# CVEs published 2026-07-06

196 CVEs were published on July 6, 2026: 30 critical, 77 high. Days are UTC.

- [CVE-2024-56141](https://cve.now/CVE-2024-56141.md): Minosoft has IV equal to key (CVSS 5.0, Bixilon Minosoft)
- [CVE-2026-53648](https://cve.now/CVE-2026-53648.md): FOSSBilling: Downloadable product files can be overwritten through filename collisions (CVSS 5.1, FOSSBilling)
- [CVE-2026-53647](https://cve.now/CVE-2026-53647.md): FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get\_info endpoint (CVSS 6.9, FOSSBilling)
- [CVE-2026-13356](https://cve.now/CVE-2026-13356.md): Interrupted navigation could allow address bar origin spoofing in Firefox for iOS (CVSS 6.3, Mozilla Firefox for iOS)
- [CVE-2026-53646](https://cve.now/CVE-2026-53646.md): FOSSBilling: Client password reset token reuse allows persistent account takeover (CVSS 7.7, FOSSBilling)
- [CVE-2026-53645](https://cve.now/CVE-2026-53645.md): FOSSBilling's missing self-edit prevention in staff permission management allows persistent privilege escalation (CVSS 8.5, FOSSBilling)
- [CVE-2026-53644](https://cve.now/CVE-2026-53644.md): FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders (CVSS 8.6, FOSSBilling)
- [CVE-2026-53643](https://cve.now/CVE-2026-53643.md): FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpoints (CVSS 8.7, FOSSBilling)
- [CVE-2026-53642](https://cve.now/CVE-2026-53642.md): FOSSBilling: Unverified clients can access client-area pages when email confirmation is required (CVSS 5.3, FOSSBilling)
- [CVE-2026-53641](https://cve.now/CVE-2026-53641.md): FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal (CVSS 4.8, FOSSBilling)
- [CVE-2026-53640](https://cve.now/CVE-2026-53640.md): FOSSBilling missing authorization checks on read-only admin API endpoints expose sensitive staff, client, and redirect data (CVSS 2.3, FOSSBilling)
- [CVE-2026-43928](https://cve.now/CVE-2026-43928.md): FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpayment (CVSS 2.3, FOSSBilling)
- [CVE-2026-43927](https://cve.now/CVE-2026-43927.md): FOSSBilling has race condition in cart checkout that bypasses promo code usage limits (CVSS 6.9, FOSSBilling)
- [CVE-2026-43925](https://cve.now/CVE-2026-43925.md): FOSSBilling: Mass assignment of group\_id in guest client registration allows unauthorized promo code use (CVSS 6.9, FOSSBilling)
- [CVE-2026-43921](https://cve.now/CVE-2026-43921.md): FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization (CVSS 8.9, FOSSBilling)
- [CVE-2026-42153](https://cve.now/CVE-2026-42153.md): Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container (CVSS 8.8, coollabsio coolify)
- [CVE-2026-34167](https://cve.now/CVE-2026-34167.md): Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor (CVSS 5.0, coollabsio coolify)
- [CVE-2026-34049](https://cve.now/CVE-2026-34049.md): Coolify: Command Injection via unsanitized MongoDB collection names in database backup (CVSS 3.3, coollabsio coolify)
- [CVE-2026-34599](https://cve.now/CVE-2026-34599.md): Coolify: Authenticated Remote Code Execution in GetLogs Livewire Component (CVSS 8.8, coollabsio coolify)
- [CVE-2026-43918](https://cve.now/CVE-2026-43918.md): Suspended or inactive FOSSBilling accounts can retain or regain access through existing sessions, API tokens, and password reset flows (CVSS 8.7, FOSSBilling)
- [CVE-2026-42204](https://cve.now/CVE-2026-42204.md): Coolify: Authenticated RCE via SHELL\_SAFE\_COMMAND\_PATTERN regression → host root (CVSS 8.8, coollabsio coolify)
- [CVE-2026-59710](https://cve.now/CVE-2026-59710.md): showdown - Stored XSS via Unescaped Table Header ID Attribute Injection (CVSS 5.3, showdown)
- [CVE-2026-42148](https://cve.now/CVE-2026-42148.md): Coolify: Command Injection via Unescaped Version String in Docker Build (CVSS 3.8, coollabsio coolify)
- [CVE-2026-34153](https://cve.now/CVE-2026-34153.md): Coolify LocalFileVolume fs\_path command injection enables RCE (CVSS 8.8, coollabsio coolify)
- [CVE-2026-41899](https://cve.now/CVE-2026-41899.md): Coolify unauthenticated feedback endpoint allows Discord webhook abuse (CVSS 6.5, coollabsio coolify)
- [CVE-2026-34050](https://cve.now/CVE-2026-34050.md): Coolify Settings/Updates Livewire component missing instance administrator authorization (CVSS 6.5, coollabsio coolify)
- [CVE-2026-32718](https://cve.now/CVE-2026-32718.md): Coolify read-scoped API tokens can perform state-changing validation operations (CVSS 6.5, coollabsio coolify)
- [CVE-2026-59711](https://cve.now/CVE-2026-59711.md): showdown - Cross-Site Scripting via Unescaped Metadata Title in completeHTMLDocument (CVSS 5.3, showdown)
- [CVE-2026-42331](https://cve.now/CVE-2026-42331.md): FOSSBilling missing authorization in guest Invoice API endpoints (CVSS 7.7, FOSSBilling)
- [CVE-2026-14468](https://cve.now/CVE-2026-14468.md): Path traversal allows arbitrary file read in Terraform Enterprise container (CVSS 7.7, HashiCorp Terraform Enterprise)
- [CVE-2026-33734](https://cve.now/CVE-2026-33734.md): FOSSBilling has improper SQL neutralization in \`Massmailer\` recipient filters (CVSS 6.9, FOSSBilling)
- [CVE-2026-42341](https://cve.now/CVE-2026-42341.md): FOSSBilling has an unauthenticated payment bypass via IPN callback forgery (CVSS 9.2, FOSSBilling)
- [CVE-2026-34038](https://cve.now/CVE-2026-34038.md): Coolify authenticated remote command injection leading to RCE and secret exfiltration (CVSS 9.9, coollabsio coolify)
- [CVE-2026-59712](https://cve.now/CVE-2026-59712.md): Leantime - JSON-RPC API Broken Access Control via users.getUser (CVSS 8.6, Leantime)
- [CVE-2026-59713](https://cve.now/CVE-2026-59713.md): Leantime - OIDC Login CSRF via Unconditional State Verification Stub (CVSS 8.6, Leantime)
- [CVE-2026-54763](https://cve.now/CVE-2026-54763.md): Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth (CVSS 7.8, traefik · github.com/traefik/traefik +2)
- [CVE-2026-14471](https://cve.now/CVE-2026-14471.md): Authenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-registry (CVSS 8.1, AWS MCP Gateway & Registry)
- [CVE-2026-54765](https://cve.now/CVE-2026-54765.md): Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port (CVSS 6.3, traefik · github.com/traefik/traefik/v3 +2)
- [CVE-2026-54764](https://cve.now/CVE-2026-54764.md): ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false (CVSS 6.9, traefik · github.com/traefik/traefik/v2 +2)
- [CVE-2026-57572](https://cve.now/CVE-2026-57572.md): Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser\_config.extra\_args (CVSS 10.0, unclecode crawl4ai · crawl4ai)
- [CVE-2026-57573](https://cve.now/CVE-2026-57573.md): Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint (CVSS 8.6, unclecode crawl4ai · crawl4ai)
- [CVE-2026-57571](https://cve.now/CVE-2026-57571.md): Crawl4AI arbitrary file write via download filename path traversal (CVSS 9.6, unclecode crawl4ai · crawl4ai)
- [CVE-2026-25271](https://cve.now/CVE-2026-25271.md): Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-25268](https://cve.now/CVE-2026-25268.md): Stack-based Buffer Overflow in WLAN Host (CVSS 8.8, Qualcomm Snapdragon)
- [CVE-2026-21384](https://cve.now/CVE-2026-21384.md): Out-of-bounds Write in Camera Driver (CVSS 5.3, Qualcomm Snapdragon)
- [CVE-2026-21383](https://cve.now/CVE-2026-21383.md): Reusing a Nonce, Key Pair in Encryption in HLOS (CVSS 7.1, Qualcomm Snapdragon)
- [CVE-2026-21379](https://cve.now/CVE-2026-21379.md): Buffer Over-read in Windows Compute (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-21370](https://cve.now/CVE-2026-21370.md): Out-of-bounds Write in Camera Driver (CVSS 5.3, Qualcomm Snapdragon)
- [CVE-2026-21369](https://cve.now/CVE-2026-21369.md): Out-of-bounds Write in Camera Driver (CVSS 5.3, Qualcomm Snapdragon)
- [CVE-2026-21368](https://cve.now/CVE-2026-21368.md): Out-of-bounds Write in Camera Driver (CVSS 5.3, Qualcomm Snapdragon)
- [CVE-2025-59617](https://cve.now/CVE-2025-59617.md): Use After Free in Computer Vision (CVSS 6.6, Qualcomm Snapdragon)
- [CVE-2025-59616](https://cve.now/CVE-2025-59616.md): Use After Free in Computer Vision (CVSS 6.6, Qualcomm Snapdragon)
- [CVE-2025-59615](https://cve.now/CVE-2025-59615.md): Use After Free in Computer Vision (CVSS 6.6, Qualcomm Snapdragon)
- [CVE-2026-55514](https://cve.now/CVE-2026-55514.md): vLLM denial of service via prompt embeds on M-RoPE models (CVSS 7.1, vllm-project vllm · vllm)
- [CVE-2026-55574](https://cve.now/CVE-2026-55574.md): vLLM: ReDoS via structured\_outputs.regex compiled without timeout in xgrammar and outlines backends (CVSS 8.7, vllm-project vllm · vllm)
- [CVE-2026-55727](https://cve.now/CVE-2026-55727.md): A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow an (CVSS 7.5, Genetec Security Center)
- [CVE-2026-50135](https://cve.now/CVE-2026-50135.md): Hugo: Symlink confinement bypass in resources.Get (CVSS 6.9, gohugoio hugo · github.com/gohugoio/hugo)
- [CVE-2026-54234](https://cve.now/CVE-2026-54234.md): vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection (CVSS 7.5, vllm-project vllm · vllm)
- [CVE-2026-48267](https://cve.now/CVE-2026-48267.md): DNG SDK | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe DNG Software Development Kit)
- [CVE-2026-50134](https://cve.now/CVE-2026-50134.md): Hugo: security.http.urls allow-list bypass via HTTP redirects (CVSS 6.3, gohugoio hugo · github.com/gohugoio/hugo)
- [CVE-2026-14898](https://cve.now/CVE-2026-14898.md): The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses. (CVSS 6.5, OpenAI Codex desktop app for macOS)
- [CVE-2026-55646](https://cve.now/CVE-2026-55646.md): vLLM speech-to-text endpoints allocate full upload before enforcing the audio file-size limit (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2026-59089](https://cve.now/CVE-2026-59089.md): Gimp: gimp: denial of service via integer overflow in playstation tim loader (CVSS 5.5, gimp · Red Hat Enterprise Linux)
- [CVE-2026-53763](https://cve.now/CVE-2026-53763.md): OP-TEE has AES-GCM 32-bit integer overflow in length counters that breaks authentication guarantee (CVSS 3.8, OP-TEE optee\_os)
- [CVE-2026-44362](https://cve.now/CVE-2026-44362.md): OP-TEE's subkey rollback protection can be bypassed with older subkey versions (CVSS 5.5, OP-TEE optee\_os)
- [CVE-2026-42546](https://cve.now/CVE-2026-42546.md): OP-TEE has missing OPTEE\_MSG\_ATTR\_TYPE\_MASK in cleanup\_shm\_refs() leaks mobj references (CVSS 3.8, OP-TEE optee\_os)
- [CVE-2026-50133](https://cve.now/CVE-2026-50133.md): Hugo: XSS via text/html content files (CVSS 5.1, gohugoio hugo · github.com/gohugoio/hugo)
- [CVE-2026-41516](https://cve.now/CVE-2026-41516.md): OP-TEE: Hisilicon HPRE PKCS#1 v1.5 Decryption Padding Oracle (CVSS 2.5, OP-TEE optee\_os)
- [CVE-2026-58403](https://cve.now/CVE-2026-58403.md): Hugo symlink confinement bypass in os.ReadFile (CVSS 5.9, gohugoio hugo · github.com/gohugoio/hugo)
- [CVE-2026-41515](https://cve.now/CVE-2026-41515.md): OP-TEE: RSA-OAEP padding oracle in NXP CAAM driver enables plaintext recovery (CVSS 2.5, OP-TEE optee\_os)
- [CVE-2026-14536](https://cve.now/CVE-2026-14536.md): Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user c (CVSS 7.3, Devolutions Server)
- [CVE-2026-58402](https://cve.now/CVE-2026-58402.md): Hugo default code block renderer XSS via unescaped code-fence language (CVSS 5.1, gohugoio hugo · github.com/gohugoio/hugo)
- [CVE-2026-11405](https://cve.now/CVE-2026-11405.md): Hidden backdoor authentication mechanism in multiple versions of Tenda firmware allows admin access to web management interface (CVSS 9.8, Tenda firmware)
- [CVE-2026-58404](https://cve.now/CVE-2026-58404.md): Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings (CVSS 4.6, gohugoio hugo · github.com/gohugoio/hugo)
- [CVE-2026-41514](https://cve.now/CVE-2026-41514.md): OP-TEE: RSA-OAEP padding oracle in Hisilicon HPRE driver enables plaintext recovery (CVSS 2.5, OP-TEE optee\_os)
- [CVE-2026-54291](https://cve.now/CVE-2026-54291.md): Silent channel-binding authentication downgrade via unsupported certificate algorithms (CVSS 8.2, pgjdbc · org.postgresql:postgresql)
- [CVE-2026-55379](https://cve.now/CVE-2026-55379.md): Pillow BdfFontFile\`: \`Image.new()\` called without \`\_decompression\_bomb\_check()\` — bomb protection bypass via font loading (CVSS 7.5, python-pillow Pillow · pillow)
- [CVE-2026-55380](https://cve.now/CVE-2026-55380.md): Pillow GdImageFile decompression bomb protection bypass (CVSS 7.5, python-pillow Pillow · pillow)
- [CVE-2026-54060](https://cve.now/CVE-2026-54060.md): Pillow: \`FontFile.compile()\`: \`Image.new()\` called without \`\_decompression\_bomb\_check()\` (CVSS 7.5, python-pillow Pillow · pillow)
- [CVE-2026-54059](https://cve.now/CVE-2026-54059.md): Pillow: PcfFontFile.\_load\_bitmaps()\`: \`Image.frombytes()\` called without \`\_decompression\_bomb\_check()\` — bomb protection bypass via PCF font loading (CVSS 7.5, python-pillow Pillow · pillow)
- [CVE-2026-55798](https://cve.now/CVE-2026-55798.md): Pillow: WindowsViewer.get\_command() OS command injection via unescaped shell path (CVSS 4.5, python-pillow Pillow · pillow)
- [CVE-2026-9181](https://cve.now/CVE-2026-9181.md): Directory Traversal in ArcGIS Server (CVSS 9.8, Esri ArcGIS Server)
- [CVE-2026-9182](https://cve.now/CVE-2026-9182.md): Unvalidated File Upload vulnerability in ArcGIS Server. (CVSS 9.8, Esri ArcGIS Server)
- [CVE-2026-13753](https://cve.now/CVE-2026-13753.md): Certain HP DeskJet All in One – Potential Information Disclosure (CVSS 7.5, HP DeskJet 2820 AIO Printer · HP DeskJet 2823 AIO Print… +45)
- [CVE-2026-12154](https://cve.now/CVE-2026-12154.md): Reviews Widgets for Google, Yelp & TripAdvisor \<= 2.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'page\_id' Shortcode Attribute (CVSS 6.4, widgetpack Reviews Widgets for Google, TripAdvisor, Yelp &…)
- [CVE-2026-41434](https://cve.now/CVE-2026-41434.md): OP-TEE has unbounded recursion in sanitize\_client\_object() (CVSS 3.3, OP-TEE optee\_os)
- [CVE-2026-48614](https://cve.now/CVE-2026-48614.md): An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resu (CVSS 9.9, WebPros Plesk)
- [CVE-2026-40257](https://cve.now/CVE-2026-40257.md): OP-TEE has SHA-3 accelerated finalize heap overflow (CVSS 5.5, OP-TEE optee\_os)
- [CVE-2025-53831](https://cve.now/CVE-2025-53831.md): DrawIO for ownCloud 10 is vulnerable to Stored XSS (CVSS 8.2, DrawIO for ownCloud · ownCloud)
- [CVE-2026-48316](https://cve.now/CVE-2026-48316.md): ColdFusion | Improper Input Validation (CWE-20) (CVSS 10.0, Adobe ColdFusion)
- [CVE-2026-40141](https://cve.now/CVE-2026-40141.md): High-Severity Vulnerability In Web Application Component of BeyondTrust Remote Support and Privileged Remote Access (CVSS 8.5, BeyondTrust Remote Support · BeyondTrust Privilege Remote A…)
- [CVE-2026-40140](https://cve.now/CVE-2026-40140.md): High-Severity Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote Access (CVSS 8.7, BeyondTrust Remote Support · BeyondTrust Privileged Remote…)
- [CVE-2026-40139](https://cve.now/CVE-2026-40139.md): Critical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote Access (CVSS 9.2, BeyondTrust Remote Support · BeyondTrust Privileged Remote…)
- [CVE-2026-40138](https://cve.now/CVE-2026-40138.md): Critical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote Access (CVSS 9.2, BeyondTrust Remote Support · BeyondTrust Privileged Remote…)
- [CVE-2026-43825](https://cve.now/CVE-2026-43825.md): Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModel (CVSS 7.3, Apache Software Foundation Apache OpenNLP :: Core :: ML ::…)
- [CVE-2026-5268](https://cve.now/CVE-2026-5268.md): SFTP Server Authentication Weakness (CVSS 9.1, CIENA 6500 S-Series · CIENA 6500 T-Series +2)
- [CVE-2026-59195](https://cve.now/CVE-2026-59195.md): pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node\_modules/.pnpm-config (CVSS 8.2, pnpm)
- [CVE-2026-59196](https://cve.now/CVE-2026-59196.md): pnpm: hoisted install imports lockfile alias outside node\_modules (CVSS 7.1, pnpm)
- [CVE-2025-53830](https://cve.now/CVE-2025-53830.md): Anti-Virus for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF) (CVSS 9.1, Anti-Virus for ownCloud · ownCloud)
- [CVE-2026-59194](https://cve.now/CVE-2026-59194.md): pnpm: patch-remove could delete project-selected files outside the patches directory (CVSS 7.1, pnpm)
- [CVE-2025-53829](https://cve.now/CVE-2025-53829.md): ownCloud 10 is vulnerable to Relative Path Traversal (CVSS 8.0, ownCloud)
- [CVE-2025-53828](https://cve.now/CVE-2025-53828.md): SharePoint for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF) (CVSS 8.5, owncloud SharePoint · ownCloud)
- [CVE-2026-13122](https://cve.now/CVE-2026-13122.md): OpenVPN version 2.6.0 through 2.6.20 and 2.7\_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authe (CVSS 5.9, OpenVPN)
- [CVE-2025-53827](https://cve.now/CVE-2025-53827.md): ownCloud Core: Updater has an exposed dangerous method or function (CVSS 9.1, ownCloud Core)
- [CVE-2026-59152](https://cve.now/CVE-2026-59152.md): Arbitrary server-side file read in LangSmith SDK TracingMiddleware (CVSS 5.0, langchain-ai langsmith-sdk · langsmith)
- [CVE-2026-58203](https://cve.now/CVE-2026-58203.md): NestedSecretsSettingsSource follows symlinks outside secrets\_dir, enabling local file read and bypassing secrets\_dir\_max\_size (CVSS 5.3, pydantic-settings)
- [CVE-2026-13698](https://cve.now/CVE-2026-13698.md): A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7\_alpha1 through 2.7.4 allows remote attackers with a vali (CVSS 6.0, OpenVPN)
- [CVE-2026-54893](https://cve.now/CVE-2026-54893.md): Email-derived URL path injection in the Swoosh Microsoft Graph adapter (CVSS 2.1, swoosh)
- [CVE-2026-58380](https://cve.now/CVE-2026-58380.md): Gimp: gimp: stack buffer overflow in pnmscanner\_gettoken() (CVSS 7.3, Red Hat Enterprise Linux)
- [CVE-2026-7185](https://cve.now/CVE-2026-7185.md): Unauthorized access to files in T-Systems products (CVSS 6.0, T-Systems Archivo · T-Systems MyTAO +2)
- [CVE-2026-13708](https://cve.now/CVE-2026-13708.md): Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers in i\_readjpeg\_wiol (CVSS 7.5, TONYC Imager::File::JPEG)
- [CVE-2026-13705](https://cve.now/CVE-2026-13705.md): Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read\_rgb\_16\_rle (CVSS 7.1, TONYC Imager)
- [CVE-2025-15668](https://cve.now/CVE-2025-15668.md): GPAC MP4Box box\_code\_base.c sgpd\_del\_entry heap-based overflow (CVSS 4.8, GPAC)
- [CVE-2025-15667](https://cve.now/CVE-2025-15667.md): GPAC MP4Box avc\_ext.c gf\_isom\_nalu\_sample\_rewrite double free (CVSS 4.8, GPAC)
- [CVE-2026-4249](https://cve.now/CVE-2026-4249.md): Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption (CVSS 8.6, WSO2 Universal Gateway · WSO2 Traffic Manager +2)
- [CVE-2025-8591](https://cve.now/CVE-2025-8591.md): Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification (CVSS 6.1, WSO2 Identity Server · WSO2 API Manager +5)
- [CVE-2026-6901](https://cve.now/CVE-2026-6901.md): Untrusted Search Path (CVSS 7.7, B&R Industrial Automation APROL)
- [CVE-2026-49297](https://cve.now/CVE-2026-49297.md): Apache Airflow Google provider: Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOperator + GCSTimeSpanFileTransformOperator) (CVSS 8.1, Apache Software Foundation Apache Airflow Google provider ·…)
- [CVE-2026-6900](https://cve.now/CVE-2026-6900.md): Improper Certificate Validation (CVSS 7.4, B&R Industrial Automation APROL)
- [CVE-2026-44937](https://cve.now/CVE-2026-44937.md): SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components (CVSS 8.3, SUSE Rancher · github.com/rancher/fleet)
- [CVE-2026-46588](https://cve.now/CVE-2026-46588.md): Apache Camel: CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input (CVSS 7.3, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-46587](https://cve.now/CVE-2026-46587.md): Apache Camel: Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input (CVSS 7.3, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-49042](https://cve.now/CVE-2026-49042.md): Apache Camel: langchain4j-tools: filter tool argument headers against declared parameters (CVSS 7.3, Apache Software Foundation Apache Camel · org.apache.cam… +2)
- [CVE-2026-44936](https://cve.now/CVE-2026-44936.md): Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml (CVSS 5.0, SUSE Rancher · github.com/rancher/fleet)
- [CVE-2026-56810](https://cve.now/CVE-2026-56810.md): mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode\_body/5 (CVSS 8.7, elixir-mint mint)
- [CVE-2026-58226](https://cve.now/CVE-2026-58226.md): Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax (CVSS 8.7, elixir-mint hpax)
- [CVE-2026-12686](https://cve.now/CVE-2026-12686.md): Incorrect authorisation in Adiss’s Biloop (CVSS 9.3, Adiss Biloop)
- [CVE-2026-9165](https://cve.now/CVE-2026-9165.md): Stackrox: stackrox: unbounded graphql query depth allows authenticated denial of service (CVSS 7.7, Red Hat Advanced Cluster Security)
- [CVE-2026-44934](https://cve.now/CVE-2026-44934.md): Exposed tokens in SUSE Rancher AI Agent logs (CVSS 7.0, SUSE Rancher)
- [CVE-2026-24013](https://cve.now/CVE-2026-24013.md): Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC (CVSS 9.1, Apache Software Foundation Apache IoTDB · apache-iotdb)
- [CVE-2026-24012](https://cve.now/CVE-2026-24012.md): Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query (CVSS 7.5, Apache Software Foundation Apache IoTDB · apache-iotdb)
- [CVE-2026-43866](https://cve.now/CVE-2026-43866.md): Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder (CVSS 7.3, Apache Software Foundation Apache Camel · org.apache.cam… +5)
- [CVE-2026-24014](https://cve.now/CVE-2026-24014.md): Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write (CVSS 9.8, Apache Software Foundation Apache IoTDB · apache-iotdb)
- [CVE-2026-43867](https://cve.now/CVE-2026-43867.md): Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (CVSS 9.8, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-56140](https://cve.now/CVE-2026-56140.md): Apache Camel AWS2 SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy to align it with sibling components (CVSS 9.8, Apache Software Foundation Apache Camel AWS2 SNS · org.apac…)
- [CVE-2026-56139](https://cve.now/CVE-2026-56139.md): Apache Camel Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients (CVSS 5.3, Apache Software Foundation Apache Camel Undertow · org.apac…)
- [CVE-2026-55994](https://cve.now/CVE-2026-55994.md): Apache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling control over internal behaviour (CVSS 7.5, Apache Software Foundation Apache Camel Iggy · org.apache.c…)
- [CVE-2026-55993](https://cve.now/CVE-2026-55993.md): Apache Camel Atmosphere Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling influencing internal behaviour (CVSS 7.5, Apache Software Foundation Apache Camel Atmosphere Websocke…)
- [CVE-2026-1433](https://cve.now/CVE-2026-1433.md): uniFLOW Universal Login Manager (ULM) Standalone Improper Protection of Sensitive Information Leads to Information Disclosure (CVSS 4.8, NT-ware uniFLOW ULM (Universal Login Manager) Standalone)
- [CVE-2026-53913](https://cve.now/CVE-2026-53913.md): Apache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the token is never verified and any non-null bearer value is accepted (CVSS 9.8, Apache Software Foundation Apache Camel Keycloak · org.apac…)
- [CVE-2026-49365](https://cve.now/CVE-2026-49365.md): Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients (CVSS 5.3, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-49099](https://cve.now/CVE-2026-49099.md): Apache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour (CVSS 5.3, Apache Software Foundation Apache Camel Salesforce · org.ap…)
- [CVE-2026-49098](https://cve.now/CVE-2026-49098.md): Apache Camel: Camel-Kafka: The kafka.OVERRIDE\_TOPIC (and other kafka.\*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter, allowing an HTTP client to redirect Kafka messages to an arbitrary topic (CVSS 5.3, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-49097](https://cve.now/CVE-2026-49097.md): Apache Camel: Camel-IRC: The irc.sendTo (and other irc.\*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to redirect outgoing IRC messages to arbitrary channels or users (CVSS 6.5, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-49086](https://cve.now/CVE-2026-49086.md): Apache Camel Dapr: Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers, allowing an actor who can publish to the subscribed topic to influence internal behaviour (CVSS 6.5, Apache Software Foundation Apache Camel Dapr · org.apache.c…)
- [CVE-2026-48206](https://cve.now/CVE-2026-48206.md): Apache Camel JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to drive arbitrary JIRA issue operations using the endpoint's configured credentials (CVSS 5.3, Apache Software Foundation Apache Camel JIRA · org.apache.c…)
- [CVE-2026-48205](https://cve.now/CVE-2026-48205.md): Apache Camel DNS: The dns.\* and term Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour (CVSS 9.1, Apache Software Foundation Apache Camel DNS · org.apache.ca…)
- [CVE-2026-48204](https://cve.now/CVE-2026-48204.md): Apache Camel: Camel-MongoDB-GridFS: The gridfs.\* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configuration (CVSS 9.8, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-48203](https://cve.now/CVE-2026-48203.md): Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields (CVSS 9.1, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-46726](https://cve.now/CVE-2026-46726.md): Apache Camel Vertx Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers (CVSS 7.5, Apache Software Foundation Apache Camel Vertx Websocket · o…)
- [CVE-2026-46592](https://cve.now/CVE-2026-46592.md): Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation (CVSS 7.5, Apache Software Foundation Apache Camel · org.apache.cam… +1)
- [CVE-2026-46591](https://cve.now/CVE-2026-46591.md): Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169) (CVSS 8.2, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-46590](https://cve.now/CVE-2026-46590.md): Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048) (CVSS 8.8, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-46585](https://cve.now/CVE-2026-46585.md): Apache Camel Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN\_LUCENE\_DOCS) that bypass the HTTP header filter, allowing an HTTP client to inject the full-text search query (CVSS 7.5, Apache Software Foundation Apache Camel Lucene · org.apache…)
- [CVE-2026-46584](https://cve.now/CVE-2026-46584.md): Apache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail session properties, allowing an attacker to influence SMTP parameters (CVSS 3.7, Apache Software Foundation Apache Camel Mail · org.apache.c…)
- [CVE-2026-46457](https://cve.now/CVE-2026-46457.md): Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers (CVSS 7.5, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-46456](https://cve.now/CVE-2026-46456.md): Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers (CVSS 9.8, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-46455](https://cve.now/CVE-2026-46455.md): Apache Camel: Camel-Keycloak: The access-token validity window is not verified because the IS\_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted (CVSS 9.8, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-46454](https://cve.now/CVE-2026-46454.md): Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers (CVSS 9.8, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-46453](https://cve.now/CVE-2026-46453.md): Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation (CVSS 5.3, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-43865](https://cve.now/CVE-2026-43865.md): Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution (CVSS 8.1, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-42527](https://cve.now/CVE-2026-42527.md): Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.\*\* and enables DNS-based information disclosure (CVSS 8.1, Apache Software Foundation Apache Camel · org.apache.ca… +11)
- [CVE-2026-40859](https://cve.now/CVE-2026-40859.md): Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled (CVSS 8.1, Apache Software Foundation Apache Camel · org.apache.cam… +1)
- [CVE-2026-40047](https://cve.now/CVE-2026-40047.md): Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer (CVSS 9.1, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-14809](https://cve.now/CVE-2026-14809.md): PROG MIS｜Prog Management System - SQL Injection (CVSS 8.7, PROG MIS Prog Management System)
- [CVE-2026-14808](https://cve.now/CVE-2026-14808.md): PROG MIS｜Prog Management System - Exposure of Sensitive Information (CVSS 9.3, PROG MIS Prog Management System)
- [CVE-2026-14807](https://cve.now/CVE-2026-14807.md): PROG MIS｜ERP App - Use of Hard-coded Credentials (CVSS 9.3, PROG MIS ERP App)
- [CVE-2026-14802](https://cve.now/CVE-2026-14802.md): react create-react-app react-dev-utils openBrowser.js startBrowserProcess os command injection (CVSS 6.9, create-react-app · react-dev-utils)
- [CVE-2026-14801](https://cve.now/CVE-2026-14801.md): GPAC TeXML File load\_text.c txtin\_probe\_duration divide by zero (CVSS 4.8, GPAC)
- [CVE-2026-14800](https://cve.now/CVE-2026-14800.md): imhamzaazam ecommerceFlask cross-site request forgery (CVSS 5.3, imhamzaazam ecommerceFlask)
- [CVE-2026-6382](https://cve.now/CVE-2026-6382.md): Multiple elFinder Plugins - Authenticated OS Command Injection (CVSS 9.1, FileOrganizer · Advanced File Manager +2)
- [CVE-2026-12083](https://cve.now/CVE-2026-12083.md): Admin and Site Enhancements \< 8.8.4 - Unauthenticated Administrator-Role Restoration via reset-for Parameter (CVSS 8.1, Admin and Site Enhancements · admin-site-enhancements-pro)
- [CVE-2026-11962](https://cve.now/CVE-2026-11962.md): FileOrganizer \< 1.2.0 - Authenticated Arbitrary File Upload via elFinder File Operations (CVSS 8.8, FileOrganizer)
- [CVE-2026-11855](https://cve.now/CVE-2026-11855.md): Simple Membership \< 4.7.5 - Unauthenticated Stored XSS via Stripe Webhook API Version (CVSS 8.8, Simple Membership)
- [CVE-2026-11766](https://cve.now/CVE-2026-11766.md): Ultimate Member \< 2.12.0 - Subscriber+ Stored XSS via Custom Textarea Profile Fields (CVSS 8.0, Ultimate Member)
- [CVE-2026-10830](https://cve.now/CVE-2026-10830.md): AllCoach \< 1.0.2 - Unauthenticated Account Takeover (CVSS 8.8, AllCoach)
- [CVE-2024-6228](https://cve.now/CVE-2024-6228.md): WANotifier \< 2.6 - Subscriber+ LFI (CVSS 7.5, Notifications for Forms & WordPress Actions)
- [CVE-2026-14799](https://cve.now/CVE-2026-14799.md): CodeAstro Ecommerce Website my\_account.php sql injection (CVSS 5.3, CodeAstro Ecommerce Website)
- [CVE-2026-14798](https://cve.now/CVE-2026-14798.md): CodeAstro Apartment Visitor Management System visitor-entry.php sql injection (CVSS 5.3, CodeAstro Apartment Visitor Management System)
- [CVE-2026-14797](https://cve.now/CVE-2026-14797.md): CodeAstro Apartment Visitor Management System edit-apartment.php sql injection (CVSS 5.3, CodeAstro Apartment Visitor Management System)
- [CVE-2026-14796](https://cve.now/CVE-2026-14796.md): CodeAstro Apartment Visitor Management System report.php sql injection (CVSS 5.3, CodeAstro Apartment Visitor Management System)
- [CVE-2026-14795](https://cve.now/CVE-2026-14795.md): CodeAstro Apartment Visitor Management System action-visitor.php sql injection (CVSS 5.3, CodeAstro Apartment Visitor Management System)
- [CVE-2026-14794](https://cve.now/CVE-2026-14794.md): Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization (CVSS 5.3, Craft CMS · craftcms/cms)
- [CVE-2026-14793](https://cve.now/CVE-2026-14793.md): Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization (CVSS 5.3, Craft CMS · craftcms/cms)
- [CVE-2026-14792](https://cve.now/CVE-2026-14792.md): Formbricks Survey actions.ts access control (CVSS 6.9, Formbricks)
- [CVE-2026-14791](https://cve.now/CVE-2026-14791.md): crater-invoice-inc crater Invoice Note InvoicesRequest.php getFormattedString cross site scripting (CVSS 5.1, crater-invoice-inc crater)
- [CVE-2026-14790](https://cve.now/CVE-2026-14790.md): GPAC Media File write\_nhml.c nhmldump\_send\_frame null pointer dereference (CVSS 4.8, GPAC)
- [CVE-2026-14789](https://cve.now/CVE-2026-14789.md): radareorg radare2 Memory64ListStream mdmp.c stack-based overflow (CVSS 4.8, radareorg radare2)
- [CVE-2026-14788](https://cve.now/CVE-2026-14788.md): radareorg radare2 cfile.c r\_core\_bin\_load use after free (CVSS 4.8, radareorg radare2)
- [CVE-2026-14803](https://cve.now/CVE-2026-14803.md): Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder (CVSS 6.5, SRI Mojo::JSON)
- [CVE-2026-14787](https://cve.now/CVE-2026-14787.md): radareorg radare2 pb Print cmd\_print.inc cmd\_print integer overflow (CVSS 4.8, radareorg radare2)
- [CVE-2026-14786](https://cve.now/CVE-2026-14786.md): radareorg radare2 str.c r\_str\_word\_get0set integer overflow (CVSS 4.8, radareorg radare2)
- [CVE-2026-14784](https://cve.now/CVE-2026-14784.md): vxcontrol PentAGI Docker API client.go sandbox (CVSS 5.3, vxcontrol PentAGI)
- [CVE-2026-38973](https://cve.now/CVE-2026-38973.md): mrubyc through release3.4.1 was found to contain an out-of-bounds read in builtin missing-method lookup inside mrbc\_find\_method(). (CVSS 4.4)
- [CVE-2026-38976](https://cve.now/CVE-2026-38976.md): mrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in op\_super() / OP\_SUPER due to a missing runtime guard for (CVSS 7.5)
- [CVE-2026-38979](https://cve.now/CVE-2026-38979.md): ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI. (CVSS 5.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-07-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.