# CVEs published 2026-07-05

87 CVEs were published on July 5, 2026: 1 critical, 6 high. Days are UTC.

- [CVE-2026-14783](https://cve.now/CVE-2026-14783.md): NousResearch hermes-agent skills\_tool.py skill\_view path traversal (CVSS 5.3, NousResearch hermes-agent)
- [CVE-2026-14778](https://cve.now/CVE-2026-14778.md): SourceCodester Onlne Examination & Learning Management System Enrollment Management ajax\_enroll.php improper authorization (CVSS 6.9, SourceCodester Onlne Examination & Learning Management Syst…)
- [CVE-2026-14777](https://cve.now/CVE-2026-14777.md): SourceCodester Onlne Examination & Learning Management System announcements.php unrestricted upload (CVSS 5.3, SourceCodester Onlne Examination & Learning Management Syst…)
- [CVE-2026-14776](https://cve.now/CVE-2026-14776.md): SourceCodester Onlne Examination & Learning Management System Filename Extension upload\_files.php pathinfo unrestricted upload (CVSS 5.3, SourceCodester Onlne Examination & Learning Management Syst…)
- [CVE-2026-14775](https://cve.now/CVE-2026-14775.md): SourceCodester Onlne Examination & Learning Management System process\_lesson.php unrestricted upload (CVSS 5.3, SourceCodester Onlne Examination & Learning Management Syst…)
- [CVE-2026-14774](https://cve.now/CVE-2026-14774.md): itsourcecode Hospital Management System paymentdischarge.php sql injection (CVSS 5.3, itsourcecode Hospital Management System)
- [CVE-2026-10657](https://cve.now/CVE-2026-10657.md): Out-of-bounds read in Zephyr DNS resolver mDNS suffix check (memcmp past string NUL) (CVSS 3.7, zephyrproject zephyr)
- [CVE-2026-10656](https://cve.now/CVE-2026-10656.md): NULL-pointer dereference DoS in MAX32 USB device controller transfer-completion handlers (CVSS 4.6, zephyrproject zephyr)
- [CVE-2026-14773](https://cve.now/CVE-2026-14773.md): itsourcecode Hospital Management System payment.php sql injection (CVSS 5.3, itsourcecode Hospital Management System)
- [CVE-2026-14772](https://cve.now/CVE-2026-14772.md): SourceCodester Class and Exam Timetabling System edit\_course1.php sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-59520](https://cve.now/CVE-2026-59520.md): WordPress CrawlWP SEO plugin \<= 3.0.16 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, properfraction CrawlWP SEO)
- [CVE-2026-59519](https://cve.now/CVE-2026-59519.md): WordPress FormLayer plugin \<= 1.0.6 - Sensitive Data Exposure vulnerability (CVSS 5.3, Softaculous FormLayer)
- [CVE-2026-59511](https://cve.now/CVE-2026-59511.md): WordPress Exclusive Addons Elementor plugin \<= 2.7.9.9 - Sensitive Data Exposure vulnerability (CVSS 5.3, Tim Strifler Exclusive Addons Elementor)
- [CVE-2026-14771](https://cve.now/CVE-2026-14771.md): SourceCodester Class and Exam Timetabling System edit\_exam1.php sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-14770](https://cve.now/CVE-2026-14770.md): SourceCodester Class and Exam Timetabling System edit\_room.php sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-14769](https://cve.now/CVE-2026-14769.md): code-projects Real State Services pay.php sql injection (CVSS 6.9, code-projects Real State Services)
- [CVE-2026-14768](https://cve.now/CVE-2026-14768.md): code-projects Real State Services builderHome.php sql injection (CVSS 6.9, code-projects Real State Services)
- [CVE-2026-14767](https://cve.now/CVE-2026-14767.md): CodeAstro Ecommerce Website POST Parameter confirm.php sql injection (CVSS 5.3, CodeAstro Ecommerce Website)
- [CVE-2026-14766](https://cve.now/CVE-2026-14766.md): CodeAstro Apartment Visitor Management System POST Parameter search-result.php sql injection (CVSS 5.3, CodeAstro Apartment Visitor Management System)
- [CVE-2026-59510](https://cve.now/CVE-2026-59510.md): Authenticated Path Traversal in AIL Framework PDF Object Handling Enables Potential Arbitrary File Read (CVSS 7.1, ail-project ail-framework)
- [CVE-2026-14764](https://cve.now/CVE-2026-14764.md): code-projects Hotel and Tourism Reservation Event Management add\_event.php sql injection (CVSS 6.9, code-projects Hotel and Tourism Reservation)
- [CVE-2026-14763](https://cve.now/CVE-2026-14763.md): code-projects Hotel and Tourism Reservation Tour Reservations tour\_reserves.php sql injection (CVSS 6.9, code-projects Hotel and Tourism Reservation)
- [CVE-2026-14762](https://cve.now/CVE-2026-14762.md): code-projects Hotel and Tourism Reservation Room Management rooms.php sql injection (CVSS 6.9, code-projects Hotel and Tourism Reservation)
- [CVE-2026-14761](https://cve.now/CVE-2026-14761.md): radareorg radare2 str.c r\_str\_append integer overflow (CVSS 4.8, radareorg radare2)
- [CVE-2026-14760](https://cve.now/CVE-2026-14760.md): radareorg radare2 regprofile disasm.c r\_core\_seek\_arch\_bits use after free (CVSS 4.8, radareorg radare2)
- [CVE-2026-14759](https://cve.now/CVE-2026-14759.md): radareorg radare2 RBinJava Line Number Table class.c r\_bin\_java\_inner\_classes\_attr\_calc\_size heap-based overflow (CVSS 4.8, radareorg radare2)
- [CVE-2026-14758](https://cve.now/CVE-2026-14758.md): radareorg radare2 hexpairs cmd\_anal.inc.c cmd\_anal\_opcode integer overflow (CVSS 4.8, radareorg radare2)
- [CVE-2026-6509](https://cve.now/CVE-2026-6509.md): Privilege Escalation in TUBITAK BILGEM's Pardus Update (CVSS 7.8, TUBITAK BILGEM Software Technologies Research Institute Par…)
- [CVE-2026-14757](https://cve.now/CVE-2026-14757.md): radareorg radare2 cmd\_anal.inc core\_anal\_bytes integer overflow (CVSS 4.8, radareorg radare2)
- [CVE-2026-9085](https://cve.now/CVE-2026-9085.md): DNS Hijacking in TUBITAK BILGEM's Pardus-Parental-Control (CVSS 8.8, TUBITAK BILGEM Software Technologies Research Institute Par…)
- [CVE-2026-12386](https://cve.now/CVE-2026-12386.md): Buffer Overflow in TUBITAK BILGEM's Pardus Pen (CVSS 3.9, TUBITAK BILGEM Software Technologies Research Institute Par…)
- [CVE-2026-14756](https://cve.now/CVE-2026-14756.md): code-projects Hotel and Tourism Reservation Tour Management add\_tour.php sql injection (CVSS 6.9, code-projects Hotel and Tourism Reservation)
- [CVE-2026-12250](https://cve.now/CVE-2026-12250.md): Sensitive Data Exposure in TUBITAK BILGEM's Pardus Domain Joiner (CVSS 7.9, TUBITAK BILGEM Software Technologies Research Institute Par…)
- [CVE-2026-14755](https://cve.now/CVE-2026-14755.md): code-projects Hotel and Tourism Reservation Reservations Management reservations.php sql injection (CVSS 6.9, code-projects Hotel and Tourism Reservation)
- [CVE-2026-14754](https://cve.now/CVE-2026-14754.md): code-projects Hotel and Tourism Reservation add\_room.php sql injection (CVSS 6.9, code-projects Hotel and Tourism Reservation)
- [CVE-2026-14753](https://cve.now/CVE-2026-14753.md): mjperpinosa stumasy Note Handler/Assignment notes authorization (CVSS 6.9, mjperpinosa stumasy)
- [CVE-2026-14752](https://cve.now/CVE-2026-14752.md): mjperpinosa stumasy add\_into\_dictionary.php add\_definition cross site scripting (CVSS 5.1, mjperpinosa stumasy)
- [CVE-2026-14751](https://cve.now/CVE-2026-14751.md): mjperpinosa stumasy search\_scratch\_data.php search\_scratch\_data sql injection (CVSS 5.3, mjperpinosa stumasy)
- [CVE-2026-14750](https://cve.now/CVE-2026-14750.md): mjperpinosa stumasy accessing\_dictionary\_authorization.php accessing\_dictionary\_authorization sql injection (CVSS 6.9, mjperpinosa stumasy)
- [CVE-2026-14749](https://cve.now/CVE-2026-14749.md): mjperpinosa stumasy calculate.php eval code injection (CVSS 6.9, mjperpinosa stumasy)
- [CVE-2026-14748](https://cve.now/CVE-2026-14748.md): AIAnytime Awesome-MCP-Server mcp-wiki/wiki-summary server.py server-side request forgery (CVSS 5.3, AIAnytime Awesome-MCP-Server)
- [CVE-2026-59509](https://cve.now/CVE-2026-59509.md): Unauthenticated arbitrary MongoDB collection read in cve-search (CVSS 9.2, cve-search)
- [CVE-2026-14747](https://cve.now/CVE-2026-14747.md): code-projects Real State Services addprojectsale.php sql injection (CVSS 6.9, code-projects Real State Services)
- [CVE-2026-14746](https://cve.now/CVE-2026-14746.md): code-projects Real State Services addprojectrent.php sql injection (CVSS 6.9, code-projects Real State Services)
- [CVE-2026-14745](https://cve.now/CVE-2026-14745.md): code-projects Real State Services single-list\_rent.php sql injection (CVSS 6.9, code-projects Real State Services)
- [CVE-2026-14744](https://cve.now/CVE-2026-14744.md): code-projects Real State Services normalHomeRent.php sql injection (CVSS 6.9, code-projects Real State Services)
- [CVE-2026-14743](https://cve.now/CVE-2026-14743.md): code-projects Real State Services normalHomeSale.php sql injection (CVSS 6.9, code-projects Real State Services)
- [CVE-2026-14742](https://cve.now/CVE-2026-14742.md): langchain-ai langgraph Task Result Cache \_cache.py \_freeze weak hash (CVSS 2.3, langchain-ai langgraph)
- [CVE-2026-14738](https://cve.now/CVE-2026-14738.md): exo-explore exo Vision Feature Cache vision.py \_image\_cache\_key weak hash (CVSS 6.3, exo-explore exo)
- [CVE-2026-14737](https://cve.now/CVE-2026-14737.md): Hanwang e-Face General Management Platform querySysAuthStr.do sql injection (CVSS 6.9, Hanwang e-Face General Management Platform)
- [CVE-2026-14736](https://cve.now/CVE-2026-14736.md): Ruijie RG-UAC user\_auth\_commit.php unrestricted upload (CVSS 6.9, Ruijie RG-UAC)
- [CVE-2026-14735](https://cve.now/CVE-2026-14735.md): code-projects Smart Parking System parkings.php sql injection (CVSS 6.9, code-projects Smart Parking System)
- [CVE-2026-14734](https://cve.now/CVE-2026-14734.md): SourceCodester Class and Exam Timetabling System edit\_product.php sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-14733](https://cve.now/CVE-2026-14733.md): SourceCodester Class and Exam Timetabling System edit\_coursea.php sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-14732](https://cve.now/CVE-2026-14732.md): SourceCodester Class and Exam Timetabling System edit\_exam.php sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-14731](https://cve.now/CVE-2026-14731.md): itsourcecode Hospital Management System patientreport.php sql injection (CVSS 5.3, itsourcecode Hospital Management System)
- [CVE-2026-14730](https://cve.now/CVE-2026-14730.md): itsourcecode Hospital Management System patientprofile.php sql injection (CVSS 5.3, itsourcecode Hospital Management System)
- [CVE-2026-14725](https://cve.now/CVE-2026-14725.md): SourceCodester Online Boat Reservation System session expiration (CVSS 5.3, SourceCodester Online Boat Reservation System)
- [CVE-2026-14723](https://cve.now/CVE-2026-14723.md): AD-Security AD\_Miner Cache analyse\_cache.py request\_a deserialization (CVSS 4.8, AD-Security AD\_Miner)
- [CVE-2026-14722](https://cve.now/CVE-2026-14722.md): tiddly-gittly TidGi-Desktop Git Repository Import loadWikiTiddlersWithSubWikis.ts code injection (CVSS 6.9, tiddly-gittly TidGi-Desktop · tidgi)
- [CVE-2026-14721](https://cve.now/CVE-2026-14721.md): UTT HiPER 1250GW Web Endpoint ConfigWirelessBase\_5g stack-based overflow (CVSS 8.7, UTT HiPER 1250GW)
- [CVE-2026-14719](https://cve.now/CVE-2026-14719.md): SourceCodester Onlne Examination & Learning Management System Registration Endpoint register.php privileges management (CVSS 6.9, SourceCodester Onlne Examination & Learning Management Syst…)
- [CVE-2026-14781](https://cve.now/CVE-2026-14781.md): Keycloak-services: keycloak-services: oidc email\_verified claim incorrectly applied to userinfo email (CVSS 4.8, Red Hat Build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-14717](https://cve.now/CVE-2026-14717.md): itsourcecode Hospital Management System patientlogin.php sql injection (CVSS 5.3, itsourcecode Hospital Management System)
- [CVE-2026-14716](https://cve.now/CVE-2026-14716.md): nextlevelbuilder GoClaw WebSocket RPC router.go MethodRouter.Handle authorization (CVSS 5.3, nextlevelbuilder GoClaw)
- [CVE-2026-14714](https://cve.now/CVE-2026-14714.md): zhayujie chatgpt-on-wechat CowAgent wx Endpoint common.py verify\_server missing authentication (CVSS 6.9, zhayujie chatgpt-on-wechat CowAgent)
- [CVE-2026-14713](https://cve.now/CVE-2026-14713.md): SourceCodester Pizzafy E-Commerce System ajax.php confirm\_order sql injection (CVSS 6.9, SourceCodester Pizzafy E-Commerce System)
- [CVE-2026-14706](https://cve.now/CVE-2026-14706.md): code-projects Online Examination Quiz Creation Feature update.php sql injection (CVSS 5.3, code-projects Online Examination)
- [CVE-2026-14705](https://cve.now/CVE-2026-14705.md): code-projects Online Examination head.php sql injection (CVSS 6.9, code-projects Online Examination)
- [CVE-2026-14704](https://cve.now/CVE-2026-14704.md): stephen-kruger bluebox cross site scripting (CVSS 5.3, stephen-kruger bluebox)
- [CVE-2026-14703](https://cve.now/CVE-2026-14703.md): itsourcecode Hospital Management System patientorder.php sql injection (CVSS 5.3, itsourcecode Hospital Management System)
- [CVE-2026-14702](https://cve.now/CVE-2026-14702.md): zcaceres markdownify-mcp webpage-to-markdown Markdownify.ts saveToTempFile random values (CVSS 2.0, zcaceres markdownify-mcp)
- [CVE-2026-14701](https://cve.now/CVE-2026-14701.md): code-projects Internship Management System Password Change Endpoint change\_password.php sql injection (CVSS 5.3, code-projects Internship Management System)
- [CVE-2026-14700](https://cve.now/CVE-2026-14700.md): code-projects Internship Management System Employer Login Endpoint login.php sql injection (CVSS 6.9, code-projects Internship Management System)
- [CVE-2026-14699](https://cve.now/CVE-2026-14699.md): zcaceres markdownify-mcp Markdownify.ts assertPathAllowed symlink (CVSS 4.8, zcaceres markdownify-mcp)
- [CVE-2026-14698](https://cve.now/CVE-2026-14698.md): SourceCodester Syllabus-Aligned Learning Management and Examination System upload\_files.php unrestricted upload (CVSS 5.3, SourceCodester Syllabus-Aligned Learning Management and Exa…)
- [CVE-2026-14695](https://cve.now/CVE-2026-14695.md): SourceCodester Multi-Vendor Online Grocery Management System Registration Users.php save\_client sql injection (CVSS 6.9, SourceCodester Multi-Vendor Online Grocery Management System)
- [CVE-2026-14694](https://cve.now/CVE-2026-14694.md): SourceCodester Multi-Vendor Online Grocery Management System POST Parameter Master.php cancel\_order sql injection (CVSS 5.3, SourceCodester Multi-Vendor Online Grocery Management System)
- [CVE-2026-14693](https://cve.now/CVE-2026-14693.md): SourceCodester Multi-Vendor Online Grocery Management System Master.php cancel\_order improper authorization (CVSS 5.3, SourceCodester Multi-Vendor Online Grocery Management System)
- [CVE-2026-14692](https://cve.now/CVE-2026-14692.md): SourceCodester Multi-Vendor Online Grocery Management System POST Parameter Master.php save\_shop\_type sql injection (CVSS 5.3, SourceCodester Multi-Vendor Online Grocery Management System)
- [CVE-2026-14691](https://cve.now/CVE-2026-14691.md): SourceCodester Multi-Vendor Online Grocery Management System Setting SystemSettings.php update\_settings\_info code injection (CVSS 5.3, SourceCodester Multi-Vendor Online Grocery Management System)
- [CVE-2026-14570](https://cve.now/CVE-2026-14570.md): Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery (CVSS 7.5, TIMLEGGE Crypt::DSA)
- [CVE-2026-14690](https://cve.now/CVE-2026-14690.md): SourceCodester Multi-Vendor Online Grocery Management System Users.php save\_users improper authorization (CVSS 6.9, SourceCodester Multi-Vendor Online Grocery Management System)
- [CVE-2026-14689](https://cve.now/CVE-2026-14689.md): CodeAstro Apartment Visitor Management System add-apartment.php sql injection (CVSS 5.3, CodeAstro Apartment Visitor Management System)
- [CVE-2026-14688](https://cve.now/CVE-2026-14688.md): itsourcecode Online Hotel Management System login.php sql injection (CVSS 6.9, itsourcecode Online Hotel Management System)
- [CVE-2026-14687](https://cve.now/CVE-2026-14687.md): 666ghj BettaFish InsightEngine search-result Deduplication agent.py \_deduplicate\_results partial string comparison (CVSS 6.9, 666ghj BettaFish)
- [CVE-2026-14686](https://cve.now/CVE-2026-14686.md): HdrHistogram Range Check DoubleHistogram.java org.HdrHistogram.DoubleHistogram.recordValue comparison (CVSS 4.8, HdrHistogram)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-07-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.