CVEs published July 3, 2026
180 CVEs were published on July 3, 2026: 24 critical, 82 high.
- Published
- 180
- Critical
- 24
- High
- 82
- Medium
- 70
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 119
Most affected products
- Microsoft Edge
- 43
- Gitea Open Source Git Server · code.gitea.io/gitea
- 38
- curl
- 18
- Dell PowerProtect Data Domain
- 18
- Apache Software Foundation Apache Lucene.Net
- 3
- RT-Thread
- 3
- wedevs weDocs: AI Powered Knowledge Base, Docs, Documentati…
- 3
- ASUS AI Suite
- 2
- Eclipse Foundation Eclipse Theia
- 2
- Open Asset Import Library Assimp
- 2
Critical 24
- CVE-2026-58426Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state writeGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-58422Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accountsGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-58289Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-27780Gitea pre-receive hook can miss branch-protection checks after scanner errorsGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-26292Gitea LFS mirror synchronization bypasses migration HTTP transport restrictionsGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-26247Gitea OAuth2 PKCE S256 challenges are not enforced during token exchangeGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-26232Gitea OAuth2 authorization codes lack expiry and reuse enforcementGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-25718Gitea template repository generation mishandles symlinked pathsGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-22874Gitea webhook and migration allow-list filtering permits SSRFGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-22547Gitea repository creation accepts invalid field valuesGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-20896Gitea Docker image trusts spoofable reverse-proxy headers by defaultGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-20706Gitea repository archive downloads bypass token scope checksGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-56015Net::IP::LPM versions before 1.11 for Perl allow a heap out-of-bounds read via an unbounded prefix lengthNet-IP-LPM
- CVE-2026-4321SQLi in Raera's DestekzRaera - Ankara Web Design and Digital Advertising Agency De…
- CVE-2026-14544Hplip: incomplete fix for cve-2026-8631HPLIP · Red Hat Enterprise Linux
- CVE-2026-9079stale proxy password leakcurl
- CVE-2026-8927env-set cross-proxy Digest auth state leakcurl
- CVE-2026-8926password leak with netrc and user in URLcurl
- CVE-2026-8925SASL double-freecurl
- CVE-2026-8924trailing dot domain super cookiecurl
- CVE-2026-11856cross-origin Digest auth state leakcurl
- CVE-2026-11564Native CA trust persistcurl
- CVE-2026-10536HTTP/2 stream-dependency tree UAFcurl
- CVE-2026-9725Printcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File DeletionPrintcart Web to Print Product Designer for WooCommerce
High 82
- CVE-2026-58424Permanent Fork PR Workflow Approval Gate BypassGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-58423LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositoriesGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-58421Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of serviceGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-58419Notification API leaks private issue metadata after access revocationGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-12481Deserialization of Untrusted Data in keras-team/keraskeras-team/keras · keras
- CVE-2026-58298Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-58297Microsoft Edge for Android Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2026-58296Microsoft Edge for Android Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2026-58295Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft Edge
- CVE-2026-58294Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-58293Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-58292Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-58290Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-58288Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-58286Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-58285Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-58284Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-58276Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-57991Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2026-57986Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-57981Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-57977Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-57974Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-58299Microsoft Edge for Android Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-58287Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-58283Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-58282Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-57993Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-57992Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-57988Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-57985Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-57984Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-57983Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft Edge
- CVE-2026-57975Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-56645Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-28744Gitea Git smart HTTP bypasses repository token scopes for bearer tokensGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-28740Gitea LFS object reuse bypasses Code-unit authorizationGitea Open Source Git Server · code.gitea.io/gitea +1
- CVE-2026-28737Gitea 3D file viewer allows stored XSS through glTF extensionsRequiredGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-28699Gitea Basic Auth bypasses OAuth2 access token scopesGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-27779Gitea forwarded-proto handling allows public URL spoofingGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-27775Gitea pre-receive hook permission cache allows full repository write accessGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-27771Gitea Composer package source links use insufficient permission checksGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-27660Gitea draft releases use insufficient permission checksGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-27657Gitea email settings allow changing another user's primary email addressGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-26307Gitea git grep search lacks a timeoutGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-26231Gitea maintainer-edit permissions allow unauthorized commits to readable repositoriesGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-25712Gitea organization permission APIs expose private visibility informationGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-25038Gitea private organization labels are visible to unauthorized usersGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-24690Gitea pull-request branch updates use insufficient permission checksGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-24451Gitea fork synchronization can expose private parent repository dataGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-22555Gitea organization forks can expose organization secrets without create permissionGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-20779Gitea TOTP single-use enforcement defect allows OTP replayGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-14606RT-Thread SWM341 CAN SWM341.h CAN_Receive stack-based overflowRT-Thread
- CVE-2026-14605RT-Thread ls1c CAN ls1c_can.h recvmsg stack-based overflowRT-Thread
- CVE-2026-58379Gimp: gimp: heap buffer overflow in read_channel_data()Red Hat Enterprise Linux
- CVE-2026-14460Missing Authorization in TUBITAK BILGEM's pardus-softwareTUBITAK BILGEM Software Technologies Research Institute par…
- CVE-2026-49814Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1Dell PowerProtect Data Domain
- CVE-2026-14459Argument Injection in TUBITAK BILGEM's pardus-softwareTUBITAK BILGEM Software Technologies Research Institute par…
- CVE-2026-49815Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1Dell PowerProtect Data Domain
- CVE-2026-53478Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1Dell PowerProtect Data Domain
- CVE-2026-10055In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connecteEclipse Foundation Eclipse Theia
- CVE-2026-13341Prompt Injection and Credential Exposure via Untrusted Analytics Data in Kong Konnect MCPKongHQ mcp-konnect
- CVE-2026-10054In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shellEclipse Foundation Eclipse Theia
- CVE-2026-47896Apache Lucene.Net: Unauthenticated arbitrary file read on the Lucene.Net.Replicator replication serverApache Software Foundation Apache Lucene.Net
- CVE-2026-47897Apache Lucene.Net: Arbitrary file write from malicious server to Lucene.Net.Replicator clientApache Software Foundation Apache Lucene.Net
- CVE-2026-9148Comments <= 7.6.56 - Unauthenticated Stored Cross-Site Scripting via 'Website' Fieldadvancedcoding Comments – wpDiscuz
- CVE-2026-9547SSH improper host validationcurl
- CVE-2026-9546sending old referercurl
- CVE-2026-9545exposing HTTP/3 early datacurl
- CVE-2026-9080UAF after pause in socket callbackcurl
- CVE-2026-8932incomplete mTLS config matching in conn reusecurl
- CVE-2026-8286wrong STARTTLS connection reusecurl
- CVE-2026-12064proto-default skips SSH verificationcurl
- CVE-2026-11586WS Auto-PONG memory exhaustioncurl
- CVE-2026-11352QUIC zero-length UDP datagrams busy-loopcurl
- CVE-2026-4967In IMS, there is a possible out of bounds read due to a missing bounds check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2026-13040NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameterwebaways NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2026-14352AR for WooCommerce <= 8.40 - Unauthenticated Path Traversal to Arbitrary File Read via 'file' Parameterwebandprint AR for WooCommerce
- CVE-2022-4989** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to acceASUS AI Suite
- CVE-2022-4990** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to bypaASUS AI Suite
- CVE-2026-8921External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM priviASUS Business Manager
- CVE-2026-14327AR for WordPress <= 8.40 - Unauthenticated Arbitrary File Read via 'file' Parameterwebandprint AR for WordPress
Medium, low and unrated 74
- CVE-2026-14617NousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivityNousResearch hermes-agent
- CVE-2026-58523Microsoft Edge for Android Security Feature Bypass VulnerabilityMicrosoft Edge
- CVE-2026-14611DeepMyst Mysti Per-Project Auto-Memory MemoryManager.ts initProjectMemory exposure of resourceDeepMyst Mysti
- CVE-2026-14355ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PADphp
- CVE-2026-58418SSRF via HTTP Redirect in Repository MigrationGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-14610Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile heap-based overflowOpen Asset Import Library Assimp
- CVE-2026-58291Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2026-45489Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-58597Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-58524Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-58300Microsoft Edge for Android Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2026-58278Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-45488Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-58522Microsoft Edge for Android Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2026-56646Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-57987Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-55945Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2026-28705Gitea repository dumps write release assets using unsafe path namesGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-27783Gitea issue-template APIs bypass repository unit authorizationGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-27761Gitea repository feeds bypass API token scope enforcementGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-25782Gitea tracked-time deletion can target entries from another issueGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-25779Gitea redirect handling permits open redirects through backslash pathsGitea Open Source Git Server · github.com/go-gitea/gitea +1
- CVE-2026-25714Gitea user organization API bypasses public-only token filteringGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-20909Gitea tracked-time list endpoint has insufficient permission checksGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-14609SourceCodester CET Automated Grading System with AI Predictive Analytics session fixiationSourceCodester CET Automated Grading System with AI Predict…
- CVE-2026-14608SourceCodester CET Automated Grading System with AI Predictive Analytics POST index.php view_student authorizationSourceCodester CET Automated Grading System with AI Predict…
- CVE-2026-14607RT-Thread lwp_syscall.c sys_getaddrinfo memory corruptionRT-Thread
- CVE-2026-14604Open Asset Import Library Assimp PLY Model PlyLoader.cpp ExportToBlob double freeOpen Asset Import Library Assimp
- CVE-2026-14631webpack-dev-server vulnerable to denial of service via a malformed Host or Origin headerwebpack-dev-server
- CVE-2026-14620webpack-dev-server vulnerable to cross-site request forgery via internal developer endpointswebpack-dev-server
- CVE-2026-14615Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filterRed Hat build of Keycloak
- CVE-2026-14614Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresourceRed Hat build of Keycloak · Red Hat Data Grid +2
- CVE-2026-14613Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permissionRed Hat build of Keycloak · Red Hat Data Grid +2
- CVE-2026-14612Freeipa: ipa: idm: freeipa: off-by-one buffer overflows in ipa-otpd oauth2.c during oauth2 device authorizationRed Hat Enterprise Linux
- CVE-2026-49813Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1Dell PowerProtect Data Domain
- CVE-2026-46463Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1Dell PowerProtect Data Domain
- CVE-2026-46464Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1Dell PowerProtect Data Domain
- CVE-2026-46465Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1Dell PowerProtect Data Domain
- CVE-2026-46466Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1Dell PowerProtect Data Domain
- CVE-2026-46467Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1Dell PowerProtect Data Domain
- CVE-2026-46468Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1Dell PowerProtect Data Domain
- CVE-2026-46730Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1Dell PowerProtect Data Domain
- CVE-2026-59234Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletionRoskus Prospero Flow CRM
- CVE-2026-56085Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1Dell PowerProtect Data Domain
- CVE-2026-26355Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1Dell PowerProtect Data Domain
- CVE-2026-54483Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1Dell PowerProtect Data Domain
- CVE-2026-41123Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1Dell PowerProtect Data Domain
- CVE-2026-41124Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1Dell PowerProtect Data Domain
- CVE-2026-44268Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1Dell PowerProtect Data Domain
- CVE-2026-44269Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1Dell PowerProtect Data Domain
- CVE-2026-5137RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameterrometheme RTMKit
- CVE-2026-4322XSS in Raera's DestekzRaera - Ankara Web Design and Digital Advertising Agency De…
- CVE-2026-35159Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability.Dell Inspiron 15 · Dell G15 +116
- CVE-2026-11398LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer StepLatePoint – Calendar Booking Plugin for Appointments and Ev…
- CVE-2026-4804Zakra <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST APIthemegrill Zakra
- CVE-2026-9756GenerateBlocks <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attributeedge22 GenerateBlocks
- CVE-2026-11778CURCY <= 2.2.14 - Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parametervillatheme CURCY – Multi Currency for WooCommerce – Smoothl…
- CVE-2026-11900Ad Inserter <= 2.8.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode Attributespacetime Ad Inserter – Ad Manager & AdSense Ads
- CVE-2026-47898Apache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParserApache Software Foundation Apache Lucene.Net
- CVE-2026-8804Cleartext Storage of Sensitive Information for Puppet Resource APIPerforce Puppet Core · Perforce Puppet Enterprise
- CVE-2026-9230Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structureexpresstech Quiz and Survey Master (QSM) – Easy Quiz and Su…
- CVE-2026-8351RTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameterrometheme RTMKit
- CVE-2026-8458wrong reuse for different servicescurl
- CVE-2026-9180MotoPress Appointment Booking <= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameterjetmonsters MotoPress Appointment Booking
- CVE-2026-8892CM Business Directory <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Business Address Meta Fieldscreativemindssolutions CM Business Directory – Optimise and…
- CVE-2026-9626JSON API User <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameterparorrey JSON API User
- CVE-2026-11397WP Import Export Lite <= 3.9.30 - Authenticated (Administrator+) Server-Side Request Forgery via 'file_url' Parametervjinfotech WP Import Export Lite
- CVE-2026-8489Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Fieldultimatemember Ultimate Member – User Profile, Registration…
- CVE-2026-12557Ninja Forms - File Uploads <= 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST EndpointsSaturdayDrive Ninja Forms - File Uploads
- CVE-2026-12960An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device toASUS Router app
- CVE-2026-12731weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributeswedevs weDocs: AI Powered Knowledge Base, Docs, Documentati…
- CVE-2026-12920Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Administrator+) SQL Injection via 's' Parameterwplegalpages Cookie Banner for GDPR / CCPA – WPLP Cookie Co…
- CVE-2026-12729weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Data Migration via wedocs_migrate_betterdocs_to_wedocs AJAX Actionwedevs weDocs: AI Powered Knowledge Base, Docs, Documentati…
- CVE-2026-12734weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'connectorWidth' Block Attributewedevs weDocs: AI Powered Knowledge Base, Docs, Documentati…