CVEs published July 6, 2026
196 CVEs were published on July 6, 2026: 30 critical, 77 high.
- Published
- 196
- Critical
- 30
- High
- 77
- Medium
- 77
- Low
- 12
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 151
Most affected products
- Apache Software Foundation Apache Camel · org.apache.camel:…
- 17
- FOSSBilling
- 17
- coollabsio coolify
- 11
- Qualcomm Snapdragon
- 11
- OP-TEE optee_os
- 8
- gohugoio hugo · github.com/gohugoio/hugo
- 6
- python-pillow Pillow · pillow
- 5
- CodeAstro Apartment Visitor Management System
- 4
- GPAC
- 4
- radareorg radare2
- 4
Critical 30
- CVE-2026-42341FOSSBilling has an unauthenticated payment bypass via IPN callback forgeryFOSSBilling
- CVE-2026-34038Coolify authenticated remote command injection leading to RCE and secret exfiltrationcoollabsio coolify
- CVE-2026-57572Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_argsunclecode crawl4ai · crawl4ai
- CVE-2026-57571Crawl4AI arbitrary file write via download filename path traversalunclecode crawl4ai · crawl4ai
- CVE-2026-11405Hidden backdoor authentication mechanism in multiple versions of Tenda firmware allows admin access to web management interfaceTenda firmware
- CVE-2026-9181Directory Traversal in ArcGIS ServerEsri ArcGIS Server
- CVE-2026-9182Unvalidated File Upload vulnerability in ArcGIS Server.Esri ArcGIS Server
- CVE-2026-48614An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resuWebPros Plesk
- CVE-2026-48316ColdFusion | Improper Input Validation (CWE-20)Adobe ColdFusion
- CVE-2026-40139Critical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote AccessBeyondTrust Remote Support · BeyondTrust Privileged Remote…
- CVE-2026-40138Critical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote AccessBeyondTrust Remote Support · BeyondTrust Privileged Remote…
- CVE-2026-5268SFTP Server Authentication WeaknessCIENA 6500 S-Series · CIENA 6500 T-Series +2
- CVE-2025-53830Anti-Virus for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF)Anti-Virus for ownCloud · ownCloud
- CVE-2025-53827ownCloud Core: Updater has an exposed dangerous method or functionownCloud Core
- CVE-2026-12686Incorrect authorisation in Adiss’s BiloopAdiss Biloop
- CVE-2026-24013Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPCApache Software Foundation Apache IoTDB · apache-iotdb
- CVE-2026-24014Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File WriteApache Software Foundation Apache IoTDB · apache-iotdb
- CVE-2026-43867Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilterApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2026-56140Apache Camel AWS2 SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy to align it with sibling componentsApache Software Foundation Apache Camel AWS2 SNS · org.apac…
- CVE-2026-53913Apache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the token is never verified and any non-null bearer value is acceptedApache Software Foundation Apache Camel Keycloak · org.apac…
- CVE-2026-48205Apache Camel DNS: The dns.* and term Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to influence internal behaviourApache Software Foundation Apache Camel DNS · org.apache.ca…
- CVE-2026-48204Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configurationApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2026-48203Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fieldsApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2026-46456Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headersApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2026-46455Apache Camel: Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be acceptedApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2026-46454Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headersApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2026-40047Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducerApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2026-14808PROG MIS｜Prog Management System - Exposure of Sensitive InformationPROG MIS Prog Management System
- CVE-2026-14807PROG MIS｜ERP App - Use of Hard-coded CredentialsPROG MIS ERP App
- CVE-2026-6382Multiple elFinder Plugins - Authenticated OS Command InjectionFileOrganizer · Advanced File Manager +2
High 77
- CVE-2026-53646FOSSBilling: Client password reset token reuse allows persistent account takeoverFOSSBilling
- CVE-2026-53645FOSSBilling's missing self-edit prevention in staff permission management allows persistent privilege escalationFOSSBilling
- CVE-2026-53644FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active ordersFOSSBilling
- CVE-2026-53643FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpointsFOSSBilling
- CVE-2026-43921FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serializationFOSSBilling
- CVE-2026-42153Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Containercoollabsio coolify
- CVE-2026-34599Coolify: Authenticated Remote Code Execution in GetLogs Livewire Componentcoollabsio coolify
- CVE-2026-43918Suspended or inactive FOSSBilling accounts can retain or regain access through existing sessions, API tokens, and password reset flowsFOSSBilling
- CVE-2026-42204Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host rootcoollabsio coolify
- CVE-2026-34153Coolify LocalFileVolume fs_path command injection enables RCEcoollabsio coolify
- CVE-2026-42331FOSSBilling missing authorization in guest Invoice API endpointsFOSSBilling
- CVE-2026-14468Path traversal allows arbitrary file read in Terraform Enterprise containerHashiCorp Terraform Enterprise
- CVE-2026-59712Leantime - JSON-RPC API Broken Access Control via users.getUserLeantime
- CVE-2026-59713Leantime - OIDC Login CSRF via Unconditional State Verification StubLeantime
- CVE-2026-54763Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuthtraefik · github.com/traefik/traefik +2
- CVE-2026-14471Authenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-registryAWS MCP Gateway & Registry
- CVE-2026-57573Crawl4AI unauthenticated SSRF in Docker streaming crawl endpointunclecode crawl4ai · crawl4ai
- CVE-2026-25271Time-of-check Time-of-use (TOCTOU) Race Condition in DSP ServiceQualcomm Snapdragon
- CVE-2026-25268Stack-based Buffer Overflow in WLAN HostQualcomm Snapdragon
- CVE-2026-21383Reusing a Nonce, Key Pair in Encryption in HLOSQualcomm Snapdragon
- CVE-2026-21379Buffer Over-read in Windows ComputeQualcomm Snapdragon
- CVE-2026-55514vLLM denial of service via prompt embeds on M-RoPE modelsvllm-project vllm · vllm
- CVE-2026-55574vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backendsvllm-project vllm · vllm
- CVE-2026-55727A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow anGenetec Security Center
- CVE-2026-54234vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjectionvllm-project vllm · vllm
- CVE-2026-14536Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user cDevolutions Server
- CVE-2026-54291Silent channel-binding authentication downgrade via unsupported certificate algorithmspgjdbc · org.postgresql:postgresql
- CVE-2026-55379Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loadingpython-pillow Pillow · pillow
- CVE-2026-55380Pillow GdImageFile decompression bomb protection bypasspython-pillow Pillow · pillow
- CVE-2026-54060Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`python-pillow Pillow · pillow
- CVE-2026-54059Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loadingpython-pillow Pillow · pillow
- CVE-2026-13753Certain HP DeskJet All in One – Potential Information DisclosureHP DeskJet 2820 AIO Printer · HP DeskJet 2823 AIO Print… +45
- CVE-2025-53831DrawIO for ownCloud 10 is vulnerable to Stored XSSDrawIO for ownCloud · ownCloud
- CVE-2026-40141High-Severity Vulnerability In Web Application Component of BeyondTrust Remote Support and Privileged Remote AccessBeyondTrust Remote Support · BeyondTrust Privilege Remote A…
- CVE-2026-40140High-Severity Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote AccessBeyondTrust Remote Support · BeyondTrust Privileged Remote…
- CVE-2026-43825Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModelApache Software Foundation Apache OpenNLP :: Core :: ML ::…
- CVE-2026-59195pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-configpnpm
- CVE-2026-59196pnpm: hoisted install imports lockfile alias outside node_modulespnpm
- CVE-2026-59194pnpm: patch-remove could delete project-selected files outside the patches directorypnpm
- CVE-2025-53829ownCloud 10 is vulnerable to Relative Path TraversalownCloud
- CVE-2025-53828SharePoint for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF)owncloud SharePoint · ownCloud
- CVE-2026-58380Gimp: gimp: stack buffer overflow in pnmscanner_gettoken()Red Hat Enterprise Linux
- CVE-2026-13708Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers in i_readjpeg_wiolTONYC Imager::File::JPEG
- CVE-2026-13705Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rleTONYC Imager
- CVE-2026-4249Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service DisruptionWSO2 Universal Gateway · WSO2 Traffic Manager +2
- CVE-2026-6901Untrusted Search PathB&R Industrial Automation APROL
- CVE-2026-49297Apache Airflow Google provider: Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOperator + GCSTimeSpanFileTransformOperator)Apache Software Foundation Apache Airflow Google provider ·…
- CVE-2026-6900Improper Certificate ValidationB&R Industrial Automation APROL
- CVE-2026-44937SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL ComponentsSUSE Rancher · github.com/rancher/fleet
- CVE-2026-46588Apache Camel: CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted inputApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2026-46587Apache Camel: Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted inputApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2026-49042Apache Camel: langchain4j-tools: filter tool argument headers against declared parametersApache Software Foundation Apache Camel · org.apache.cam… +2
- CVE-2026-56810mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5elixir-mint mint
- CVE-2026-58226Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpaxelixir-mint hpax
- CVE-2026-9165Stackrox: stackrox: unbounded graphql query depth allows authenticated denial of serviceRed Hat Advanced Cluster Security
- CVE-2026-44934Exposed tokens in SUSE Rancher AI Agent logsSUSE Rancher
- CVE-2026-24012Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation QueryApache Software Foundation Apache IoTDB · apache-iotdb
- CVE-2026-43866Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolderApache Software Foundation Apache Camel · org.apache.cam… +5
- CVE-2026-55994Apache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling control over internal behaviourApache Software Foundation Apache Camel Iggy · org.apache.c…
- CVE-2026-55993Apache Camel Atmosphere Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling influencing internal behaviourApache Software Foundation Apache Camel Atmosphere Websocke…
- CVE-2026-46726Apache Camel Vertx Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headersApache Software Foundation Apache Camel Vertx Websocket · o…
- CVE-2026-46592Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operationApache Software Foundation Apache Camel · org.apache.cam… +1
- CVE-2026-46591Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)Apache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2026-46590Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)Apache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2026-46585Apache Camel Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP client to inject the full-text search queryApache Software Foundation Apache Camel Lucene · org.apache…
- CVE-2026-46457Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headersApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2026-43865Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code executionApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2026-42527Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosureApache Software Foundation Apache Camel · org.apache.ca… +11
- CVE-2026-40859Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabledApache Software Foundation Apache Camel · org.apache.cam… +1
- CVE-2026-14809PROG MIS｜Prog Management System - SQL InjectionPROG MIS Prog Management System
- CVE-2026-12083Admin and Site Enhancements < 8.8.4 - Unauthenticated Administrator-Role Restoration via reset-for ParameterAdmin and Site Enhancements · admin-site-enhancements-pro
- CVE-2026-11962FileOrganizer < 1.2.0 - Authenticated Arbitrary File Upload via elFinder File OperationsFileOrganizer
- CVE-2026-11855Simple Membership < 4.7.5 - Unauthenticated Stored XSS via Stripe Webhook API VersionSimple Membership
- CVE-2026-11766Ultimate Member < 2.12.0 - Subscriber+ Stored XSS via Custom Textarea Profile FieldsUltimate Member
- CVE-2026-10830AllCoach < 1.0.2 - Unauthenticated Account TakeoverAllCoach
- CVE-2024-6228WANotifier < 2.6 - Subscriber+ LFINotifications for Forms & WordPress Actions
- CVE-2026-38976mrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in op_super() / OP_SUPER due to a missing runtime guard for
Medium, low and unrated 89
- CVE-2024-56141Minosoft has IV equal to keyBixilon Minosoft
- CVE-2026-53648FOSSBilling: Downloadable product files can be overwritten through filename collisionsFOSSBilling
- CVE-2026-53647FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpointFOSSBilling
- CVE-2026-13356Interrupted navigation could allow address bar origin spoofing in Firefox for iOSMozilla Firefox for iOS
- CVE-2026-53642FOSSBilling: Unverified clients can access client-area pages when email confirmation is requiredFOSSBilling
- CVE-2026-53641FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literalFOSSBilling
- CVE-2026-53640FOSSBilling missing authorization checks on read-only admin API endpoints expose sensitive staff, client, and redirect dataFOSSBilling
- CVE-2026-43928FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpaymentFOSSBilling
- CVE-2026-43927FOSSBilling has race condition in cart checkout that bypasses promo code usage limitsFOSSBilling
- CVE-2026-43925FOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized promo code useFOSSBilling
- CVE-2026-34167Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitorcoollabsio coolify
- CVE-2026-34049Coolify: Command Injection via unsanitized MongoDB collection names in database backupcoollabsio coolify
- CVE-2026-59710showdown - Stored XSS via Unescaped Table Header ID Attribute Injectionshowdown
- CVE-2026-42148Coolify: Command Injection via Unescaped Version String in Docker Buildcoollabsio coolify
- CVE-2026-41899Coolify unauthenticated feedback endpoint allows Discord webhook abusecoollabsio coolify
- CVE-2026-34050Coolify Settings/Updates Livewire component missing instance administrator authorizationcoollabsio coolify
- CVE-2026-32718Coolify read-scoped API tokens can perform state-changing validation operationscoollabsio coolify
- CVE-2026-59711showdown - Cross-Site Scripting via Unescaped Metadata Title in completeHTMLDocumentshowdown
- CVE-2026-33734FOSSBilling has improper SQL neutralization in `Massmailer` recipient filtersFOSSBilling
- CVE-2026-54765Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:porttraefik · github.com/traefik/traefik/v3 +2
- CVE-2026-54764ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=falsetraefik · github.com/traefik/traefik/v2 +2
- CVE-2026-21384Out-of-bounds Write in Camera DriverQualcomm Snapdragon
- CVE-2026-21370Out-of-bounds Write in Camera DriverQualcomm Snapdragon
- CVE-2026-21369Out-of-bounds Write in Camera DriverQualcomm Snapdragon
- CVE-2026-21368Out-of-bounds Write in Camera DriverQualcomm Snapdragon
- CVE-2025-59617Use After Free in Computer VisionQualcomm Snapdragon
- CVE-2025-59616Use After Free in Computer VisionQualcomm Snapdragon
- CVE-2025-59615Use After Free in Computer VisionQualcomm Snapdragon
- CVE-2026-50135Hugo: Symlink confinement bypass in resources.Getgohugoio hugo · github.com/gohugoio/hugo
- CVE-2026-48267DNG SDK | NULL Pointer Dereference (CWE-476)Adobe DNG Software Development Kit
- CVE-2026-50134Hugo: security.http.urls allow-list bypass via HTTP redirectsgohugoio hugo · github.com/gohugoio/hugo
- CVE-2026-14898The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses.OpenAI Codex desktop app for macOS
- CVE-2026-55646vLLM speech-to-text endpoints allocate full upload before enforcing the audio file-size limitvllm-project vllm · vllm
- CVE-2026-59089Gimp: gimp: denial of service via integer overflow in playstation tim loadergimp · Red Hat Enterprise Linux
- CVE-2026-53763OP-TEE has AES-GCM 32-bit integer overflow in length counters that breaks authentication guaranteeOP-TEE optee_os
- CVE-2026-44362OP-TEE's subkey rollback protection can be bypassed with older subkey versionsOP-TEE optee_os
- CVE-2026-42546OP-TEE has missing OPTEE_MSG_ATTR_TYPE_MASK in cleanup_shm_refs() leaks mobj referencesOP-TEE optee_os
- CVE-2026-50133Hugo: XSS via text/html content filesgohugoio hugo · github.com/gohugoio/hugo
- CVE-2026-41516OP-TEE: Hisilicon HPRE PKCS#1 v1.5 Decryption Padding OracleOP-TEE optee_os
- CVE-2026-58403Hugo symlink confinement bypass in os.ReadFilegohugoio hugo · github.com/gohugoio/hugo
- CVE-2026-41515OP-TEE: RSA-OAEP padding oracle in NXP CAAM driver enables plaintext recoveryOP-TEE optee_os
- CVE-2026-58402Hugo default code block renderer XSS via unescaped code-fence languagegohugoio hugo · github.com/gohugoio/hugo
- CVE-2026-58404Hugo security.http.urls deny rules bypassed by alternate IPv4 encodingsgohugoio hugo · github.com/gohugoio/hugo
- CVE-2026-41514OP-TEE: RSA-OAEP padding oracle in Hisilicon HPRE driver enables plaintext recoveryOP-TEE optee_os
- CVE-2026-55798Pillow: WindowsViewer.get_command() OS command injection via unescaped shell pathpython-pillow Pillow · pillow
- CVE-2026-12154Reviews Widgets for Google, Yelp & TripAdvisor <= 2.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'page_id' Shortcode Attributewidgetpack Reviews Widgets for Google, TripAdvisor, Yelp &…
- CVE-2026-41434OP-TEE has unbounded recursion in sanitize_client_object()OP-TEE optee_os
- CVE-2026-40257OP-TEE has SHA-3 accelerated finalize heap overflowOP-TEE optee_os
- CVE-2026-13122OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed autheOpenVPN
- CVE-2026-59152Arbitrary server-side file read in LangSmith SDK TracingMiddlewarelangchain-ai langsmith-sdk · langsmith
- CVE-2026-58203NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_sizepydantic-settings
- CVE-2026-13698A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valiOpenVPN
- CVE-2026-54893Email-derived URL path injection in the Swoosh Microsoft Graph adapterswoosh
- CVE-2026-7185Unauthorized access to files in T-Systems productsT-Systems Archivo · T-Systems MyTAO +2
- CVE-2025-15668GPAC MP4Box box_code_base.c sgpd_del_entry heap-based overflowGPAC
- CVE-2025-15667GPAC MP4Box avc_ext.c gf_isom_nalu_sample_rewrite double freeGPAC
- CVE-2025-8591Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI ModificationWSO2 Identity Server · WSO2 API Manager +5
- CVE-2026-44936Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yamlSUSE Rancher · github.com/rancher/fleet
- CVE-2026-56139Apache Camel Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clientsApache Software Foundation Apache Camel Undertow · org.apac…
- CVE-2026-1433uniFLOW Universal Login Manager (ULM) Standalone Improper Protection of Sensitive Information Leads to Information DisclosureNT-ware uniFLOW ULM (Universal Login Manager) Standalone
- CVE-2026-49365Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clientsApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2026-49099Apache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to influence internal behaviourApache Software Foundation Apache Camel Salesforce · org.ap…
- CVE-2026-49098Apache Camel: Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter, allowing an HTTP client to redirect Kafka messages to an arbitrary topicApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2026-49097Apache Camel: Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to redirect outgoing IRC messages to arbitrary channels or usersApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2026-49086Apache Camel Dapr: Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers, allowing an actor who can publish to the subscribed topic to influence internal behaviourApache Software Foundation Apache Camel Dapr · org.apache.c…
- CVE-2026-48206Apache Camel JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to drive arbitrary JIRA issue operations using the endpoint's configured credentialsApache Software Foundation Apache Camel JIRA · org.apache.c…
- CVE-2026-46584Apache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail session properties, allowing an attacker to influence SMTP parametersApache Software Foundation Apache Camel Mail · org.apache.c…
- CVE-2026-46453Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operationApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2026-14802react create-react-app react-dev-utils openBrowser.js startBrowserProcess os command injectioncreate-react-app · react-dev-utils
- CVE-2026-14801GPAC TeXML File load_text.c txtin_probe_duration divide by zeroGPAC
- CVE-2026-14800imhamzaazam ecommerceFlask cross-site request forgeryimhamzaazam ecommerceFlask
- CVE-2026-14799CodeAstro Ecommerce Website my_account.php sql injectionCodeAstro Ecommerce Website
- CVE-2026-14798CodeAstro Apartment Visitor Management System visitor-entry.php sql injectionCodeAstro Apartment Visitor Management System
- CVE-2026-14797CodeAstro Apartment Visitor Management System edit-apartment.php sql injectionCodeAstro Apartment Visitor Management System
- CVE-2026-14796CodeAstro Apartment Visitor Management System report.php sql injectionCodeAstro Apartment Visitor Management System
- CVE-2026-14795CodeAstro Apartment Visitor Management System action-visitor.php sql injectionCodeAstro Apartment Visitor Management System
- CVE-2026-14794Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorizationCraft CMS · craftcms/cms
- CVE-2026-14793Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorizationCraft CMS · craftcms/cms
- CVE-2026-14792Formbricks Survey actions.ts access controlFormbricks
- CVE-2026-14791crater-invoice-inc crater Invoice Note InvoicesRequest.php getFormattedString cross site scriptingcrater-invoice-inc crater
- CVE-2026-14790GPAC Media File write_nhml.c nhmldump_send_frame null pointer dereferenceGPAC
- CVE-2026-14789radareorg radare2 Memory64ListStream mdmp.c stack-based overflowradareorg radare2
- CVE-2026-14788radareorg radare2 cfile.c r_core_bin_load use after freeradareorg radare2
- CVE-2026-14803Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoderSRI Mojo::JSON
- CVE-2026-14787radareorg radare2 pb Print cmd_print.inc cmd_print integer overflowradareorg radare2
- CVE-2026-14786radareorg radare2 str.c r_str_word_get0set integer overflowradareorg radare2
- CVE-2026-14784vxcontrol PentAGI Docker API client.go sandboxvxcontrol PentAGI
- CVE-2026-38973mrubyc through release3.4.1 was found to contain an out-of-bounds read in builtin missing-method lookup inside mrbc_find_method().
- CVE-2026-38979ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI.