# CVEs published 2026-07-07

166 CVEs were published on July 7, 2026: 21 critical, 70 high. Days are UTC.

- [CVE-2026-55428](https://cve.now/CVE-2026-55428.md): Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator (CVSS 8.2, coder · github.com/coder/coder +1)
- [CVE-2026-55427](https://cve.now/CVE-2026-55427.md): Coder vulnerable to SSH config injection via unsanitized server-supplied values in \`coder config-ssh\` (CVSS 8.3, coder · github.com/coder/coder +1)
- [CVE-2026-55079](https://cve.now/CVE-2026-55079.md): Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service (CVSS 4.9, coder · github.com/coder/coder/v2 +1)
- [CVE-2026-55078](https://cve.now/CVE-2026-55078.md): Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service (CVSS 6.5, coder · github.com/coder/coder +1)
- [CVE-2026-55077](https://cve.now/CVE-2026-55077.md): Coder: User-admin role can reset owner account password (CVSS 7.2, coder · github.com/coder/coder/v2 +1)
- [CVE-2026-55076](https://cve.now/CVE-2026-55076.md): Coder's OIDC email\_verified type coercion bypass enables account takeover via unverified email linking (CVSS 7.4, coder · github.com/coder/coder/v2 +1)
- [CVE-2026-59704](https://cve.now/CVE-2026-59704.md): Cap - Missing Access Control in Video AI Metadata Endpoint (CVSS 7.1, Cap)
- [CVE-2026-14895](https://cve.now/CVE-2026-14895.md): String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service (CVSS 7.5, BAKERSCOT String::Util)
- [CVE-2026-59705](https://cve.now/CVE-2026-59705.md): mem0 - OpenMemory API Unauthenticated Access via Memory Endpoints (CVSS 9.3, mem0)
- [CVE-2026-14740](https://cve.now/CVE-2026-14740.md): DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment (CVSS 9.1, HMBRAND DBI)
- [CVE-2026-14739](https://cve.now/CVE-2026-14739.md): DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders (CVSS 9.8, HMBRAND DBI)
- [CVE-2026-14380](https://cve.now/CVE-2026-14380.md): DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile (CVSS 8.8, DBI)
- [CVE-2026-49033](https://cve.now/CVE-2026-49033.md): Stack-Based Buffer Overflow in Labcenter Proteus (CVSS 8.4, Labcenter Proteus)
- [CVE-2026-42958](https://cve.now/CVE-2026-42958.md): Use After Free in Labcenter Proteus (CVSS 8.4, Labcenter Proteus)
- [CVE-2026-42953](https://cve.now/CVE-2026-42953.md): Out-of-bounds write in Labcenter Proteus (CVSS 8.4, Labcenter Proteus)
- [CVE-2026-55075](https://cve.now/CVE-2026-55075.md): Coder vulnerable to OIDC account takeover via email-based user matching and email\_verified bypass (CVSS 7.4, coder · github.com/coder/coder +1)
- [CVE-2026-54698](https://cve.now/CVE-2026-54698.md): Hasura: Row-level authorization bypass on table computed fields (CVSS 6.0, hasura graphql-engine)
- [CVE-2026-54602](https://cve.now/CVE-2026-54602.md): FastGPT: Cross-team LLM request/response disclosure (IDOR) via /api/core/ai/record/getRecord (CVSS 7.1, labring FastGPT)
- [CVE-2026-54607](https://cve.now/CVE-2026-54607.md): FastGPT: SSRF in HTTP-tool OpenAPI schema importer via SwaggerParser $ref (bypasses the isInternalAddress guard) (CVSS 7.7, labring FastGPT)
- [CVE-2026-55418](https://cve.now/CVE-2026-55418.md): FastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure) (CVSS 8.6, labring FastGPT)
- [CVE-2026-54601](https://cve.now/CVE-2026-54601.md): FastGPT: reTrainingCollection allows server-owned datasetId override causing cross-tenant authorization confusion (CVSS 6.3, labring FastGPT)
- [CVE-2026-58266](https://cve.now/CVE-2026-58266.md): Anki: User scripts in iframes have access to the internal Anki API (CVSS 6.5, ankitects anki · aqt)
- [CVE-2026-59153](https://cve.now/CVE-2026-59153.md): Anki's local HTTP server does not sufficiently validate requests (CVSS 2.1, ankitects anki · aqt)
- [CVE-2026-46354](https://cve.now/CVE-2026-46354.md): Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft (CVSS 9.1, coder · github.com/coder/coder +1)
- [CVE-2026-55490](https://cve.now/CVE-2026-55490.md): OpenWrt: EAD Integer Underflow → Pre-Auth Denial of Service (CVSS 6.5, openwrt)
- [CVE-2026-28378](https://cve.now/CVE-2026-28378.md): Cross-Organization Public Dashboard Deletion via Missing Org Isolation (CVSS 3.1, Grafana Enterprise · Grafana OSS)
- [CVE-2026-45796](https://cve.now/CVE-2026-45796.md): Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint (CVSS 6.5, coder · github.com/coder/coder/v2 +1)
- [CVE-2026-55408](https://cve.now/CVE-2026-55408.md): Koodo Reader: Remote code execution via malicious epub file (CVSS 8.4, koodo-reader)
- [CVE-2026-59706](https://cve.now/CVE-2026-59706.md): mem0 - Unauthenticated Config API Exposure and SSRF via ollama\_base\_url (CVSS 9.2, mem0)
- [CVE-2026-49229](https://cve.now/CVE-2026-49229.md): Actual: Disabled OpenID users keep access through existing session tokens (CVSS 8.3, actualbudget actual · @actual-app/sync-server)
- [CVE-2026-50179](https://cve.now/CVE-2026-50179.md): Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields (CVSS 4.2, actualbudget actual · @actual-app/web)
- [CVE-2026-46700](https://cve.now/CVE-2026-46700.md): Actual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets (CVSS 4.3, actualbudget actual · @actual-app/sync-server)
- [CVE-2026-46672](https://cve.now/CVE-2026-46672.md): Actual: CSV Formula Injection in \`@actual-app/cli\` \`--format csv\` Output via Custom \`escapeCsv\` Helper (CVSS 4.6, actualbudget actual · @actual-app/cli)
- [CVE-2026-50007](https://cve.now/CVE-2026-50007.md): Actual: Shared users can perform owner-only file management actions (CVSS 7.2, actualbudget actual)
- [CVE-2026-49471](https://cve.now/CVE-2026-49471.md): Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE (CVSS 8.3, oraios serena · serena-agent)
- [CVE-2026-55592](https://cve.now/CVE-2026-55592.md): Dashy: XSS in workspace url parameter (CVSS 3.9, lissy93 dashy)
- [CVE-2026-53511](https://cve.now/CVE-2026-53511.md): calibre: Arbitrary Code Execution in Template Formatter via Book Metadata (CVSS 8.5, kovidgoyal calibre)
- [CVE-2026-53935](https://cve.now/CVE-2026-53935.md): CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation (CVSS 6.9, cilium · github.com/cilium/cilium)
- [CVE-2026-50530](https://cve.now/CVE-2026-50530.md): DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets (CVSS 7.1, dataease)
- [CVE-2026-50529](https://cve.now/CVE-2026-50529.md): DataEase: Link Token Leakage Prior to Share Password/Ticket Validation (CVSS 8.7, dataease)
- [CVE-2026-55647](https://cve.now/CVE-2026-55647.md): DataEase: authenticated stored XSS in the dashboard text components (CVSS 5.1, dataease)
- [CVE-2026-59707](https://cve.now/CVE-2026-59707.md): LocalAI - Server-Side Request Forgery via POST /models/apply (CVSS 9.2, LocalAI · github.com/mudler/LocalAI)
- [CVE-2026-55635](https://cve.now/CVE-2026-55635.md): DataEase: Authenticated SQL Injection in Chart Quota Filters (CVSS 8.7, dataease)
- [CVE-2026-58473](https://cve.now/CVE-2026-58473.md): Cognee \< 1.2.0 Unauthorized LLM Configuration Overwrite via /api/v1/settings (CVSS 9.3, topoteretes cognee · cognee)
- [CVE-2026-58583](https://cve.now/CVE-2026-58583.md): FluxInk Color Management Driver local privilege escalation (CVSS 7.1, FluxInk Color Management Driver)
- [CVE-2026-57172](https://cve.now/CVE-2026-57172.md): DataEase: Hardcoded JWT Signing Secret in ShareLink (CVSS 8.3, dataease)
- [CVE-2026-53751](https://cve.now/CVE-2026-53751.md): DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE) (CVSS 8.7, dataease)
- [CVE-2026-53730](https://cve.now/CVE-2026-53730.md): DataEase: Unauthorized Access to Engine Database via previewSql Endpoint (CVSS 8.7, dataease)
- [CVE-2026-55633](https://cve.now/CVE-2026-55633.md): DataEase H2 RCE via Zip Protocol & File Dropper Fix bypass (CVSS 8.7, dataease)
- [CVE-2026-55631](https://cve.now/CVE-2026-55631.md): DataEase: Path Traversal Leading to Arbitrary File Deletion via Font Management (CVSS 7.2, dataease)
- [CVE-2026-53729](https://cve.now/CVE-2026-53729.md): DataEase ExportCenter IDOR allows cross-user export task access (CVSS 8.7, dataease)
- [CVE-2026-44454](https://cve.now/CVE-2026-44454.md): Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent (CVSS 8.1, coder · github.com/coder/coder/v2 +1)
- [CVE-2026-55434](https://cve.now/CVE-2026-55434.md): Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints (CVSS 6.5, coder · github.com/coder/coder +1)
- [CVE-2026-55417](https://cve.now/CVE-2026-55417.md): Chevereto private profile setting leaks username on /json endpoint (CVSS 6.9, chevereto · chevereto/chevereto +1)
- [CVE-2026-58472](https://cve.now/CVE-2026-58472.md): GNU Wget 1.25.0 Heap Buffer Overflow via HTML Attribute Encoding (CVSS 6.0, gnuwget wget)
- [CVE-2026-58471](https://cve.now/CVE-2026-58471.md): GNU Wget 1.25.0 Heap Buffer Overflow via convert\_fname() in url.c (CVSS 6.0, gnuwget wget)
- [CVE-2026-58470](https://cve.now/CVE-2026-58470.md): GNU Wget 1.25.0 Integer Overflow via Content-Range Header Parsing (CVSS 6.9, gnuwget wget)
- [CVE-2026-58469](https://cve.now/CVE-2026-58469.md): GNU Wget 1.25.0 Heap Buffer Underread via Metalink URL Parsing (CVSS 8.7, gnuwget wget)
- [CVE-2026-58468](https://cve.now/CVE-2026-58468.md): NocoBase 2.1.20 Server-Side Request Forgery via serverRequest wrapper (CVSS 5.1, nocobase)
- [CVE-2026-44877](https://cve.now/CVE-2026-44877.md): Unauthenticated Remote Disclosure of Cryptographic Secrets (CVSS 6.5, Hewlett Packard Enterprise (HPE) HPE Networking Instant On)
- [CVE-2026-59708](https://cve.now/CVE-2026-59708.md): Ghostfolio - Unauthorized Portfolio Data Exposure via Public Endpoint (CVSS 8.7, ghostfolio)
- [CVE-2026-59800](https://cve.now/CVE-2026-59800.md): 9Router \< 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint (CVSS 9.2, decolua 9router · 9router)
- [CVE-2026-7017](https://cve.now/CVE-2026-7017.md): HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets (CVSS 7.1, HAARG HTTP::Tiny)
- [CVE-2026-55435](https://cve.now/CVE-2026-55435.md): Suspended Coder users retain access to AI Bridge LLM proxy endpoints (CVSS 5.4, coder · github.com/coder/coder +1)
- [CVE-2026-48952](https://cve.now/CVE-2026-48952.md): Joomla! Core - \[20260706\] - XSS in com\_installer (CVSS 5.9, Joomla! Project Joomla! CMS)
- [CVE-2026-48947](https://cve.now/CVE-2026-48947.md): Joomla! Core - \[20260701\] - Incorrect Access Control in com\_media webservice endpoints (CVSS 6.4, Joomla! Project Joomla! CMS)
- [CVE-2026-48958](https://cve.now/CVE-2026-48958.md): Joomla! Core - \[20260712\] - Incorrect Access Control in com\_fields webservice endpoints (CVSS 6.4, Joomla! Project Joomla! CMS)
- [CVE-2026-48950](https://cve.now/CVE-2026-48950.md): Joomla! Core - \[20260704\] - XSS in com\_templates (CVSS 5.9, Joomla! Project Joomla! CMS)
- [CVE-2026-48955](https://cve.now/CVE-2026-48955.md): Joomla! Core - \[20260709\] - Incorrect Access Control in com\_workflow (CVSS 6.4, Joomla! Project Joomla! CMS)
- [CVE-2026-48956](https://cve.now/CVE-2026-48956.md): Joomla! Core - \[20260710\] - Incorrect Access Control in com\_modules (CVSS 6.4, Joomla! Project Joomla! CMS)
- [CVE-2026-48957](https://cve.now/CVE-2026-48957.md): Joomla! Core - \[20260711\] - Incorrect Access Control in com\_privacy webservice endpoints (CVSS 6.4, Joomla! Project Joomla! CMS)
- [CVE-2026-48951](https://cve.now/CVE-2026-48951.md): Joomla! Core - \[20260705\] - XSS in various modalreturn layouts (CVSS 5.9, Joomla! Project Joomla! CMS)
- [CVE-2026-48953](https://cve.now/CVE-2026-48953.md): Joomla! Core - \[20260707\] - XSS in the generic image output layout (CVSS 5.9, Joomla! Project Joomla! CMS)
- [CVE-2026-48948](https://cve.now/CVE-2026-48948.md): Joomla! Core - \[20260702\] - Incorrect Access Control in com\_contact vcf download (CVSS 6.4, Joomla! Project Joomla! CMS)
- [CVE-2026-48949](https://cve.now/CVE-2026-48949.md): Joomla! Core - \[20260703\] - XSS in MFA method management (CVSS 5.9, Joomla! Project Joomla! CMS)
- [CVE-2026-48954](https://cve.now/CVE-2026-48954.md): Joomla! Core - \[20260708\] - XSS through language overrides (CVSS 5.9, Joomla! Project Joomla! CMS)
- [CVE-2026-13019](https://cve.now/CVE-2026-13019.md): Missing Authentication (CVSS 9.8, Esri Portal for ArcGIS)
- [CVE-2026-13020](https://cve.now/CVE-2026-13020.md): Weak Password Recovery Mechanism in Portal for ArcGIS (CVSS 8.1, Esri Portal for ArcGIS)
- [CVE-2026-14904](https://cve.now/CVE-2026-14904.md): RES Auth.GetUserPrivateKey Arbitrary File Read (CVSS 7.1, AWS res)
- [CVE-2025-12799](https://cve.now/CVE-2025-12799.md): Jastow: jastow cross-site scripting attack due to unsanitized uri (CVSS 6.5, Red Hat JBoss Enterprise Application Platform 8.1.7.GA ·… +2)
- [CVE-2026-23697](https://cve.now/CVE-2026-23697.md): Vtiger CRM \< 8.4.0 Authenticated File Upload RCE via Documents Module (CVSS 8.7, Vtiger CRM)
- [CVE-2026-23698](https://cve.now/CVE-2026-23698.md): Vtiger CRM 8.4.0 Authenticated RCE via Module Import File Upload (CVSS 8.6, Vtiger CRM)
- [CVE-2026-57851](https://cve.now/CVE-2026-57851.md): MSI KernCoreLib64.sys Privilege Escalation via IOCTL Handlers (CVSS 8.5, Micro-Star International (MSI) KernCoreLib64.sys)
- [CVE-2026-14969](https://cve.now/CVE-2026-14969.md): 389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption (CVSS 4.4, Red Hat Directory Server · Red Hat Enterprise Linux)
- [CVE-2026-14935](https://cve.now/CVE-2026-14935.md): Gstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence check (CVSS 3.7, Red Hat Enterprise Linux)
- [CVE-2026-56812](https://cve.now/CVE-2026-56812.md): Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff (CVSS 6.3, phoenixframework phoenix · phoenix)
- [CVE-2026-56811](https://cve.now/CVE-2026-56811.md): Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service (CVSS 8.7, phoenixframework phoenix · phoenix)
- [CVE-2026-12948](https://cve.now/CVE-2026-12948.md): Stored Cross-Site Scripting (XSS) (CVSS 4.8, Digi International Digi PortServer TS · Digi Internation… +1)
- [CVE-2026-12352](https://cve.now/CVE-2026-12352.md): Incorrect Authorization (CVSS 5.9, Digi International PortServer TS 1/2/4 · Digi International…)
- [CVE-2026-59709](https://cve.now/CVE-2026-59709.md): Ghostfolio - Unauthorized Portfolio Holding Tag Modification via Missing Permission Check (CVSS 5.3, Ghostfolio)
- [CVE-2026-53878](https://cve.now/CVE-2026-53878.md): Header injection possibility since DomainNameValidator accepted newlines in input (CVSS 6.1, djangoproject Django · django)
- [CVE-2026-53877](https://cve.now/CVE-2026-53877.md): Heap buffer over-read in GDALRaster (CVSS 4.8, djangoproject Django · django)
- [CVE-2026-48588](https://cve.now/CVE-2026-48588.md): Potential exposure of private data via cached Set-Cookie response (CVSS 4.2, djangoproject Django · django)
- [CVE-2026-14940](https://cve.now/CVE-2026-14940.md): 389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn (CVSS 5.3, Red Hat Directory Server · Red Hat Enterprise Linux)
- [CVE-2026-6101](https://cve.now/CVE-2026-6101.md): AMP for WP \<= 1.1.12 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font Upload (CVSS 7.5, mohammed\_kaludi AMP for WP – Accelerated Mobile Pages)
- [CVE-2026-53479](https://cve.now/CVE-2026-53479.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1 (CVSS 7.2, Dell PowerProtect Data Domain)
- [CVE-2026-44938](https://cve.now/CVE-2026-44938.md): Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent (CVSS 8.8, SUSE Rancher · github.com/rancher/fleet)
- [CVE-2026-53481](https://cve.now/CVE-2026-53481.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1 (CVSS 9.8, Dell PowerProtect Data Domain)
- [CVE-2026-10659](https://cve.now/CVE-2026-10659.md): NULL pointer dereference in Zephyr Dhara FTL disk driver on flash read error during journal resume (CVSS 4.7, zephyrproject zephyr)
- [CVE-2026-53483](https://cve.now/CVE-2026-53483.md): Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1 (CVSS 9.8, Dell PowerProtect Data Domain)
- [CVE-2011-10043](https://cve.now/CVE-2011-10043.md): Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded (CVSS 9.8, BINGOS Module::Load)
- [CVE-2026-13696](https://cve.now/CVE-2026-13696.md): LDAP Injection in HAVELSAN's Liman MYS (CVSS 8.8, HAVELSAN Liman MYS)
- [CVE-2026-11348](https://cve.now/CVE-2026-11348.md): Authentication Bypass in HAVELSAN's Open Source Project Liman MYS (CVSS 8.1, HAVELSAN Liman MYS)
- [CVE-2026-11340](https://cve.now/CVE-2026-11340.md): Authorization Bypass in HAVELSAN's Open Source Project Liman MYS (CVSS 8.3, HAVELSAN Liman MYS)
- [CVE-2026-14868](https://cve.now/CVE-2026-14868.md): Weak encryption mechanism for User directory (CVSS 8.4, arcinfo PcVue)
- [CVE-2026-14867](https://cve.now/CVE-2026-14867.md): Insecure password storage in User directory (CVSS 6.8, arcinfo PcVue)
- [CVE-2026-33264](https://cve.now/CVE-2026-33264.md): Apache Airflow: DAG author RCE on webserver via unrestricted import\_string() in BaseSerialization.deserialize() (CVSS 9.8, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-49487](https://cve.now/CVE-2026-49487.md): Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs (CVSS 6.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-48828](https://cve.now/CVE-2026-48828.md): Apache Airflow: Bulk JSON Variables bypass should\_hide\_value\_for\_key - redact() called without the key (CVSS 6.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-49296](https://cve.now/CVE-2026-49296.md): Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag\_id} (CVSS 6.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-11610](https://cve.now/CVE-2026-11610.md): 389-ds-base: 389-ds-base: heap buffer overflow in sasl\_io\_recv() via padded sasl unbind (CVSS 8.8, 389ds 389-ds-base · Red Hat Directory Server 11.5 E4S fo… +6)
- [CVE-2026-48891](https://cve.now/CVE-2026-48891.md): Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target (CVSS 4.3, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-48892](https://cve.now/CVE-2026-48892.md): Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options (CVSS 6.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-14476](https://cve.now/CVE-2026-14476.md): Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass (CVSS 8.0, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-14474](https://cve.now/CVE-2026-14474.md): Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation (CVSS 8.8, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-13199](https://cve.now/CVE-2026-13199.md): Insufficient Entropy in Raspberry Pi 5 and Compute Module 5 (CVSS 5.1, Raspberry Pi 5 and Compute Module)
- [CVE-2026-58384](https://cve.now/CVE-2026-58384.md): Gimp: gimp: integer overflow in read\_rle\_channel() (CVSS 7.3, Red Hat Enterprise Linux)
- [CVE-2026-8377](https://cve.now/CVE-2026-8377.md): Improper Authorization in Armiya Technologies' Access Control System (CVSS 8.2, Armiya Information Technologies Ltd. Access Control System)
- [CVE-2026-8309](https://cve.now/CVE-2026-8309.md): Reflected XSS in Armiya Technologies' Access Control System (CVSS 5.4, Armiya Information Technologies Ltd. Access Control System)
- [CVE-2026-8306](https://cve.now/CVE-2026-8306.md): Stored XSS in Armiya Technologies' Access Control System (CVSS 6.1, Armiya Information Technologies Ltd. Access Control System)
- [CVE-2026-7380](https://cve.now/CVE-2026-7380.md): HTML Injection in Armiya Technologies' Access Control System (CVSS 6.1, Armiya Information Technologies Ltd. Access Control System)
- [CVE-2026-5799](https://cve.now/CVE-2026-5799.md): IDOR in Idvlabs' Ontime (CVSS 7.5, Idvlabs Software and Consulting Services Ontime)
- [CVE-2026-5730](https://cve.now/CVE-2026-5730.md): IDOR in Idvlabs' Ontime (CVSS 7.5, Idvlabs Software and Consulting Services Ontime)
- [CVE-2026-4375](https://cve.now/CVE-2026-4375.md): DoLeads Integrator \<= 1.2.2 & wp2epub \<= 0.65 - Unauthenticated RCE (CVSS 9.0, DoLeads Integrator · wp2epub)
- [CVE-2026-12375](https://cve.now/CVE-2026-12375.md): Uncanny Automator Pro 7.3.0.5 - Backdoor via Compromised Vendor Update Server (CVSS 9.8, uncanny-automator-pro)
- [CVE-2026-12277](https://cve.now/CVE-2026-12277.md): Frontend File Manager Plugin \<= 23.6 - Unauthenticated Arbitrary File Deletion via Saved File Metadata Path Traversal (CVSS 8.7, Frontend File Manager Plugin)
- [CVE-2026-10834](https://cve.now/CVE-2026-10834.md): WP Travel Engine \< 6.8.1 - Subscriber+ Arbitrary Media File Move via user\_profile\_image (CVSS 4.6, WP Travel Engine)
- [CVE-2026-14345](https://cve.now/CVE-2026-14345.md): WPFunnels \<= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter (CVSS 9.8, getwpfunnels WPFunnels – Funnel Builder for WooCommerce wit…)
- [CVE-2026-57871](https://cve.now/CVE-2026-57871.md): Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. (CVSS 7.1, MicroRealEstate)
- [CVE-2026-58315](https://cve.now/CVE-2026-58315.md): Cross-site request forgery vulnerability exists in SEIKO EPSON Web Config. (CVSS 4.3, SEIKO EPSON Web Config)
- [CVE-2026-57870](https://cve.now/CVE-2026-57870.md): Broken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document templates used by other orga (CVSS 5.3, MicroRealEstate)
- [CVE-2026-57869](https://cve.now/CVE-2026-57869.md): Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers t (CVSS 7.1, MicroRealEstate)
- [CVE-2026-57868](https://cve.now/CVE-2026-57868.md): MicroRealEstate is affected by broken object-level access controls in PDF generator functionality. (CVSS 7.1, MicroRealEstate)
- [CVE-2026-57867](https://cve.now/CVE-2026-57867.md): MicroRealEstate allows adversaries to bypass authentication due to a lack of token state management. (CVSS 8.8, MicroRealEstate)
- [CVE-2026-27844](https://cve.now/CVE-2026-27844.md): Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized oper (CVSS 2.7, Gallagher Controller 7000 and)
- [CVE-2026-27790](https://cve.now/CVE-2026-27790.md): Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific req (CVSS 2.7, Gallagher T-20 Readers)
- [CVE-2026-26053](https://cve.now/CVE-2026-26053.md): An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privile (CVSS 5.3, Gallagher Command Centre Server)
- [CVE-2026-42201](https://cve.now/CVE-2026-42201.md): Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands (CVSS 3.3, coollabsio coolify)
- [CVE-2026-34158](https://cve.now/CVE-2026-34158.md): Coolify: Command injection via single-quote breakout in Docker Compose custom commands (CVSS 8.8, coollabsio coolify)
- [CVE-2026-34170](https://cve.now/CVE-2026-34170.md): Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL (CVSS 4.3, coollabsio coolify)
- [CVE-2026-34037](https://cve.now/CVE-2026-34037.md): Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo() (CVSS 9.9, coollabsio coolify)
- [CVE-2026-34048](https://cve.now/CVE-2026-34048.md): Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers (CVSS 9.9, coollabsio coolify)
- [CVE-2026-34057](https://cve.now/CVE-2026-34057.md): Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name (CVSS 8.8, coollabsio coolify)
- [CVE-2026-42143](https://cve.now/CVE-2026-42143.md): Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers (CVSS 8.8, coollabsio coolify)
- [CVE-2026-42147](https://cve.now/CVE-2026-42147.md): Coolify: SSRF via S3 Storage Endpoint in testConnection() (CVSS 4.9, coollabsio coolify)
- [CVE-2026-34044](https://cve.now/CVE-2026-34044.md): Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped) (CVSS 7.7, coollabsio coolify)
- [CVE-2026-34152](https://cve.now/CVE-2026-34152.md): Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport) (CVSS 8.8, coollabsio coolify)
- [CVE-2026-34149](https://cve.now/CVE-2026-34149.md): Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs (CVSS 3.3, coollabsio coolify)
- [CVE-2026-34171](https://cve.now/CVE-2026-34171.md): Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value (CVSS 8.0, coollabsio coolify)
- [CVE-2026-34034](https://cve.now/CVE-2026-34034.md): Coolify: Host RCE via Sentinel token injection (CVSS 8.8, coollabsio coolify)
- [CVE-2026-34168](https://cve.now/CVE-2026-34168.md): Coolify: Command injection via unsanitized persistent storage name in docker volume commands (CVSS 8.8, coollabsio coolify)
- [CVE-2026-42145](https://cve.now/CVE-2026-42145.md): Coolify: File Upload Without Type or Size Validation in Database Backup Restore (CVSS 3.1, coollabsio coolify)
- [CVE-2026-34198](https://cve.now/CVE-2026-34198.md): Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing (CVSS 5.3, coollabsio coolify)
- [CVE-2026-34058](https://cve.now/CVE-2026-34058.md): Coolify: OS Command Injection via Unmanaged Container Operations - Remote Code Execution (CVSS 8.8, coollabsio coolify)
- [CVE-2026-34035](https://cve.now/CVE-2026-34035.md): Coolify: Host RCE via Log Drain secret/env command injection (CVSS 8.8, coollabsio coolify)
- [CVE-2026-34047](https://cve.now/CVE-2026-34047.md): Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution (CVSS 9.9, coollabsio coolify)
- [CVE-2026-42172](https://cve.now/CVE-2026-42172.md): Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Access (CVSS 3.1, coollabsio coolify)
- [CVE-2026-42200](https://cve.now/CVE-2026-42200.md): Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE (CVSS 8.8, coollabsio coolify)
- [CVE-2026-11328](https://cve.now/CVE-2026-11328.md): Exclusive Addons for Elementor \<= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title (CVSS 6.4, timstrifler Exclusive Addons for Elementor)
- [CVE-2026-36162](https://cve.now/CVE-2026-36162.md): An authenticated stored cross-site scripting (XSS) vulnerability in the Upload File Shares API of LiquidFiles v4.2.7 allows attackers to exe (CVSS 5.4)
- [CVE-2026-36163](https://cve.now/CVE-2026-36163.md): An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScri (CVSS 5.4)
- [CVE-2026-37270](https://cve.now/CVE-2026-37270.md): Trueview Security camera T18161- AF v4.9.60.0 contains an authentication bypass vulnerability caused by improper password validation and the (CVSS 9.8)
- [CVE-2026-37271](https://cve.now/CVE-2026-37271.md): Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, The device accepts GATT Write Request com (CVSS 9.8)
- [CVE-2026-50810](https://cve.now/CVE-2026-50810.md): A NULL pointer dereference in smooth\_parse\_stream\_index() in src/media\_tools/mpd.c in GPAC master HEAD before commit b35c61f104b85fbb16520ac (CVSS 5.5)
- [CVE-2026-50811](https://cve.now/CVE-2026-50811.md): An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/tru (CVSS 6.5)
- [CVE-2026-51937](https://cve.now/CVE-2026-51937.md): An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, JsApiTicketComponent.jav (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-07-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.