# CVEs published 2026-07-03

180 CVEs were published on July 3, 2026: 24 critical, 82 high. Days are UTC.

- [CVE-2026-14617](https://cve.now/CVE-2026-14617.md): NousResearch hermes-agent Streaming Reasoning Tag Filter stream\_consumer.py GatewayStreamConsumer.\_filter\_and\_accumulate case sensitivity (CVSS 2.3, NousResearch hermes-agent)
- [CVE-2026-58523](https://cve.now/CVE-2026-58523.md): Microsoft Edge for Android Security Feature Bypass Vulnerability (CVSS 6.5, Microsoft Edge)
- [CVE-2026-14611](https://cve.now/CVE-2026-14611.md): DeepMyst Mysti Per-Project Auto-Memory MemoryManager.ts initProjectMemory exposure of resource (CVSS 5.3, DeepMyst Mysti)
- [CVE-2026-14355](https://cve.now/CVE-2026-14355.md): ext/openssl: Memory corruption in openssl\_encrypt with AES-WRAP-PAD (CVSS 5.6, php)
- [CVE-2026-58426](https://cve.now/CVE-2026-58426.md): Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write (CVSS 9.6, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-58424](https://cve.now/CVE-2026-58424.md): Permanent Fork PR Workflow Approval Gate Bypass (CVSS 8.9, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-58423](https://cve.now/CVE-2026-58423.md): LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories (CVSS 7.7, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-58422](https://cve.now/CVE-2026-58422.md): Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts (CVSS 9.8, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-58421](https://cve.now/CVE-2026-58421.md): Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service (CVSS 7.5, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-58419](https://cve.now/CVE-2026-58419.md): Notification API leaks private issue metadata after access revocation (CVSS 7.5, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-58418](https://cve.now/CVE-2026-58418.md): SSRF via HTTP Redirect in Repository Migration (CVSS 6.5, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-14610](https://cve.now/CVE-2026-14610.md): Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile heap-based overflow (CVSS 4.8, Open Asset Import Library Assimp)
- [CVE-2026-12481](https://cve.now/CVE-2026-12481.md): Deserialization of Untrusted Data in keras-team/keras (CVSS 8.8, keras-team/keras · keras)
- [CVE-2026-58291](https://cve.now/CVE-2026-58291.md): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVSS 6.1, Microsoft Edge)
- [CVE-2026-45489](https://cve.now/CVE-2026-45489.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 6.5, Microsoft Edge)
- [CVE-2026-58597](https://cve.now/CVE-2026-58597.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 4.3, Microsoft Edge)
- [CVE-2026-58524](https://cve.now/CVE-2026-58524.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 5.4, Microsoft Edge)
- [CVE-2026-58300](https://cve.now/CVE-2026-58300.md): Microsoft Edge for Android Information Disclosure Vulnerability (CVSS 6.2, Microsoft Edge)
- [CVE-2026-58298](https://cve.now/CVE-2026-58298.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 7.2, Microsoft Edge)
- [CVE-2026-58297](https://cve.now/CVE-2026-58297.md): Microsoft Edge for Android Information Disclosure Vulnerability (CVSS 7.1, Microsoft Edge)
- [CVE-2026-58296](https://cve.now/CVE-2026-58296.md): Microsoft Edge for Android Information Disclosure Vulnerability (CVSS 7.1, Microsoft Edge)
- [CVE-2026-58295](https://cve.now/CVE-2026-58295.md): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2026-58294](https://cve.now/CVE-2026-58294.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Edge)
- [CVE-2026-58293](https://cve.now/CVE-2026-58293.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Edge)
- [CVE-2026-58292](https://cve.now/CVE-2026-58292.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Edge)
- [CVE-2026-58290](https://cve.now/CVE-2026-58290.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Edge)
- [CVE-2026-58289](https://cve.now/CVE-2026-58289.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 9.0, Microsoft Edge)
- [CVE-2026-58288](https://cve.now/CVE-2026-58288.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2026-58286](https://cve.now/CVE-2026-58286.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 8.1, Microsoft Edge)
- [CVE-2026-58285](https://cve.now/CVE-2026-58285.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2026-58284](https://cve.now/CVE-2026-58284.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2026-58278](https://cve.now/CVE-2026-58278.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 5.4, Microsoft Edge)
- [CVE-2026-58276](https://cve.now/CVE-2026-58276.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Edge)
- [CVE-2026-57991](https://cve.now/CVE-2026-57991.md): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVSS 7.4, Microsoft Edge)
- [CVE-2026-57986](https://cve.now/CVE-2026-57986.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Edge)
- [CVE-2026-57981](https://cve.now/CVE-2026-57981.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Edge)
- [CVE-2026-57977](https://cve.now/CVE-2026-57977.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 7.1, Microsoft Edge)
- [CVE-2026-57974](https://cve.now/CVE-2026-57974.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Edge)
- [CVE-2026-45488](https://cve.now/CVE-2026-45488.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 5.4, Microsoft Edge)
- [CVE-2026-58522](https://cve.now/CVE-2026-58522.md): Microsoft Edge for Android Information Disclosure Vulnerability (CVSS 6.8, Microsoft Edge)
- [CVE-2026-58299](https://cve.now/CVE-2026-58299.md): Microsoft Edge for Android Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Edge)
- [CVE-2026-58287](https://cve.now/CVE-2026-58287.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2026-58283](https://cve.now/CVE-2026-58283.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 8.1, Microsoft Edge)
- [CVE-2026-58282](https://cve.now/CVE-2026-58282.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 8.1, Microsoft Edge)
- [CVE-2026-56646](https://cve.now/CVE-2026-56646.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 6.5, Microsoft Edge)
- [CVE-2026-57993](https://cve.now/CVE-2026-57993.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 7.4, Microsoft Edge)
- [CVE-2026-57992](https://cve.now/CVE-2026-57992.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Edge)
- [CVE-2026-57988](https://cve.now/CVE-2026-57988.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 7.1, Microsoft Edge)
- [CVE-2026-57987](https://cve.now/CVE-2026-57987.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 6.5, Microsoft Edge)
- [CVE-2026-57985](https://cve.now/CVE-2026-57985.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 7.6, Microsoft Edge)
- [CVE-2026-57984](https://cve.now/CVE-2026-57984.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Edge)
- [CVE-2026-57983](https://cve.now/CVE-2026-57983.md): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVSS 8.7, Microsoft Edge)
- [CVE-2026-57975](https://cve.now/CVE-2026-57975.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Edge)
- [CVE-2026-56645](https://cve.now/CVE-2026-56645.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Edge)
- [CVE-2026-55945](https://cve.now/CVE-2026-55945.md): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVSS 4.2, Microsoft Edge)
- [CVE-2026-28744](https://cve.now/CVE-2026-28744.md): Gitea Git smart HTTP bypasses repository token scopes for bearer tokens (CVSS 8.1, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-28740](https://cve.now/CVE-2026-28740.md): Gitea LFS object reuse bypasses Code-unit authorization (CVSS 7.1, Gitea Open Source Git Server · code.gitea.io/gitea +1)
- [CVE-2026-28737](https://cve.now/CVE-2026-28737.md): Gitea 3D file viewer allows stored XSS through glTF extensionsRequired (CVSS 8.7, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-28705](https://cve.now/CVE-2026-28705.md): Gitea repository dumps write release assets using unsafe path names (CVSS 5.3, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-28699](https://cve.now/CVE-2026-28699.md): Gitea Basic Auth bypasses OAuth2 access token scopes (CVSS 8.1, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-27783](https://cve.now/CVE-2026-27783.md): Gitea issue-template APIs bypass repository unit authorization (CVSS 4.3, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-27780](https://cve.now/CVE-2026-27780.md): Gitea pre-receive hook can miss branch-protection checks after scanner errors (CVSS 9.8, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-27779](https://cve.now/CVE-2026-27779.md): Gitea forwarded-proto handling allows public URL spoofing (CVSS 7.5, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-27775](https://cve.now/CVE-2026-27775.md): Gitea pre-receive hook permission cache allows full repository write access (CVSS 8.8, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-27771](https://cve.now/CVE-2026-27771.md): Gitea Composer package source links use insufficient permission checks (CVSS 8.2, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-27761](https://cve.now/CVE-2026-27761.md): Gitea repository feeds bypass API token scope enforcement (CVSS 4.3, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-27660](https://cve.now/CVE-2026-27660.md): Gitea draft releases use insufficient permission checks (CVSS 7.5, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-27657](https://cve.now/CVE-2026-27657.md): Gitea email settings allow changing another user's primary email address (CVSS 7.5, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-26307](https://cve.now/CVE-2026-26307.md): Gitea git grep search lacks a timeout (CVSS 7.5, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-26292](https://cve.now/CVE-2026-26292.md): Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions (CVSS 9.8, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-26247](https://cve.now/CVE-2026-26247.md): Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange (CVSS 9.1, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-26232](https://cve.now/CVE-2026-26232.md): Gitea OAuth2 authorization codes lack expiry and reuse enforcement (CVSS 9.1, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-26231](https://cve.now/CVE-2026-26231.md): Gitea maintainer-edit permissions allow unauthorized commits to readable repositories (CVSS 8.5, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-25782](https://cve.now/CVE-2026-25782.md): Gitea tracked-time deletion can target entries from another issue (CVSS 5.3, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-25779](https://cve.now/CVE-2026-25779.md): Gitea redirect handling permits open redirects through backslash paths (CVSS 6.1, Gitea Open Source Git Server · github.com/go-gitea/gitea +1)
- [CVE-2026-25718](https://cve.now/CVE-2026-25718.md): Gitea template repository generation mishandles symlinked paths (CVSS 9.1, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-25714](https://cve.now/CVE-2026-25714.md): Gitea user organization API bypasses public-only token filtering (CVSS 4.3, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-25712](https://cve.now/CVE-2026-25712.md): Gitea organization permission APIs expose private visibility information (CVSS 7.5, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-25038](https://cve.now/CVE-2026-25038.md): Gitea private organization labels are visible to unauthorized users (CVSS 7.5, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-24690](https://cve.now/CVE-2026-24690.md): Gitea pull-request branch updates use insufficient permission checks (CVSS 7.5, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-24451](https://cve.now/CVE-2026-24451.md): Gitea fork synchronization can expose private parent repository data (CVSS 7.5, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-22874](https://cve.now/CVE-2026-22874.md): Gitea webhook and migration allow-list filtering permits SSRF (CVSS 9.6, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-22555](https://cve.now/CVE-2026-22555.md): Gitea organization forks can expose organization secrets without create permission (CVSS 8.1, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-22547](https://cve.now/CVE-2026-22547.md): Gitea repository creation accepts invalid field values (CVSS 9.1, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-20909](https://cve.now/CVE-2026-20909.md): Gitea tracked-time list endpoint has insufficient permission checks (CVSS 5.3, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-20896](https://cve.now/CVE-2026-20896.md): Gitea Docker image trusts spoofable reverse-proxy headers by default (CVSS 9.8, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-20779](https://cve.now/CVE-2026-20779.md): Gitea TOTP single-use enforcement defect allows OTP replay (CVSS 7.1, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-20706](https://cve.now/CVE-2026-20706.md): Gitea repository archive downloads bypass token scope checks (CVSS 9.1, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2026-14609](https://cve.now/CVE-2026-14609.md): SourceCodester CET Automated Grading System with AI Predictive Analytics session fixiation (CVSS 6.3, SourceCodester CET Automated Grading System with AI Predict…)
- [CVE-2026-14608](https://cve.now/CVE-2026-14608.md): SourceCodester CET Automated Grading System with AI Predictive Analytics POST index.php view\_student authorization (CVSS 5.3, SourceCodester CET Automated Grading System with AI Predict…)
- [CVE-2026-14607](https://cve.now/CVE-2026-14607.md): RT-Thread lwp\_syscall.c sys\_getaddrinfo memory corruption (CVSS 6.8, RT-Thread)
- [CVE-2026-14606](https://cve.now/CVE-2026-14606.md): RT-Thread SWM341 CAN SWM341.h CAN\_Receive stack-based overflow (CVSS 8.5, RT-Thread)
- [CVE-2026-14605](https://cve.now/CVE-2026-14605.md): RT-Thread ls1c CAN ls1c\_can.h recvmsg stack-based overflow (CVSS 8.5, RT-Thread)
- [CVE-2026-14604](https://cve.now/CVE-2026-14604.md): Open Asset Import Library Assimp PLY Model PlyLoader.cpp ExportToBlob double free (CVSS 5.3, Open Asset Import Library Assimp)
- [CVE-2026-58379](https://cve.now/CVE-2026-58379.md): Gimp: gimp: heap buffer overflow in read\_channel\_data() (CVSS 7.3, Red Hat Enterprise Linux)
- [CVE-2026-14631](https://cve.now/CVE-2026-14631.md): webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header (CVSS 5.3, webpack-dev-server)
- [CVE-2026-14620](https://cve.now/CVE-2026-14620.md): webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints (CVSS 4.7, webpack-dev-server)
- [CVE-2026-14615](https://cve.now/CVE-2026-14615.md): Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter (CVSS 4.3, Red Hat build of Keycloak)
- [CVE-2026-14614](https://cve.now/CVE-2026-14614.md): Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource (CVSS 5.4, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-14613](https://cve.now/CVE-2026-14613.md): Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission (CVSS 4.3, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-14612](https://cve.now/CVE-2026-14612.md): Freeipa: ipa: idm: freeipa: off-by-one buffer overflows in ipa-otpd oauth2.c during oauth2 device authorization (CVSS 4.2, Red Hat Enterprise Linux)
- [CVE-2026-49813](https://cve.now/CVE-2026-49813.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1 (CVSS 6.7, Dell PowerProtect Data Domain)
- [CVE-2026-14460](https://cve.now/CVE-2026-14460.md): Missing Authorization in TUBITAK BILGEM's pardus-software (CVSS 8.8, TUBITAK BILGEM Software Technologies Research Institute par…)
- [CVE-2026-49814](https://cve.now/CVE-2026-49814.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1 (CVSS 7.2, Dell PowerProtect Data Domain)
- [CVE-2026-14459](https://cve.now/CVE-2026-14459.md): Argument Injection in TUBITAK BILGEM's pardus-software (CVSS 8.8, TUBITAK BILGEM Software Technologies Research Institute par…)
- [CVE-2026-49815](https://cve.now/CVE-2026-49815.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1 (CVSS 7.2, Dell PowerProtect Data Domain)
- [CVE-2026-53478](https://cve.now/CVE-2026-53478.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1 (CVSS 7.2, Dell PowerProtect Data Domain)
- [CVE-2026-46463](https://cve.now/CVE-2026-46463.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1 (CVSS 6.5, Dell PowerProtect Data Domain)
- [CVE-2026-46464](https://cve.now/CVE-2026-46464.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1 (CVSS 4.9, Dell PowerProtect Data Domain)
- [CVE-2026-46465](https://cve.now/CVE-2026-46465.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1 (CVSS 5.5, Dell PowerProtect Data Domain)
- [CVE-2026-46466](https://cve.now/CVE-2026-46466.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1 (CVSS 2.7, Dell PowerProtect Data Domain)
- [CVE-2026-46467](https://cve.now/CVE-2026-46467.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1 (CVSS 5.8, Dell PowerProtect Data Domain)
- [CVE-2026-46468](https://cve.now/CVE-2026-46468.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1 (CVSS 4.4, Dell PowerProtect Data Domain)
- [CVE-2026-56015](https://cve.now/CVE-2026-56015.md): Net::IP::LPM versions before 1.11 for Perl allow a heap out-of-bounds read via an unbounded prefix length (CVSS 9.1, Net-IP-LPM)
- [CVE-2026-46730](https://cve.now/CVE-2026-46730.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1 (CVSS 4.2, Dell PowerProtect Data Domain)
- [CVE-2026-59234](https://cve.now/CVE-2026-59234.md): Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletion (CVSS 6.9, Roskus Prospero Flow CRM)
- [CVE-2026-56085](https://cve.now/CVE-2026-56085.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1 (CVSS 3.3, Dell PowerProtect Data Domain)
- [CVE-2026-26355](https://cve.now/CVE-2026-26355.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1 (CVSS 6.5, Dell PowerProtect Data Domain)
- [CVE-2026-54483](https://cve.now/CVE-2026-54483.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1 (CVSS 6.7, Dell PowerProtect Data Domain)
- [CVE-2026-41123](https://cve.now/CVE-2026-41123.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1 (CVSS 4.3, Dell PowerProtect Data Domain)
- [CVE-2026-41124](https://cve.now/CVE-2026-41124.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1 (CVSS 2.3, Dell PowerProtect Data Domain)
- [CVE-2026-44268](https://cve.now/CVE-2026-44268.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1 (CVSS 4.4, Dell PowerProtect Data Domain)
- [CVE-2026-44269](https://cve.now/CVE-2026-44269.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1 (CVSS 4.4, Dell PowerProtect Data Domain)
- [CVE-2026-10055](https://cve.now/CVE-2026-10055.md): In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connecte (CVSS 8.5, Eclipse Foundation Eclipse Theia)
- [CVE-2026-13341](https://cve.now/CVE-2026-13341.md): Prompt Injection and Credential Exposure via Untrusted Analytics Data in Kong Konnect MCP (CVSS 7.4, KongHQ mcp-konnect)
- [CVE-2026-10054](https://cve.now/CVE-2026-10054.md): In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell (CVSS 8.8, Eclipse Foundation Eclipse Theia)
- [CVE-2026-5137](https://cve.now/CVE-2026-5137.md): RTMKit \<= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter (CVSS 4.3, rometheme RTMKit)
- [CVE-2026-4322](https://cve.now/CVE-2026-4322.md): XSS in Raera's Destekz (CVSS 6.1, Raera - Ankara Web Design and Digital Advertising Agency De…)
- [CVE-2026-4321](https://cve.now/CVE-2026-4321.md): SQLi in Raera's Destekz (CVSS 9.8, Raera - Ankara Web Design and Digital Advertising Agency De…)
- [CVE-2026-35159](https://cve.now/CVE-2026-35159.md): Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability. (CVSS 5.3, Dell Inspiron 15 · Dell G15 +116)
- [CVE-2026-11398](https://cve.now/CVE-2026-11398.md): LatePoint \<= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process\_step\_customer() Booking Form Customer Step (CVSS 5.3, LatePoint – Calendar Booking Plugin for Appointments and Ev…)
- [CVE-2026-4804](https://cve.now/CVE-2026-4804.md): Zakra \<= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API (CVSS 6.4, themegrill Zakra)
- [CVE-2026-9756](https://cve.now/CVE-2026-9756.md): GenerateBlocks \<= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute (CVSS 6.4, edge22 GenerateBlocks)
- [CVE-2026-11778](https://cve.now/CVE-2026-11778.md): CURCY \<= 2.2.14 - Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter (CVSS 5.4, villatheme CURCY – Multi Currency for WooCommerce – Smoothl…)
- [CVE-2026-11900](https://cve.now/CVE-2026-11900.md): Ad Inserter \<= 2.8.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode Attribute (CVSS 4.3, spacetime Ad Inserter – Ad Manager & AdSense Ads)
- [CVE-2026-47896](https://cve.now/CVE-2026-47896.md): Apache Lucene.Net: Unauthenticated arbitrary file read on the Lucene.Net.Replicator replication server (CVSS 8.9, Apache Software Foundation Apache Lucene.Net)
- [CVE-2026-47897](https://cve.now/CVE-2026-47897.md): Apache Lucene.Net: Arbitrary file write from malicious server to Lucene.Net.Replicator client (CVSS 8.9, Apache Software Foundation Apache Lucene.Net)
- [CVE-2026-47898](https://cve.now/CVE-2026-47898.md): Apache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParser (CVSS 4.0, Apache Software Foundation Apache Lucene.Net)
- [CVE-2026-8804](https://cve.now/CVE-2026-8804.md): Cleartext Storage of Sensitive Information for Puppet Resource API (CVSS 6.7, Perforce Puppet Core · Perforce Puppet Enterprise)
- [CVE-2026-14544](https://cve.now/CVE-2026-14544.md): Hplip: incomplete fix for cve-2026-8631 (CVSS 9.8, HPLIP · Red Hat Enterprise Linux)
- [CVE-2026-9148](https://cve.now/CVE-2026-9148.md): Comments \<= 7.6.56 - Unauthenticated Stored Cross-Site Scripting via 'Website' Field (CVSS 7.2, advancedcoding Comments – wpDiscuz)
- [CVE-2026-9230](https://cve.now/CVE-2026-9230.md): Quiz and Survey Master (QSM) \<= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structure (CVSS 4.3, expresstech Quiz and Survey Master (QSM) – Easy Quiz and Su…)
- [CVE-2026-8351](https://cve.now/CVE-2026-8351.md): RTMKit \<= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameter (CVSS 6.4, rometheme RTMKit)
- [CVE-2026-9547](https://cve.now/CVE-2026-9547.md): SSH improper host validation (CVSS 7.4, curl)
- [CVE-2026-9546](https://cve.now/CVE-2026-9546.md): sending old referer (CVSS 7.5, curl)
- [CVE-2026-9545](https://cve.now/CVE-2026-9545.md): exposing HTTP/3 early data (CVSS 7.5, curl)
- [CVE-2026-9080](https://cve.now/CVE-2026-9080.md): UAF after pause in socket callback (CVSS 7.3, curl)
- [CVE-2026-9079](https://cve.now/CVE-2026-9079.md): stale proxy password leak (CVSS 9.8, curl)
- [CVE-2026-8932](https://cve.now/CVE-2026-8932.md): incomplete mTLS config matching in conn reuse (CVSS 7.5, curl)
- [CVE-2026-8927](https://cve.now/CVE-2026-8927.md): env-set cross-proxy Digest auth state leak (CVSS 9.1, curl)
- [CVE-2026-8926](https://cve.now/CVE-2026-8926.md): password leak with netrc and user in URL (CVSS 9.1, curl)
- [CVE-2026-8925](https://cve.now/CVE-2026-8925.md): SASL double-free (CVSS 9.8, curl)
- [CVE-2026-8924](https://cve.now/CVE-2026-8924.md): trailing dot domain super cookie (CVSS 9.1, curl)
- [CVE-2026-8458](https://cve.now/CVE-2026-8458.md): wrong reuse for different services (CVSS 6.5, curl)
- [CVE-2026-8286](https://cve.now/CVE-2026-8286.md): wrong STARTTLS connection reuse (CVSS 8.1, curl)
- [CVE-2026-12064](https://cve.now/CVE-2026-12064.md): proto-default skips SSH verification (CVSS 7.5, curl)
- [CVE-2026-11856](https://cve.now/CVE-2026-11856.md): cross-origin Digest auth state leak (CVSS 9.8, curl)
- [CVE-2026-11586](https://cve.now/CVE-2026-11586.md): WS Auto-PONG memory exhaustion (CVSS 7.5, curl)
- [CVE-2026-11564](https://cve.now/CVE-2026-11564.md): Native CA trust persist (CVSS 9.1, curl)
- [CVE-2026-11352](https://cve.now/CVE-2026-11352.md): QUIC zero-length UDP datagrams busy-loop (CVSS 7.5, curl)
- [CVE-2026-10536](https://cve.now/CVE-2026-10536.md): HTTP/2 stream-dependency tree UAF (CVSS 9.8, curl)
- [CVE-2026-4967](https://cve.now/CVE-2026-4967.md): In IMS, there is a possible out of bounds read due to a missing bounds check. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2026-9180](https://cve.now/CVE-2026-9180.md): MotoPress Appointment Booking \<= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment\_details.booking\_id' Parameter (CVSS 5.3, jetmonsters MotoPress Appointment Booking)
- [CVE-2026-8892](https://cve.now/CVE-2026-8892.md): CM Business Directory \<= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Business Address Meta Fields (CVSS 6.4, creativemindssolutions CM Business Directory – Optimise and…)
- [CVE-2026-9626](https://cve.now/CVE-2026-9626.md): JSON API User \<= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter (CVSS 6.4, parorrey JSON API User)
- [CVE-2026-11397](https://cve.now/CVE-2026-11397.md): WP Import Export Lite \<= 3.9.30 - Authenticated (Administrator+) Server-Side Request Forgery via 'file\_url' Parameter (CVSS 5.5, vjinfotech WP Import Export Lite)
- [CVE-2026-9725](https://cve.now/CVE-2026-9725.md): Printcart Web to Print Product Designer for WooCommerce \<= 2.5.2 - Unauthenticated Arbitrary File Deletion (CVSS 9.1, Printcart Web to Print Product Designer for WooCommerce)
- [CVE-2026-13040](https://cve.now/CVE-2026-13040.md): NEX-Forms \<= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real\_val\_\_' Parameter (CVSS 7.2, webaways NEX-Forms – Ultimate Forms Plugin for WordPress)
- [CVE-2026-8489](https://cve.now/CVE-2026-8489.md): Ultimate Member \<= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field (CVSS 6.4, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2026-14352](https://cve.now/CVE-2026-14352.md): AR for WooCommerce \<= 8.40 - Unauthenticated Path Traversal to Arbitrary File Read via 'file' Parameter (CVSS 7.5, webandprint AR for WooCommerce)
- [CVE-2026-12557](https://cve.now/CVE-2026-12557.md): Ninja Forms - File Uploads \<= 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST Endpoints (CVSS 5.3, SaturdayDrive Ninja Forms - File Uploads)
- [CVE-2022-4989](https://cve.now/CVE-2022-4989.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\* Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to acce (CVSS 8.5, ASUS AI Suite)
- [CVE-2022-4990](https://cve.now/CVE-2022-4990.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\* Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to bypa (CVSS 7.3, ASUS AI Suite)
- [CVE-2026-8921](https://cve.now/CVE-2026-8921.md): External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privi (CVSS 8.5, ASUS Business Manager)
- [CVE-2026-12960](https://cve.now/CVE-2026-12960.md): An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to (CVSS 6.0, ASUS Router app)
- [CVE-2026-14327](https://cve.now/CVE-2026-14327.md): AR for WordPress \<= 8.40 - Unauthenticated Arbitrary File Read via 'file' Parameter (CVSS 7.5, webandprint AR for WordPress)
- [CVE-2026-12731](https://cve.now/CVE-2026-12731.md): weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot \<= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributes (CVSS 6.4, wedevs weDocs: AI Powered Knowledge Base, Docs, Documentati…)
- [CVE-2026-12920](https://cve.now/CVE-2026-12920.md): Cookie Banner for GDPR / CCPA \<= 4.3.5 - Authenticated (Administrator+) SQL Injection via 's' Parameter (CVSS 4.9, wplegalpages Cookie Banner for GDPR / CCPA – WPLP Cookie Co…)
- [CVE-2026-12729](https://cve.now/CVE-2026-12729.md): weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot \<= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Data Migration via wedocs\_migrate\_betterdocs\_to\_wedocs AJAX Action (CVSS 4.3, wedevs weDocs: AI Powered Knowledge Base, Docs, Documentati…)
- [CVE-2026-12734](https://cve.now/CVE-2026-12734.md): weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot \<= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'connectorWidth' Block Attribute (CVSS 6.4, wedevs weDocs: AI Powered Knowledge Base, Docs, Documentati…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-07-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.