# CVEs published 2026-07-04

72 CVEs were published on July 4, 2026: 0 critical, 30 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-14685](https://cve.now/CVE-2026-14685.md): HdrHistogram AbstractHistogram AbstractHistogram.java recordValueWithCount state issue (CVSS 4.8, HdrHistogram)
- [CVE-2026-14684](https://cve.now/CVE-2026-14684.md): HdrHistogram AbstractHistogram.java memory allocation (CVSS 4.8, HdrHistogram)
- [CVE-2026-14683](https://cve.now/CVE-2026-14683.md): HdrHistogram AbstractHistogram.java memory allocation (CVSS 4.8, HdrHistogram)
- [CVE-2026-14660](https://cve.now/CVE-2026-14660.md): code-projects Online Job Portal login.php sql injection (CVSS 6.9, code-projects Online Job Portal)
- [CVE-2026-14659](https://cve.now/CVE-2026-14659.md): itsourcecode Hospital Management System patientappointment.php sql injection (CVSS 5.3, itsourcecode Hospital Management System)
- [CVE-2026-14658](https://cve.now/CVE-2026-14658.md): code-projects Assessment Management marking-scheme.php sql injection (CVSS 5.3, code-projects Assessment Management)
- [CVE-2026-14657](https://cve.now/CVE-2026-14657.md): code-projects Assessment Management Database Query marking-scheme.php sql injection (CVSS 5.3, code-projects Assessment Management)
- [CVE-2026-14656](https://cve.now/CVE-2026-14656.md): code-projects Assessment Management remove-user.php cross site scripting (CVSS 5.3, code-projects Assessment Management)
- [CVE-2026-14655](https://cve.now/CVE-2026-14655.md): code-projects Assessment Management view-users.php cross site scripting (CVSS 4.8, code-projects Assessment Management)
- [CVE-2026-14654](https://cve.now/CVE-2026-14654.md): SourceCodester Simple and Nice Shopping Cart Script girlsproductdeletequery.php sql injection (CVSS 6.9, SourceCodester Simple and Nice Shopping Cart Script)
- [CVE-2026-14653](https://cve.now/CVE-2026-14653.md): SourceCodester Simple and Nice Shopping Cart Script mensproductdeletequery.php sql injection (CVSS 6.9, SourceCodester Simple and Nice Shopping Cart Script)
- [CVE-2024-1248](https://cve.now/CVE-2024-1248.md): Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation (CVSS 4.8, WSO2 API Manager · WSO2 Identity Server +2)
- [CVE-2026-14652](https://cve.now/CVE-2026-14652.md): SourceCodester Simple and Nice Shopping Cart Script Admin Login login.php sql injection (CVSS 6.9, SourceCodester Simple and Nice Shopping Cart Script)
- [CVE-2026-14651](https://cve.now/CVE-2026-14651.md): connorskees grass visitor denial of service (CVSS 4.8, connorskees grass)
- [CVE-2026-14650](https://cve.now/CVE-2026-14650.md): connorskees grass UTF-8 Character raw\_to\_parse\_error denial of service (CVSS 4.8, connorskees grass)
- [CVE-2026-14649](https://cve.now/CVE-2026-14649.md): code-projects Online Voting System saveVote.php test\_input sql injection (CVSS 6.9, code-projects Online Voting System)
- [CVE-2026-14648](https://cve.now/CVE-2026-14648.md): code-projects Online Voting System Login authentication.php test\_input sql injection (CVSS 6.9, code-projects Online Voting System)
- [CVE-2026-14647](https://cve.now/CVE-2026-14647.md): onnx onnxruntime old.cc convPoolShapeInference\_opset19 out-of-bounds (CVSS 5.3, onnx)
- [CVE-2026-14642](https://cve.now/CVE-2026-14642.md): SourceCodester Class and Exam Timetabling System edit\_class2.php sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-14641](https://cve.now/CVE-2026-14641.md): SourceCodester Class and Exam Timetabling System edit\_course.php sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-14640](https://cve.now/CVE-2026-14640.md): CodeAstro Apartment Visitor Management System Login index.php sql injection (CVSS 6.9, CodeAstro Apartment Visitor Management System)
- [CVE-2026-14639](https://cve.now/CVE-2026-14639.md): CodeAstro Ecommerce Website my\_account.php sql injection (CVSS 5.3, CodeAstro Ecommerce Website)
- [CVE-2026-12740](https://cve.now/CVE-2026-12740.md): Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter (CVSS 8.1, CORNELIUS Plack::Middleware::OAuth)
- [CVE-2026-12746](https://cve.now/CVE-2026-12746.md): Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter (CVSS 8.1, BIAFRA Dancer2::Plugin::Auth::OAuth::Provider)
- [CVE-2026-14638](https://cve.now/CVE-2026-14638.md): itsourcecode Hospital Management System patient.php sql injection (CVSS 5.3, itsourcecode Hospital Management System)
- [CVE-2026-14637](https://cve.now/CVE-2026-14637.md): kirilkirkov Ecommerce-CodeIgniter-Bootstrap ShoppingCart.php getCartItems deserialization (CVSS 8.8, kirilkirkov Ecommerce-CodeIgniter-Bootstrap)
- [CVE-2026-14636](https://cve.now/CVE-2026-14636.md): kirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Image Manager AddProduct.php do\_upload\_others\_images path traversal (CVSS 5.3, kirilkirkov Ecommerce-CodeIgniter-Bootstrap)
- [CVE-2026-14635](https://cve.now/CVE-2026-14635.md): kirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Multi-Image Endpoint AddProduct.php path traversal (CVSS 6.9, kirilkirkov Ecommerce-CodeIgniter-Bootstrap)
- [CVE-2026-14634](https://cve.now/CVE-2026-14634.md): kirilkirkov Ecommerce-CodeIgniter-Bootstrap Subscribed Emails Admin MY\_Controller.php checkForPostRequests cross site scripting (CVSS 5.3, kirilkirkov Ecommerce-CodeIgniter-Bootstrap)
- [CVE-2026-14633](https://cve.now/CVE-2026-14633.md): kirilkirkov Ecommerce-CodeIgniter-Bootstrap Hidden REST API Endpoint set cross site scripting (CVSS 5.3, kirilkirkov Ecommerce-CodeIgniter-Bootstrap)
- [CVE-2026-14632](https://cve.now/CVE-2026-14632.md): kirilkirkov Ecommerce-CodeIgniter-Bootstrap Trusted Backend MY\_Controller.php setReferrer redirect (CVSS 5.3, kirilkirkov Ecommerce-CodeIgniter-Bootstrap)
- [CVE-2026-14630](https://cve.now/CVE-2026-14630.md): ForceInjection AI-fundermentals Memory Recall smart\_customer\_service.py get\_conversation\_history weak hash (CVSS 2.3, ForceInjection AI-fundermentals)
- [CVE-2026-14535](https://cve.now/CVE-2026-14535.md): Fickling MLAllowlist analysis pass rendered inoperative by shared mutable state in AnalysisContext.shorten\_code() (CVSS 8.8, trailofbits fickling · fickling)
- [CVE-2026-14534](https://cve.now/CVE-2026-14534.md): Fickling check\_safety() bypass via unlisted standard library modules (\_posixsubprocess, site, atexit) (CVSS 8.8, trailofbits fickling · fickling)
- [CVE-2026-14629](https://cve.now/CVE-2026-14629.md): RT-Thread Parameter lwp\_syscall.c sys\_ioctl divide by zero (CVSS 5.3, RT-Thread)
- [CVE-2026-14628](https://cve.now/CVE-2026-14628.md): NousResearch hermes-agent Live Webhook Endpoint base.py extract\_media path traversal (CVSS 6.9, NousResearch hermes-agent)
- [CVE-2025-13475](https://cve.now/CVE-2025-13475.md): Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure (CVSS 3.5, WSO2 Identity Server · WSO2 API Manager)
- [CVE-2026-14627](https://cve.now/CVE-2026-14627.md): NousResearch hermes-agent Discord Platform Integration discord.py DiscordAdapter.\_is\_allowed\_user improper authentication (CVSS 6.3, NousResearch hermes-agent)
- [CVE-2026-12196](https://cve.now/CVE-2026-12196.md): HestiaCP Admin Takeover (CVSS 8.3, hestiacp)
- [CVE-2026-14626](https://cve.now/CVE-2026-14626.md): NousResearch hermes-agent HTTP API run\_agent.py AIAgent.run\_conversation denial of service (CVSS 5.3, NousResearch hermes-agent)
- [CVE-2026-53362](https://cve.now/CVE-2026-53362.md): ipv6: account for fraggap on the paged allocation path (CVSS 7.8, KEV, Linux)
- [CVE-2026-53361](https://cve.now/CVE-2026-53361.md): af\_unix: Set gc\_in\_progress to true in unix\_gc(). (CVSS 7.1, Linux)
- [CVE-2026-53360](https://cve.now/CVE-2026-53360.md): KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (CVSS 8.8, Linux)
- [CVE-2026-53359](https://cve.now/CVE-2026-53359.md): KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVSS 8.8, Linux)
- [CVE-2026-12195](https://cve.now/CVE-2026-12195.md): myVesta is affected by an authenticated remote code execution vulnerability. (CVSS 8.5, myvesta vesta)
- [CVE-2026-14625](https://cve.now/CVE-2026-14625.md): NousResearch hermes-agent server.py shell.exec protection mechanism (CVSS 5.3, NousResearch hermes-agent)
- [CVE-2026-14624](https://cve.now/CVE-2026-14624.md): omec-project amf NGSetupRequest handler.go denial of service (CVSS 5.3, omec-project amf)
- [CVE-2026-14623](https://cve.now/CVE-2026-14623.md): omec-project amf NGAP Message RRCInactiveTransitionReport denial of service (CVSS 5.3, omec-project amf)
- [CVE-2026-14622](https://cve.now/CVE-2026-14622.md): jairiidriss restaurant-website-php-mysql AJAX Endpoint ajax\_files missing authentication (CVSS 6.9, jairiidriss restaurant-website-php-mysql)
- [CVE-2026-14621](https://cve.now/CVE-2026-14621.md): FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong session (CVSS 2.3, FederatedAI FATE)
- [CVE-2026-12194](https://cve.now/CVE-2026-12194.md): PHPIPAM Authenticated LFI (CVSS 2.3, phpipam)
- [CVE-2026-14619](https://cve.now/CVE-2026-14619.md): itsourcecode Hospital Management System medicine.php sql injection (CVSS 5.3, itsourcecode Hospital Management System)
- [CVE-2026-14618](https://cve.now/CVE-2026-14618.md): Open5GS AMF nnrf-handler.c amf\_nnrf\_handle\_nf\_discover denial of service (CVSS 5.3, Open5GS)
- [CVE-2025-71380](https://cve.now/CVE-2025-71380.md): n8n - Arbitrary Command Execution via Execute Command Node (CVSS 8.7, n8n · n8n-nodes-base)
- [CVE-2025-71375](https://cve.now/CVE-2025-71375.md): picklescan - Undetected Remote Code Execution via \_operator.methodcaller (CVSS 7.6, picklescan)
- [CVE-2025-71373](https://cve.now/CVE-2025-71373.md): picklescan - Remote Code Execution via operator.methodcaller Detection Bypass (CVSS 7.6, picklescan)
- [CVE-2025-71372](https://cve.now/CVE-2025-71372.md): Picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.getlincoef Gadget (CVSS 7.6, Picklescan)
- [CVE-2025-71369](https://cve.now/CVE-2025-71369.md): picklescan - Unsafe Deserialization via torch.utils.data.datapipes.utils.decoder.basichandlers (CVSS 7.6, picklescan)
- [CVE-2025-71367](https://cve.now/CVE-2025-71367.md): picklescan - Remote Code Execution via \_operator.attrgetter Detection Bypass (CVSS 7.6, picklescan)
- [CVE-2025-71366](https://cve.now/CVE-2025-71366.md): picklescan - Arbitrary Code Execution via torch.utils.bottleneck.\_\_main\_\_.run\_cprofile (CVSS 7.6, picklescan)
- [CVE-2025-71364](https://cve.now/CVE-2025-71364.md): picklescan - Arbitrary Code Execution via Undetected asyncio.unix\_events.\_UnixSubprocessTransport.\_start (CVSS 7.6, picklescan)
- [CVE-2025-71362](https://cve.now/CVE-2025-71362.md): picklescan - Arbitrary Code Execution via Unsafe Deserialization in numpy.f2py.crackfortran (CVSS 7.6, picklescan)
- [CVE-2025-71360](https://cve.now/CVE-2025-71360.md): picklescan - Remote Code Execution via Undetected idlelib.calltip.get\_entity (CVSS 7.6, picklescan)
- [CVE-2025-71359](https://cve.now/CVE-2025-71359.md): picklescan - Unsafe Deserialization via lib2to3.pgen2.grammar.Grammar.loads (CVSS 7.6, picklescan)
- [CVE-2025-71356](https://cve.now/CVE-2025-71356.md): picklescan - Arbitrary Code Execution via torch.fx.experimental.symbolic\_shapes.ShapeEnv.evaluate\_guards\_expression (CVSS 7.6, picklescan)
- [CVE-2025-71353](https://cve.now/CVE-2025-71353.md): picklescan - Remote Code Execution via torch.\_dynamo.guards.GuardBuilder.get (CVSS 7.6, picklescan)
- [CVE-2025-71347](https://cve.now/CVE-2025-71347.md): picklescan - Undetected Remote Code Execution via numpy.f2py.crackfortran.param\_eval (CVSS 7.6, picklescan)
- [CVE-2025-71345](https://cve.now/CVE-2025-71345.md): picklescan - Arbitrary Code Execution via torch.utils.bottleneck.\_\_main\_\_.run\_autograd\_prof (CVSS 7.6, picklescan)
- [CVE-2025-71343](https://cve.now/CVE-2025-71343.md): picklescan - Arbitrary Code Execution via lib2to3.pgen2.pgen.ParserGenerator.make\_label Detection Bypass (CVSS 7.6, picklescan)
- [CVE-2025-71342](https://cve.now/CVE-2025-71342.md): picklescan - Undetected Remote Code Execution via idlelib.run.Executive.runcode (CVSS 7.6, picklescan)
- [CVE-2026-12252](https://cve.now/CVE-2026-12252.md): Untrusted JAR Code Execution in Multiple Stanford Interface Classes in nltk/nltk (CVSS 7.8, nltk/nltk · nltk)
- [CVE-2026-54424](https://cve.now/CVE-2026-54424.md): An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. (CVSS 8.4, Unity Parsec)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-07-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.