CVEs published July 7, 2026
166 CVEs were published on July 7, 2026: 21 critical, 70 high.
- Published
- 166
- Critical
- 21
- High
- 70
- Medium
- 65
- Low
- 10
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 111
Most affected products
- coollabsio coolify
- 21
- Joomla! Project Joomla! CMS
- 12
- dataease
- 10
- coder · github.com/coder/coder +1
- 7
- Apache Software Foundation Apache Airflow · apache-airflow
- 6
- coder · github.com/coder/coder/v2 +1
- 5
- MicroRealEstate
- 5
- Armiya Information Technologies Ltd. Access Control System
- 4
- gnuwget wget
- 4
- labring FastGPT
- 4
Critical 21
- CVE-2026-59705mem0 - OpenMemory API Unauthenticated Access via Memory Endpointsmem0
- CVE-2026-14740DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL commentHMBRAND DBI
- CVE-2026-14739DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholdersHMBRAND DBI
- CVE-2026-46354Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theftcoder · github.com/coder/coder +1
- CVE-2026-59706mem0 - Unauthenticated Config API Exposure and SSRF via ollama_base_urlmem0
- CVE-2026-59707LocalAI - Server-Side Request Forgery via POST /models/applyLocalAI · github.com/mudler/LocalAI
- CVE-2026-58473Cognee < 1.2.0 Unauthorized LLM Configuration Overwrite via /api/v1/settingstopoteretes cognee · cognee
- CVE-2026-598009Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpointdecolua 9router · 9router
- CVE-2026-13019Missing AuthenticationEsri Portal for ArcGIS
- CVE-2026-53481Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1Dell PowerProtect Data Domain
- CVE-2026-53483Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1Dell PowerProtect Data Domain
- CVE-2011-10043Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loadedBINGOS Module::Load
- CVE-2026-33264Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()Apache Software Foundation Apache Airflow · apache-airflow
- CVE-2026-4375DoLeads Integrator <= 1.2.2 & wp2epub <= 0.65 - Unauthenticated RCEDoLeads Integrator · wp2epub
- CVE-2026-12375Uncanny Automator Pro 7.3.0.5 - Backdoor via Compromised Vendor Update Serveruncanny-automator-pro
- CVE-2026-14345WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parametergetwpfunnels WPFunnels – Funnel Builder for WooCommerce wit…
- CVE-2026-34037Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()coollabsio coolify
- CVE-2026-34048Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team serverscoollabsio coolify
- CVE-2026-34047Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Executioncoollabsio coolify
- CVE-2026-37270Trueview Security camera T18161- AF v4.9.60.0 contains an authentication bypass vulnerability caused by improper password validation and the
- CVE-2026-37271Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, The device accepts GATT Write Request com
High 70
- CVE-2026-55428Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinatorcoder · github.com/coder/coder +1
- CVE-2026-55427Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`coder · github.com/coder/coder +1
- CVE-2026-55077Coder: User-admin role can reset owner account passwordcoder · github.com/coder/coder/v2 +1
- CVE-2026-55076Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linkingcoder · github.com/coder/coder/v2 +1
- CVE-2026-59704Cap - Missing Access Control in Video AI Metadata EndpointCap
- CVE-2026-14895String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of serviceBAKERSCOT String::Util
- CVE-2026-14380DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced ProfileDBI
- CVE-2026-49033Stack-Based Buffer Overflow in Labcenter ProteusLabcenter Proteus
- CVE-2026-42958Use After Free in Labcenter ProteusLabcenter Proteus
- CVE-2026-42953Out-of-bounds write in Labcenter ProteusLabcenter Proteus
- CVE-2026-55075Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypasscoder · github.com/coder/coder +1
- CVE-2026-54602FastGPT: Cross-team LLM request/response disclosure (IDOR) via /api/core/ai/record/getRecordlabring FastGPT
- CVE-2026-54607FastGPT: SSRF in HTTP-tool OpenAPI schema importer via SwaggerParser $ref (bypasses the isInternalAddress guard)labring FastGPT
- CVE-2026-55418FastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure)labring FastGPT
- CVE-2026-55408Koodo Reader: Remote code execution via malicious epub filekoodo-reader
- CVE-2026-49229Actual: Disabled OpenID users keep access through existing session tokensactualbudget actual · @actual-app/sync-server
- CVE-2026-50007Actual: Shared users can perform owner-only file management actionsactualbudget actual
- CVE-2026-49471Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCEoraios serena · serena-agent
- CVE-2026-53511calibre: Arbitrary Code Execution in Template Formatter via Book Metadatakovidgoyal calibre
- CVE-2026-50530DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasetsdataease
- CVE-2026-50529DataEase: Link Token Leakage Prior to Share Password/Ticket Validationdataease
- CVE-2026-55635DataEase: Authenticated SQL Injection in Chart Quota Filtersdataease
- CVE-2026-58583FluxInk Color Management Driver local privilege escalationFluxInk Color Management Driver
- CVE-2026-57172DataEase: Hardcoded JWT Signing Secret in ShareLinkdataease
- CVE-2026-53751DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE)dataease
- CVE-2026-53730DataEase: Unauthorized Access to Engine Database via previewSql Endpointdataease
- CVE-2026-55633DataEase H2 RCE via Zip Protocol & File Dropper Fix bypassdataease
- CVE-2026-55631DataEase: Path Traversal Leading to Arbitrary File Deletion via Font Managementdataease
- CVE-2026-53729DataEase ExportCenter IDOR allows cross-user export task accessdataease
- CVE-2026-44454Coder vulnerable to workspace auto-creation via crafted URL parameters without user consentcoder · github.com/coder/coder/v2 +1
- CVE-2026-58469GNU Wget 1.25.0 Heap Buffer Underread via Metalink URL Parsinggnuwget wget
- CVE-2026-59708Ghostfolio - Unauthorized Portfolio Data Exposure via Public Endpointghostfolio
- CVE-2026-7017HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targetsHAARG HTTP::Tiny
- CVE-2026-13020Weak Password Recovery Mechanism in Portal for ArcGISEsri Portal for ArcGIS
- CVE-2026-14904RES Auth.GetUserPrivateKey Arbitrary File ReadAWS res
- CVE-2026-23697Vtiger CRM < 8.4.0 Authenticated File Upload RCE via Documents ModuleVtiger CRM
- CVE-2026-23698Vtiger CRM 8.4.0 Authenticated RCE via Module Import File UploadVtiger CRM
- CVE-2026-57851MSI KernCoreLib64.sys Privilege Escalation via IOCTL HandlersMicro-Star International (MSI) KernCoreLib64.sys
- CVE-2026-56811Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of servicephoenixframework phoenix · phoenix
- CVE-2026-6101AMP for WP <= 1.1.12 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font Uploadmohammed_kaludi AMP for WP – Accelerated Mobile Pages
- CVE-2026-53479Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1Dell PowerProtect Data Domain
- CVE-2026-44938Fleet has PSS Bypass through addLabelsFromOptions in Fleet AgentSUSE Rancher · github.com/rancher/fleet
- CVE-2026-13696LDAP Injection in HAVELSAN's Liman MYSHAVELSAN Liman MYS
- CVE-2026-11348Authentication Bypass in HAVELSAN's Open Source Project Liman MYSHAVELSAN Liman MYS
- CVE-2026-11340Authorization Bypass in HAVELSAN's Open Source Project Liman MYSHAVELSAN Liman MYS
- CVE-2026-14868Weak encryption mechanism for User directoryarcinfo PcVue
- CVE-2026-11610389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind389ds 389-ds-base · Red Hat Directory Server 11.5 E4S fo… +6
- CVE-2026-14476Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypassRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-14474Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalationRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-58384Gimp: gimp: integer overflow in read_rle_channel()Red Hat Enterprise Linux
- CVE-2026-8377Improper Authorization in Armiya Technologies' Access Control SystemArmiya Information Technologies Ltd. Access Control System
- CVE-2026-5799IDOR in Idvlabs' OntimeIdvlabs Software and Consulting Services Ontime
- CVE-2026-5730IDOR in Idvlabs' OntimeIdvlabs Software and Consulting Services Ontime
- CVE-2026-12277Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Deletion via Saved File Metadata Path TraversalFrontend File Manager Plugin
- CVE-2026-57871Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files.MicroRealEstate
- CVE-2026-57869Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers tMicroRealEstate
- CVE-2026-57868MicroRealEstate is affected by broken object-level access controls in PDF generator functionality.MicroRealEstate
- CVE-2026-57867MicroRealEstate allows adversaries to bypass authentication due to a lack of token state management.MicroRealEstate
- CVE-2026-34158Coolify: Command injection via single-quote breakout in Docker Compose custom commandscoollabsio coolify
- CVE-2026-34057Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Namecoollabsio coolify
- CVE-2026-42143Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Serverscoollabsio coolify
- CVE-2026-34044Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped)coollabsio coolify
- CVE-2026-34152Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport)coollabsio coolify
- CVE-2026-34171Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known valuecoollabsio coolify
- CVE-2026-34034Coolify: Host RCE via Sentinel token injectioncoollabsio coolify
- CVE-2026-34168Coolify: Command injection via unsanitized persistent storage name in docker volume commandscoollabsio coolify
- CVE-2026-34058Coolify: OS Command Injection via Unmanaged Container Operations - Remote Code Executioncoollabsio coolify
- CVE-2026-34035Coolify: Host RCE via Log Drain secret/env command injectioncoollabsio coolify
- CVE-2026-42200Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCEcoollabsio coolify
- CVE-2026-51937An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, JsApiTicketComponent.jav
Medium, low and unrated 75
- CVE-2026-55079Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of servicecoder · github.com/coder/coder/v2 +1
- CVE-2026-55078Coder: Zip upload decompression lacks aggregate size limit, enabling denial of servicecoder · github.com/coder/coder +1
- CVE-2026-54698Hasura: Row-level authorization bypass on table computed fieldshasura graphql-engine
- CVE-2026-54601FastGPT: reTrainingCollection allows server-owned datasetId override causing cross-tenant authorization confusionlabring FastGPT
- CVE-2026-58266Anki: User scripts in iframes have access to the internal Anki APIankitects anki · aqt
- CVE-2026-59153Anki's local HTTP server does not sufficiently validate requestsankitects anki · aqt
- CVE-2026-55490OpenWrt: EAD Integer Underflow → Pre-Auth Denial of Serviceopenwrt
- CVE-2026-28378Cross-Organization Public Dashboard Deletion via Missing Org IsolationGrafana Enterprise · Grafana OSS
- CVE-2026-45796Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpointcoder · github.com/coder/coder/v2 +1
- CVE-2026-50179Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fieldsactualbudget actual · @actual-app/web
- CVE-2026-46700Actual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secretsactualbudget actual · @actual-app/sync-server
- CVE-2026-46672Actual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` Helperactualbudget actual · @actual-app/cli
- CVE-2026-55592Dashy: XSS in workspace url parameterlissy93 dashy
- CVE-2026-53935CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translationcilium · github.com/cilium/cilium
- CVE-2026-55647DataEase: authenticated stored XSS in the dashboard text componentsdataease
- CVE-2026-55434Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpointscoder · github.com/coder/coder +1
- CVE-2026-55417Chevereto private profile setting leaks username on /json endpointchevereto · chevereto/chevereto +1
- CVE-2026-58472GNU Wget 1.25.0 Heap Buffer Overflow via HTML Attribute Encodinggnuwget wget
- CVE-2026-58471GNU Wget 1.25.0 Heap Buffer Overflow via convert_fname() in url.cgnuwget wget
- CVE-2026-58470GNU Wget 1.25.0 Integer Overflow via Content-Range Header Parsinggnuwget wget
- CVE-2026-58468NocoBase 2.1.20 Server-Side Request Forgery via serverRequest wrappernocobase
- CVE-2026-44877Unauthenticated Remote Disclosure of Cryptographic SecretsHewlett Packard Enterprise (HPE) HPE Networking Instant On
- CVE-2026-55435Suspended Coder users retain access to AI Bridge LLM proxy endpointscoder · github.com/coder/coder +1
- CVE-2026-48952Joomla! Core - [20260706] - XSS in com_installerJoomla! Project Joomla! CMS
- CVE-2026-48947Joomla! Core - [20260701] - Incorrect Access Control in com_media webservice endpointsJoomla! Project Joomla! CMS
- CVE-2026-48958Joomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpointsJoomla! Project Joomla! CMS
- CVE-2026-48950Joomla! Core - [20260704] - XSS in com_templatesJoomla! Project Joomla! CMS
- CVE-2026-48955Joomla! Core - [20260709] - Incorrect Access Control in com_workflowJoomla! Project Joomla! CMS
- CVE-2026-48956Joomla! Core - [20260710] - Incorrect Access Control in com_modulesJoomla! Project Joomla! CMS
- CVE-2026-48957Joomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpointsJoomla! Project Joomla! CMS
- CVE-2026-48951Joomla! Core - [20260705] - XSS in various modalreturn layoutsJoomla! Project Joomla! CMS
- CVE-2026-48953Joomla! Core - [20260707] - XSS in the generic image output layoutJoomla! Project Joomla! CMS
- CVE-2026-48948Joomla! Core - [20260702] - Incorrect Access Control in com_contact vcf downloadJoomla! Project Joomla! CMS
- CVE-2026-48949Joomla! Core - [20260703] - XSS in MFA method managementJoomla! Project Joomla! CMS
- CVE-2026-48954Joomla! Core - [20260708] - XSS through language overridesJoomla! Project Joomla! CMS
- CVE-2025-12799Jastow: jastow cross-site scripting attack due to unsanitized uriRed Hat JBoss Enterprise Application Platform 8.1.7.GA ·… +2
- CVE-2026-14969389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryptionRed Hat Directory Server · Red Hat Enterprise Linux
- CVE-2026-14935Gstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence checkRed Hat Enterprise Linux
- CVE-2026-56812Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiffphoenixframework phoenix · phoenix
- CVE-2026-12948Stored Cross-Site Scripting (XSS)Digi International Digi PortServer TS · Digi Internation… +1
- CVE-2026-12352Incorrect AuthorizationDigi International PortServer TS 1/2/4 · Digi International…
- CVE-2026-59709Ghostfolio - Unauthorized Portfolio Holding Tag Modification via Missing Permission CheckGhostfolio
- CVE-2026-53878Header injection possibility since DomainNameValidator accepted newlines in inputdjangoproject Django · django
- CVE-2026-53877Heap buffer over-read in GDALRasterdjangoproject Django · django
- CVE-2026-48588Potential exposure of private data via cached Set-Cookie responsedjangoproject Django · django
- CVE-2026-14940389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdnRed Hat Directory Server · Red Hat Enterprise Linux
- CVE-2026-10659NULL pointer dereference in Zephyr Dhara FTL disk driver on flash read error during journal resumezephyrproject zephyr
- CVE-2026-14867Insecure password storage in User directoryarcinfo PcVue
- CVE-2026-49487Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargsApache Software Foundation Apache Airflow · apache-airflow
- CVE-2026-48828Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the keyApache Software Foundation Apache Airflow · apache-airflow
- CVE-2026-49296Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id}Apache Software Foundation Apache Airflow · apache-airflow
- CVE-2026-48891Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.targetApache Software Foundation Apache Airflow · apache-airflow
- CVE-2026-48892Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic optionsApache Software Foundation Apache Airflow · apache-airflow
- CVE-2026-13199Insufficient Entropy in Raspberry Pi 5 and Compute Module 5Raspberry Pi 5 and Compute Module
- CVE-2026-8309Reflected XSS in Armiya Technologies' Access Control SystemArmiya Information Technologies Ltd. Access Control System
- CVE-2026-8306Stored XSS in Armiya Technologies' Access Control SystemArmiya Information Technologies Ltd. Access Control System
- CVE-2026-7380HTML Injection in Armiya Technologies' Access Control SystemArmiya Information Technologies Ltd. Access Control System
- CVE-2026-10834WP Travel Engine < 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_imageWP Travel Engine
- CVE-2026-58315Cross-site request forgery vulnerability exists in SEIKO EPSON Web Config.SEIKO EPSON Web Config
- CVE-2026-57870Broken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document templates used by other orgaMicroRealEstate
- CVE-2026-27844Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operGallagher Controller 7000 and
- CVE-2026-27790Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific reqGallagher T-20 Readers
- CVE-2026-26053An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileGallagher Command Centre Server
- CVE-2026-42201Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commandscoollabsio coolify
- CVE-2026-34170Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URLcoollabsio coolify
- CVE-2026-42147Coolify: SSRF via S3 Storage Endpoint in testConnection()coollabsio coolify
- CVE-2026-34149Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobscoollabsio coolify
- CVE-2026-42145Coolify: File Upload Without Type or Size Validation in Database Backup Restorecoollabsio coolify
- CVE-2026-34198Coolify: Password reset link poisoning via X-Forwarded-Host header spoofingcoollabsio coolify
- CVE-2026-42172Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Accesscoollabsio coolify
- CVE-2026-11328Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Titletimstrifler Exclusive Addons for Elementor
- CVE-2026-36162An authenticated stored cross-site scripting (XSS) vulnerability in the Upload File Shares API of LiquidFiles v4.2.7 allows attackers to exe
- CVE-2026-36163An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScri
- CVE-2026-50810A NULL pointer dereference in smooth_parse_stream_index() in src/media_tools/mpd.c in GPAC master HEAD before commit b35c61f104b85fbb16520ac
- CVE-2026-50811An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/tru