmailsfreescout-help-desk freescout
- CVE-2026-63770Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypassglanceapp glance
- CVE-2026-64619FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headersvastsa FileCodeBox
- CVE-2026-63108Roo Code 3.54.0 Command Injection via Parameter Expansion ParsingRooCodeInc Roo-Code
Show all 101 entriesShow fewer entries
- CVE-2026-12341SailPoint IdentityIQ Improper Bearer Token Validation VulnerabilitySailPoint Technologies IdentityIQ
- CVE-2026-60027Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1themexpert.com Quix Page Builder Pro extension for Joomla
- CVE-2026-48389DNG SDK | Stack-based Buffer Overflow (CWE-121)Adobe DNG Software Development Kit
- CVE-2026-60026Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.1themexpert.com Quix Page Builder Pro extension for Joomla
- CVE-2026-60030Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder < 6.2.1themexpert.com Quix Page Builder Pro extension for Joomla
- CVE-2026-60028Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1themexpert.com Quix Page Builder Pro extension for Joomla
- CVE-2026-64194Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chainsNLNETLABS Net::DNS
- CVE-2026-8170ExtremeXOS Privilege Escalation via Symlink Following in File UtilitiesExtreme Networks Switch Engine
- CVE-2026-8169ExtremeXOS Debug-Mode Privilege Escalation via Weak PRNGExtreme Networks Switch Engine
- CVE-2026-64612Libcupsfilters: cups-filters: libcupsfilters: cups image filter process abort via malformed pngRed Hat Enterprise Linux
- CVE-2026-48812FreeScout Allows Unauthenticated Access to Legacy Attachment Filesfreescout-help-desk freescout
- CVE-2026-55626xrdp: No authentication required with Xvnc backend on RHEL 9neutrinolabs xrdp
- CVE-2026-34239Chamilo Authenticated Remote Code Executionchamilo-lms
- CVE-2026-46555WhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltrationverygoodplugins whatsapp-mcp
- CVE-2026-58484Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruningJovancoding Network-AI · network-ai
- CVE-2026-40187Authenticated RCE via Malicious eTemplate Upload in EGroupwareegroupware · egroupware/egroupware
- CVE-2026-54538xrdp: Pre-auth infinite loop via totalLength=0 in TS_SHARECONTROLHEADERneutrinolabs xrdp
- CVE-2026-39879SQL injection in syslog-ng SQL destionation driversyslog-ng
- CVE-2026-39385Frappe LMS enrollment bypass in paid courses via unrelated batchfrappe lms
- CVE-2026-44178xrdp: Channel Data Forwarding Fixed-Size Buffer Overflowneutrinolabs xrdp
- CVE-2026-41521xrdp: lib_framebuffer_update Has Integer Overflow Heap Info Leak & ASLR Bypassneutrinolabs xrdp
- CVE-2026-46701Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default SecretJovancoding Network-AI · network-ai
- CVE-2026-64206Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lockLinux
- CVE-2026-64191i2c: stub: Reject I2C block transfers with invalid lengthLinux
- CVE-2026-64189netfilter: ipset: fix race between dump and ip_set_list resizeLinux
- CVE-2026-64188net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()Linux
- CVE-2026-35591Possible heap-based buffer overflow when decoding TIFF image containing well-crafted tilelibvips
- CVE-2026-33327Possible integer overflow leading to potential heap-based buffer overflowlibvips
- CVE-2026-32825dataCycle No Brute-Force Protection On Web And API Login Endpointsdatacycle-engine dataCycle-CORE
- CVE-2026-32824dataCycle User API Password Reset And Confirmation Flows Trust Attacker- Controlled Redirect Targetsdatacycle-engine dataCycle-CORE
- CVE-2026-32821API Collection Impersonation Via user_email And Missing Object- Level Authorizationdatacycle-engine dataCycle-CORE
- CVE-2026-32806dataCycle Authorization Bypass Via /remote_renderdatacycle-engine dataCycle-CORE
- CVE-2026-32820dataCycle Public Markdown Path Traversal Via /docs/*pathdatacycle-engine dataCycle-CORE
- CVE-2026-63429HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form contextheyform
- CVE-2026-32807dataCycle Public DataLink Text File Download Ignores Validity And Authorizationdatacycle-engine dataCycle-CORE
- CVE-2026-28220Wazuh cluster DAPI arbitrary callable deserialization and RBAC context injection allow a cluster peer to execute privileged functions on…wazuh
- CVE-2026-27823Remote Code Execution Vulnerability in EGroupwareegroupware · egroupware/egroupware
- CVE-2026-46415Caddy Defender trusted proxy client IP bypassJasonLovesDoggo caddy-defender · pkg.jsn.cam/caddy-defender
- CVE-2026-21824A privilege escalation vulnerability affects HCL CommerceHCLSoftware Commerce
- CVE-2026-45713Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizesaxllent mailpit · github.com/axllent/mailpit
- CVE-2026-25039The application evaluate UNC path in workspace nameScille parsec-cloud
- CVE-2026-62418Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources checkApache Software Foundation org.apache.syncope.core.idm:sync…
- CVE-2026-63091ProFTPD mod_sftp Signed Integer Overflow via SCP Size-Record Parserproftpd
- CVE-2026-63090ProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet Reassemblyproftpd
- CVE-2026-54910FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary filesgtsteffaniak filebrowser · github.com/gtsteffaniak/filebrow…
- CVE-2026-46410FileBrowser Quantum: unauthenticated user share share infogtsteffaniak filebrowser · github.com/gtsteffaniak/fileb… +1
- CVE-2026-45270CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Ruleci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-16248Tenda AC10 httpd/netctrl AdvSetLanip fromAdvSetLanip stack-based overflowTenda AC10
- CVE-2026-12080Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keysRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-64623Network-AI before 5.13.4 Cryptographic Signature Verification BypassJovancoding Network-AI
- CVE-2026-63763SurrealDB before 2.5.0 Privilege Escalation via Future Fieldssurrealdb
- CVE-2026-63760SurrealDB before 3.1.0 Denial of Service via JSON Parsersurrealdb
- CVE-2026-63759SurrealDB before 3.1.0 Denial of Service nested type annotationssurrealdb
- CVE-2026-63757SurrealDB before 3.1.0 Session Hijacking via /rpc sessionssurrealdb
- CVE-2026-63755SurrealDB before 3.1.0 Permission Bypass via WHERE Clausesurrealdb
- CVE-2026-63754SurrealDB before 3.1.0 Denial of Service via LIVE Querysurrealdb
- CVE-2026-63747SurrealDB before 3.1.0 Denial of Service via malformed RPC usesurrealdb
- CVE-2026-63746SurrealDB before 3.1.0 Permission Bypass via Graph Traversalsurrealdb
- CVE-2026-63740SurrealDB before 3.1.4 Array Element Permission Bypasssurrealdb
- CVE-2026-63739SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZERsurrealdb
- CVE-2026-63737SurrealDB before 3.1.5 Denial of Service via deep operator chainssurrealdb
- CVE-2026-63735SurrealDB before 3.2.0 Authentication Bypass via Custom APIsurrealdb
- CVE-2026-16247Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAINBizerba SE & Co. KG _connect.BRAIN
- CVE-2026-16246Insecure permission assignment due to execution of LogPathConfig.exe during setupBizerba SE & Co. KG BRAIN2
- CVE-2026-14448Authenticated RCE in system_certificates viewMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-13577Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailableDancer2
- CVE-2026-6656Crypt::Password versions through 0.28 for Perl are susceptible to timing attacksDRSTEVE Crypt::Password
- CVE-2026-9833Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' ParameterTag Groups is the Advanced Way to Display Your Taxonomy Ter…
- CVE-2026-13142Passwordless Login by VentraConnect < 1.4.1 - Unauthenticated Account Takeover via Email OTP Brute ForceSocial Login, Passkeys, Magic Link & Email OTP
- CVE-2026-12970LearnPress < 4.4.1 - Reflected XSS via c_searchLearnPress
- CVE-2026-12592SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry HeaderSlimStat Analytics
- CVE-2026-11349Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_moreModern Event Calendar Pro · Modern Events Calendar Lite
- CVE-2026-10081Unlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews WidgetUnlimited Elements For Elementor
- CVE-2024-51316The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name function of the file…
- CVE-2026-51031FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint.
- CVE-2026-52349Directory Traversal vulnerability in Menyoo 2.0 Versions before commit 729aa48: fixed in commit 729aa48 allows a local attacker to execute…
Medium, low and unrated 120
- CVE-2026-16327D-Link DNS-320 upload.php unrestricted uploadD-Link DNS-320
- CVE-2026-57852Authentication Bypass via Null Short-Circuit in Grav CMS Scheduler Webhook Token CheckTrilby Media Grav CMS scheduler-webhook plugin
- CVE-2026-64626AVideo Encoder downloadURL SSRF via unpinned retry fallbackWWBN AVideo
- CVE-2026-47144Shamefile has an arbitrary file read via shamefile.yaml in shame nextBKDDFS shamefile · shamefile
- CVE-2026-47128nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`always-further nono · nono-cli
- CVE-2026-16324Metasoft 美特软件 MetaCRM upload.jsp unrestricted uploadMetasoft 美特软件 MetaCRM
- CVE-2026-12900Spectra Gutenberg Blocks <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Blockbrainstormforce Spectra Legacy – Gutenberg Blocks
- CVE-2026-47134ClearanceKit: Policy signing key in System Keychain has permissive ACL allowing any local-root process to forge signed policycraigjbass clearancekit
- CVE-2026-47133ClearanceKit's signed policy tables lack monotonic counter, allowing replay of older legitimately-signed snapshotscraigjbass clearancekit
- CVE-2026-64650AI SDK Codex Harness Tool Relay Authorization Bypassvercel @ai-sdk/harness-codex
- CVE-2026-58624Apache MINA SSHD: Remote execution of JGit commands can write files on the serverApache Software Foundation org.apache.sshd:sshd-git
- CVE-2026-64651AI SDK OpenCode Harness Tool Relay Authorization Bypassvercel @ai-sdk/harness-opencode
- CVE-2026-55219Paymenter: Race condition in payWithCredit() enables credit double-spendPaymenter · paymenter/paymenter
- CVE-2026-53596FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS)freescout-help-desk freescout
- CVE-2026-53594FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Pathfreescout-help-desk freescout
- CVE-2026-44585Paymenter: Broken object level authorization via service reference manipulation on ticket creationPaymenter · paymenter/paymenter
- CVE-2026-44583Paymenter: Blind Unauthenticated SSRF on the Paypal gateway modulePaymenter · paymenter/paymenter
- CVE-2026-44584Paymenter doesn't reset email verification status after email changePaymenter · paymenter/paymenter
- CVE-2026-53592FreeScout vulnerable to prototype pollution in getQueryParamfreescout-help-desk freescout
- CVE-2026-44230RT: Reflected Cross-Site Scripting in search results chartbestpractical rt
- CVE-2026-44229RT: Cross-Site Scripting via inline-served uploaded contentbestpractical rt
- CVE-2026-15788WCOW cache mount source selector resolves NTFS junctions outside of cache rootmoby BuildKit
- CVE-2026-63768cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned Statecalcom cal.diy
- CVE-2026-63769Huginn < 2026.09.09 SSRF via ScenarioImport fetch_url Methodhuginn
- CVE-2026-63771Adminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix Headervrana adminer
Show all 120 entriesShow fewer entries
- CVE-2026-63731HyperDX < 2.31.0 SSRF via ClickHouse Proxy Test Endpointhyperdxio hyperdx
- CVE-2026-63730HyperDX < 2.31.0 SSRF via Webhook Test Endpointhyperdxio hyperdx
- CVE-2026-61901Joomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2hikashop.com Hikashop extension for Joomla
- CVE-2026-63107LimeSurvey SSRF via REST API Survey Template Host HeaderLimeSurvey
- CVE-2026-60031Joomla Extension - themexpert.com - Information disclosure in Quix Page Builder < 6.2.1themexpert.com Quix Page Builder Pro extension for Joomla
- CVE-2026-60029Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1themexpert.com Quix Page Builder Pro extension for Joomla
- CVE-2026-60033Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0themexpert.com JMedia extension for Joomla
- CVE-2026-44228RT: Stored Cross-Site Scripting via insufficient template escapingbestpractical rt
- CVE-2026-44227RT: Reflected Cross-Site Scripting via URL parametersbestpractical rt
- CVE-2026-45295FreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpointfreescout-help-desk freescout
- CVE-2026-55639xrdp: Out-of-bounds read in GCC Conference Create Request CS_SECURITY processing (xrdp_sec_process_mcs_data_CS_SECURITY)neutrinolabs xrdp
- CVE-2026-46715Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptancepallets-eco Flask-Security-Too · flask-security-too
- CVE-2026-55238xrdp: Malformed Confirm Active capability sets cause out-of-bounds readsneutrinolabs xrdp
- CVE-2026-42210Webmin 2FA requirement bypasswebmin
- CVE-2026-44978xrdp: Unchecked FIPS padding length in standard RDP Security causes heap out-of-bounds read in HMAC verificationneutrinolabs xrdp
- CVE-2026-50743A CSRF vulnerability exists in the `zone-include.php` script in Revive Adserver 6.0.7.Revive Adserver
- CVE-2026-55645xrdp: Out-of-bounds read in Client Control PDU processing (xrdp_rdp_process_data_control)neutrinolabs xrdp
- CVE-2026-47276NULL Pointer Dereference in REST API properties_parse via Malformed user_propertiesnanomq
- CVE-2026-42218XRDP is vulnerable to a server timing attack, leading to user enumerationneutrinolabs xrdp
- CVE-2026-47275nanomq NULL Pointer Dereference in MQTTv5 Client CONNECT Decoder Leading to Remote DoSnanomq
- CVE-2026-35217NanoMQ Incorrectly Accepts a Malformed SUBSCRIBE and Can Be Driven into an ASAN-Detectable Out-of-Bounds Readnanomq
- CVE-2026-58482Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actionsJovancoding Network-AI · network-ai
- CVE-2026-58481Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directoryJovancoding Network-AI · network-ai
- CVE-2026-58414Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backupsJovancoding Network-AI · network-ai
- CVE-2026-64207net/sched: dualpi2: fix GSO backlog accountingLinux
- CVE-2026-64205i2c: i801: fix hardware state machine corruption in error pathLinux
- CVE-2026-64192bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitializedLinux
- CVE-2026-64190net: team: fix NULL pointer dereference in team_xmit during mode changeLinux
- CVE-2026-64187xfs: fail recovery on a committed log item with no regionsLinux
- CVE-2026-58413EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment dataJovancoding Network-AI · network-ai
- CVE-2026-35590Possible out-of-bounds read leading to crash when decoding well-crafted EXIF metadatalibvips
- CVE-2026-33328Possible integer overflow on 32-bit systems when reading GIF imageslibvips
- CVE-2026-32823dataCycle State-Changing GET Endpoints Enable CSRFdatacycle-engine dataCycle-CORE
- CVE-2026-32819dataCycle User Directory Enumeration Via /users/searchdatacycle-engine dataCycle-CORE
- CVE-2026-46671Rust OneNote File Parser: Path traversal in `Parser::parse_notebook` allows reading files outside the notebook directorymsiemens onenote.rs · onenote_parser
- CVE-2026-63428HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field…heyform
- CVE-2026-45797HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Uploadheyform
- CVE-2026-32822dataCycle Unauthenticated Reflected DOM XSS Via flash[...] On Public Pagesdatacycle-engine dataCycle-CORE
- CVE-2026-63102rConfig Core < 8.2.8 Privilege Escalation via Users API role fieldrConfig v8 Core
- CVE-2026-6793Stored XSS in Bifra Engineering's Q-smart NexT PollBifra Engineering Consulting Q-smart NexT Poll
- CVE-2026-48824Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and…axllent mailpit · github.com/axllent/mailpit
- CVE-2026-45712Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)axllent mailpit · github.com/axllent/mailpit
- CVE-2026-26199Buffer underflow in `H5Iget_name `/`H5G_get_name` if size is zeroHDFGroup hdf5
- CVE-2026-26197Array full size, element count, and element size are not checked to make sure they match in H5Odtype.cHDFGroup hdf5
- CVE-2026-45711Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDsaxllent mailpit · github.com/axllent/mailpit
- CVE-2026-45709Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialeraxllent mailpit · github.com/axllent/mailpit
- CVE-2026-13724Business Logic Bypass in Gobito's Corporate Training Management SystemGobito Informatics Technologies Engineering Industry and Tr…
- CVE-2026-46516Frogman vulnerable to stored XSS in chat console formatter (escalation vector in multi-admin deployments)mwtcmi frogman
- CVE-2026-54685FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channelgtsteffaniak filebrowser · github.com/gtsteffaniak/filebrow…
- CVE-2026-16277Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbaddrlist()Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-16252Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System Staffshinel Ds.jsp sql injectionBeijing Shenzhou Shihan Technology Multimedia Integrated Bu…
- CVE-2026-45139CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operationsci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-59238Stored XSS in Pentestify via unsanitized finding images and report client logomaalfer Pentestify
- CVE-2026-57311Unrestricted Upload of File with Dangerous Type in Windu CMSJCD Windu CMS
- CVE-2026-57310Weak password hashing in Windu CMSJCD Windu CMS
- CVE-2026-16244itsourcecode Hospital Management System prescriptionorderreport.php sql injectionitsourcecode Hospital Management System
- CVE-2026-15588Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line bufferingRed Hat Enterprise Linux · Cert Manager support for Red… +6
- CVE-2026-63762SurrealDB before v2.6.1 Denial of Service via scriptingsurrealdb
- CVE-2026-63761SurrealDB before 3.1.0 Algorithm Downgrade via ES512surrealdb
- CVE-2026-63758SurrealDB before 3.1.0 Authorization Bypass via KILL Statementsurrealdb
- CVE-2026-63753SurrealDB before 3.1.0 Authentication Bypass via LIVE Querysurrealdb
- CVE-2026-63752SurrealDB before 3.1.0 RELATE Statement Record Overwritesurrealdb
- CVE-2026-63751SurrealDB before 3.1.0 Field Permission Bypass via JSON Patchsurrealdb
- CVE-2026-63750SurrealDB before 3.1.0 Memory Amplification via /sql WebSocketsurrealdb
- CVE-2026-63749SurrealDB before 3.1.0 Authentication Bypass via LIVE SELECTsurrealdb
- CVE-2026-63748SurrealDB before 3.1.0 Information Disclosure via Error Messagessurrealdb
- CVE-2026-63745SurrealDB before 3.1.0 Authorization Bypass via Composite Record-idsurrealdb
- CVE-2026-63744SurrealDB before 3.1.5 SSRF via JWKS URL Redirectsurrealdb
- CVE-2026-63743SurrealDB before 3.1.0 Port-Specific Deny Rule Bypass via HTTP Redirectsurrealdb
- CVE-2026-63742SurrealDB before 3.1.0 Field Permission Bypass via Indexed COUNTsurrealdb
- CVE-2026-63741SurrealDB before 3.1.0 Authentication Bypass via USE statementsurrealdb
- CVE-2026-63738SurrealDB 3.1.0 before 3.1.5 Field Permission Bypass via Traversalsurrealdb
- CVE-2026-63736SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolutionsurrealdb
- CVE-2026-63734SurrealDB before 3.2.0 Denial of Service via malformed SurrealML importsurrealdb
- CVE-2026-63733SurrealDB before 3.2.0 Permissions Bypass via PERMISSIONS Clausesurrealdb · surrealdb-core
- CVE-2026-16254Claircore: claircore: denial of service via out-of-bounds slice in claircore's apk installed-database parserRed Hat Advanced Cluster Security · Red Hat Quay
- CVE-2026-15813Kronosnet: kronosnet: memory corruption and out-of-bounds access via malformed network packet defragmentationRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-2445Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and ModificationWSO2 API Manager · WSO2 API Control Plane +1
- CVE-2026-8825Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST APIElementor Website Builder
- CVE-2026-13432ThumbPress < 6.2.2 - Subscriber+ Plugin DeactivationThumbPress
- CVE-2026-13156MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRFMailerSend
- CVE-2026-12973PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status ModificationPayPlus Payment Gateway
- CVE-2026-12972PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Payment Metadata TamperingPayPlus Payment Gateway
- CVE-2026-12898All-in-One WP Migration and Backup < 7.106 - Unauthenticated Arbitrary-Location Log File Write via Path TraversalAll-in-One WP Migration and Backup
- CVE-2026-12724Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-passwordKirki
- CVE-2026-12723Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component LibraryKirki
- CVE-2026-11868WP Travel < 11.7.1 - Unauthenticated Arbitrary Booking CancellationWP Travel
- CVE-2026-10755All in One SEO < 4.9.9 – Contributor+ Incorrect Authorization via AI IntegrationAll in One SEO
- CVE-2026-10724Reviews Feed < 2.6.5 - Unauthenticated Stored Arbitrary Shortcode Execution via Google ReviewsReviews Feed
- CVE-2026-26080HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled.HAProxy
- CVE-2026-26081HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format.HAProxy
- CVE-2026-26483Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting (XSS) vulnerability in the template management functionality.
- CVE-2026-51025Cross Site Scripting vulnerability in fuint Member Marketing System <=v1.0 allows a remote attacker to execute arbitrary code via the…
- CVE-2026-51026Directory Traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a crafted request.
- CVE-2026-51385An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code via the…