CVEs published July 4, 2026
72 CVEs were published on July 4, 2026: 0 critical, 30 high. 1 is now in CISA KEV.
- Published
- 72
- Critical
- 0
- High
- 30
- Medium
- 38
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 42
Most affected products
- picklescan
- 15
- kirilkirkov Ecommerce-CodeIgniter-Bootstrap
- 6
- code-projects Assessment Management
- 4
- Linux
- 4
- NousResearch hermes-agent
- 4
- HdrHistogram
- 3
- itsourcecode Hospital Management System
- 3
- SourceCodester Simple and Nice Shopping Cart Script
- 3
- code-projects Online Voting System
- 2
- connorskees grass
- 2
High 30
- CVE-2026-12740Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameterCORNELIUS Plack::Middleware::OAuth
- CVE-2026-12746Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameterBIAFRA Dancer2::Plugin::Auth::OAuth::Provider
- CVE-2026-14637kirilkirkov Ecommerce-CodeIgniter-Bootstrap ShoppingCart.php getCartItems deserializationkirilkirkov Ecommerce-CodeIgniter-Bootstrap
- CVE-2026-14535Fickling MLAllowlist analysis pass rendered inoperative by shared mutable state in AnalysisContext.shorten_code()trailofbits fickling · fickling
- CVE-2026-14534Fickling check_safety() bypass via unlisted standard library modules (_posixsubprocess, site, atexit)trailofbits fickling · fickling
- CVE-2026-12196HestiaCP Admin Takeoverhestiacp
- CVE-2026-53362ipv6: account for fraggap on the paged allocation pathLinux
- CVE-2026-53361af_unix: Set gc_in_progress to true in unix_gc().Linux
- CVE-2026-53360KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in useLinux
- CVE-2026-53359KVM: x86: Fix shadow paging use-after-free due to unexpected roleLinux
- CVE-2026-12195myVesta is affected by an authenticated remote code execution vulnerability.myvesta vesta
- CVE-2025-71380n8n - Arbitrary Command Execution via Execute Command Noden8n · n8n-nodes-base
- CVE-2025-71375picklescan - Undetected Remote Code Execution via _operator.methodcallerpicklescan
- CVE-2025-71373picklescan - Remote Code Execution via operator.methodcaller Detection Bypasspicklescan
- CVE-2025-71372Picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.getlincoef GadgetPicklescan
- CVE-2025-71369picklescan - Unsafe Deserialization via torch.utils.data.datapipes.utils.decoder.basichandlerspicklescan
- CVE-2025-71367picklescan - Remote Code Execution via _operator.attrgetter Detection Bypasspicklescan
- CVE-2025-71366picklescan - Arbitrary Code Execution via torch.utils.bottleneck.__main__.run_cprofilepicklescan
- CVE-2025-71364picklescan - Arbitrary Code Execution via Undetected asyncio.unix_events._UnixSubprocessTransport._startpicklescan
- CVE-2025-71362picklescan - Arbitrary Code Execution via Unsafe Deserialization in numpy.f2py.crackfortranpicklescan
- CVE-2025-71360picklescan - Remote Code Execution via Undetected idlelib.calltip.get_entitypicklescan
- CVE-2025-71359picklescan - Unsafe Deserialization via lib2to3.pgen2.grammar.Grammar.loadspicklescan
- CVE-2025-71356picklescan - Arbitrary Code Execution via torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expressionpicklescan
- CVE-2025-71353picklescan - Remote Code Execution via torch._dynamo.guards.GuardBuilder.getpicklescan
- CVE-2025-71347picklescan - Undetected Remote Code Execution via numpy.f2py.crackfortran.param_evalpicklescan
- CVE-2025-71345picklescan - Arbitrary Code Execution via torch.utils.bottleneck.__main__.run_autograd_profpicklescan
- CVE-2025-71343picklescan - Arbitrary Code Execution via lib2to3.pgen2.pgen.ParserGenerator.make_label Detection Bypasspicklescan
- CVE-2025-71342picklescan - Undetected Remote Code Execution via idlelib.run.Executive.runcodepicklescan
- CVE-2026-12252Untrusted JAR Code Execution in Multiple Stanford Interface Classes in nltk/nltknltk/nltk · nltk
- CVE-2026-54424An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege.Unity Parsec
Medium, low and unrated 42
- CVE-2026-14685HdrHistogram AbstractHistogram AbstractHistogram.java recordValueWithCount state issueHdrHistogram
- CVE-2026-14684HdrHistogram AbstractHistogram.java memory allocationHdrHistogram
- CVE-2026-14683HdrHistogram AbstractHistogram.java memory allocationHdrHistogram
- CVE-2026-14660code-projects Online Job Portal login.php sql injectioncode-projects Online Job Portal
- CVE-2026-14659itsourcecode Hospital Management System patientappointment.php sql injectionitsourcecode Hospital Management System
- CVE-2026-14658code-projects Assessment Management marking-scheme.php sql injectioncode-projects Assessment Management
- CVE-2026-14657code-projects Assessment Management Database Query marking-scheme.php sql injectioncode-projects Assessment Management
- CVE-2026-14656code-projects Assessment Management remove-user.php cross site scriptingcode-projects Assessment Management
- CVE-2026-14655code-projects Assessment Management view-users.php cross site scriptingcode-projects Assessment Management
- CVE-2026-14654SourceCodester Simple and Nice Shopping Cart Script girlsproductdeletequery.php sql injectionSourceCodester Simple and Nice Shopping Cart Script
- CVE-2026-14653SourceCodester Simple and Nice Shopping Cart Script mensproductdeletequery.php sql injectionSourceCodester Simple and Nice Shopping Cart Script
- CVE-2024-1248Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege EscalationWSO2 API Manager · WSO2 Identity Server +2
- CVE-2026-14652SourceCodester Simple and Nice Shopping Cart Script Admin Login login.php sql injectionSourceCodester Simple and Nice Shopping Cart Script
- CVE-2026-14651connorskees grass visitor denial of serviceconnorskees grass
- CVE-2026-14650connorskees grass UTF-8 Character raw_to_parse_error denial of serviceconnorskees grass
- CVE-2026-14649code-projects Online Voting System saveVote.php test_input sql injectioncode-projects Online Voting System
- CVE-2026-14648code-projects Online Voting System Login authentication.php test_input sql injectioncode-projects Online Voting System
- CVE-2026-14647onnx onnxruntime old.cc convPoolShapeInference_opset19 out-of-boundsonnx
- CVE-2026-14642SourceCodester Class and Exam Timetabling System edit_class2.php sql injectionSourceCodester Class and Exam Timetabling System
- CVE-2026-14641SourceCodester Class and Exam Timetabling System edit_course.php sql injectionSourceCodester Class and Exam Timetabling System
- CVE-2026-14640CodeAstro Apartment Visitor Management System Login index.php sql injectionCodeAstro Apartment Visitor Management System
- CVE-2026-14639CodeAstro Ecommerce Website my_account.php sql injectionCodeAstro Ecommerce Website
- CVE-2026-14638itsourcecode Hospital Management System patient.php sql injectionitsourcecode Hospital Management System
- CVE-2026-14636kirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Image Manager AddProduct.php do_upload_others_images path traversalkirilkirkov Ecommerce-CodeIgniter-Bootstrap
- CVE-2026-14635kirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Multi-Image Endpoint AddProduct.php path traversalkirilkirkov Ecommerce-CodeIgniter-Bootstrap
- CVE-2026-14634kirilkirkov Ecommerce-CodeIgniter-Bootstrap Subscribed Emails Admin MY_Controller.php checkForPostRequests cross site scriptingkirilkirkov Ecommerce-CodeIgniter-Bootstrap
- CVE-2026-14633kirilkirkov Ecommerce-CodeIgniter-Bootstrap Hidden REST API Endpoint set cross site scriptingkirilkirkov Ecommerce-CodeIgniter-Bootstrap
- CVE-2026-14632kirilkirkov Ecommerce-CodeIgniter-Bootstrap Trusted Backend MY_Controller.php setReferrer redirectkirilkirkov Ecommerce-CodeIgniter-Bootstrap
- CVE-2026-14630ForceInjection AI-fundermentals Memory Recall smart_customer_service.py get_conversation_history weak hashForceInjection AI-fundermentals
- CVE-2026-14629RT-Thread Parameter lwp_syscall.c sys_ioctl divide by zeroRT-Thread
- CVE-2026-14628NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversalNousResearch hermes-agent
- CVE-2025-13475Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data ExposureWSO2 Identity Server · WSO2 API Manager
- CVE-2026-14627NousResearch hermes-agent Discord Platform Integration discord.py DiscordAdapter._is_allowed_user improper authenticationNousResearch hermes-agent
- CVE-2026-14626NousResearch hermes-agent HTTP API run_agent.py AIAgent.run_conversation denial of serviceNousResearch hermes-agent
- CVE-2026-14625NousResearch hermes-agent server.py shell.exec protection mechanismNousResearch hermes-agent
- CVE-2026-14624omec-project amf NGSetupRequest handler.go denial of serviceomec-project amf
- CVE-2026-14623omec-project amf NGAP Message RRCInactiveTransitionReport denial of serviceomec-project amf
- CVE-2026-14622jairiidriss restaurant-website-php-mysql AJAX Endpoint ajax_files missing authenticationjairiidriss restaurant-website-php-mysql
- CVE-2026-14621FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong sessionFederatedAI FATE
- CVE-2026-12194PHPIPAM Authenticated LFIphpipam
- CVE-2026-14619itsourcecode Hospital Management System medicine.php sql injectionitsourcecode Hospital Management System
- CVE-2026-14618Open5GS AMF nnrf-handler.c amf_nnrf_handle_nf_discover denial of serviceOpen5GS