CVEs published July 9, 2026
277 CVEs were published on July 9, 2026: 31 critical, 96 high. 1 is now in CISA KEV.
- Published
- 277
- Critical
- 31
- High
- 96
- Medium
- 136
- Low
- 14
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 167
Most affected products
- Juniper Networks Junos OS
- 18
- open-webui
- 17
- discourse
- 11
- Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- 8
- getkirby kirby · getkirby/cms
- 7
- langroid
- 6
- Xen XAPI
- 6
- Nozomi Networks Guardian · Nozomi Networks CMC
- 5
- Samsung Open Source Escargot
- 5
- Juniper Networks Junos OS Evolved
- 4
Critical 31
- CVE-2026-54769Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgentlangroid
- CVE-2026-54760Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file callslangroid
- CVE-2026-55615Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879langroid
- CVE-2026-58122Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofingnesquena hermes-webui
- CVE-2026-58123Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal APInesquena hermes-webui
- CVE-2026-54003Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` headergetkirby kirby · getkirby/cms
- CVE-2026-59826Metabase: Arbitrary Code Execution via Database Connection Detail Bypassmetabase
- CVE-2026-59827Metabase: Unsafe Deserialization of H2 Query Resultsmetabase
- CVE-2026-59726Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deploymentruvnet ruflo
- CVE-2026-13461PayRange version 7.0.7 contains a JavaScript injection vulnerabilityPayRange
- CVE-2026-42486Multiple RBAC issues in XAPIXen XAPI
- CVE-2026-23562Multiple RBAC issues in XAPIXen XAPI
- CVE-2026-23561Multiple RBAC issues in XAPIXen XAPI
- CVE-2026-23560Multiple RBAC issues in XAPIXen XAPI
- CVE-2026-23559Multiple RBAC issues in XAPIXen XAPI
- CVE-2026-23556oxenstored keeps quota related use counts across domain destructionoxenstored
- CVE-2025-58151varstored: TOCTOU issues with mapped guest memoryXen varstored
- CVE-2025-58146XAPI UTF-8 string handlingXen XAPI
- CVE-2025-27464WinPVDrivers: Excessive permissions on user-exposed devicesXen Windows PV drivers
- CVE-2025-27463WinPVDrivers: Excessive permissions on user-exposed devicesXen Windows PV drivers
- CVE-2025-27462WinPVDrivers: Excessive permissions on user-exposed devicesXen Windows PV drivers
- CVE-2026-56292Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1acymailing.com AcyMailing extension for Joomla
- CVE-2026-14261CVE-2026-14261Xerte Online Tools
- CVE-2026-12116CVE-2026-12116Xerte Online Tools
- CVE-2026-56291Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1balbooa.com Balbooa Forms extension for Joomla
- CVE-2026-2342XSS in Oceanicsoft's ValeAppOceanicSoft Informatics Systems ValeApp
- CVE-2026-15158Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parametercreativethemeshq Blocksy Companion
- CVE-2026-5955SQLi in Inrove Software's BiEticaretInrove Software and Internet Services BiEticaret
- CVE-2026-14245miniOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Authentication Bypass to Administrator Account Takeover via 'username_b' Parametercyberlord92 miniOrange OTP Login, Verification and SMS Noti…
- CVE-2026-51597MERCURY MIPC252W IP camera v1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentication.
- CVE-2026-51599An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n allows an unauthentica
High 96
- CVE-2026-54771Langroid: handle_message() executes user-supplied tool JSON without sender verificationlangroid
- CVE-2026-50181Langroid: Path traversal in the file tools allows read/write outside configured current directorylangroid
- CVE-2026-50180Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file readlangroid
- CVE-2026-12598LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email in Spotify OAuth CallbackLoginPress Pro
- CVE-2026-12595LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via Discord OAuth CallbackLoginPress Pro
- CVE-2026-12597LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via GitHub OAuth CallbackLoginPress Pro
- CVE-2026-59856Vim: Arbitrary Code Execution via PHP Omni-Completionvim
- CVE-2026-59858Vim: Arbitrary Code Execution via C Omni-Completionvim
- CVE-2026-33655New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLsQuantumNous new-api · github.com/QuantumNous/new-api
- CVE-2026-59855SiYuan: Store XSS To Rce via Asset.rendersiyuan-note siyuan
- CVE-2026-59832SiYuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.dbsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-59833SiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href)siyuan-note siyuan
- CVE-2026-59834SiYuan: SQL Query in Block Search Exposes Hidden Published Document Contentsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-53963Discourse: Stored-XSS in 2FA delete confirmation modaldiscourse
- CVE-2026-58143Cotonti Siena 0.9.26 CSRF via admin.php Config Update EndpointCotonti
- CVE-2026-44787Discourse: Signup-time primary_group_id assignment grants whisperer accessdiscourse
- CVE-2026-55424Discourse: Topic featured link susceptible to stored XSSdiscourse
- CVE-2026-15271TOTOLINK EX200 Web boa.conf least privilege violationTOTOLINK A3000RU · TOTOLINK A3100R +5
- CVE-2026-55604@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Keyarikusi deepseek-mcp-server · @arikusi/deepseek-mcp-server
- CVE-2026-57028Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attackerJuniper Networks Junos OS Evolved
- CVE-2026-57026Junos OS: MX Series with SPC3, SRX Series: Processing of a specifically malformed SIP invite causes a flowd crashJuniper Networks Junos OS
- CVE-2026-57023Junos OS: MX with SPC3, SRX Series: A specifically malformed TCP packet causes a flowd crashJuniper Networks Junos OS
- CVE-2026-55207Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypasspimcore · pimcore/studio-backend-bundle
- CVE-2026-55208Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashespimcore · pimcore/studio-backend-bundle
- CVE-2026-55212Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalationpimcore · pimcore/studio-backend-bundle
- CVE-2026-55865Python Liquid: Infinite loop when parsing malformed `{% case %}` tagsjg-rp liquid · python-liquid
- CVE-2026-15270D-link DIR-823G Web boa.conf least privilege violationD-link DIR-823G
- CVE-2026-54695Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SIDpipecat-ai pipecat · pipecat-ai
- CVE-2026-49276Kirby: Self cross-site scripting (self-XSS) in the writer fieldgetkirby kirby · getkirby/cms
- CVE-2026-54005Kirby: `pages.access` permission is not checked in the `site/find` REST API routegetkirby kirby · getkirby/cms
- CVE-2026-54002Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`getkirby kirby · getkirby/cms
- CVE-2026-13492UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Fieldstiofansisland UsersWP – Front-end login form, User Registr…
- CVE-2026-59148Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theftmockoon · @mockoon/commons-server +1
- CVE-2026-55420Discourse: Remote code execution via pdf uploadsdiscourse
- CVE-2026-61343LibreBooking path traversalLibreBooking
- CVE-2026-58378Allwinner TV Box TV98 ADB exposed on networkAllwinner H616
- CVE-2026-59734Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Executioncoollabsio coolify
- CVE-2026-59720Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Serverhoppscotch
- CVE-2026-59721Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injectionhoppscotch
- CVE-2026-59221open-webui terminal proxy path traversal guard bypass via 9x encoded traversalopen-webui
- CVE-2026-15308Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarationsPython Software Foundation CPython
- CVE-2026-13462PayRange for Android, version 7.0.7, contains an SSL bypass vulnerabilityPayRange
- CVE-2026-59224Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)open-webui
- CVE-2026-59216Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_idopen-webui
- CVE-2026-59219Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logoutopen-webui
- CVE-2026-58459gpsd gpsprof Command Injection via gnuplot plot title subtype fieldntpsec gpsd
- CVE-2026-59214Open WebUI: Stored web worker XSS via Pyodideopen-webui
- CVE-2026-53987Tag Plugin for GLPI 11 before 2.14.4 Stored Cross-Site Scripting in Kanban Badge RenderingpluginsGLPI tag
- CVE-2026-59209n8n: Shared Credential Header Leak via HTTP Request Pagination Expressionn8n-io n8n · n8n
- CVE-2026-59206n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumerationn8n-io n8n · n8n
- CVE-2026-59208n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolutionn8n-io n8n · n8n
- CVE-2026-59207n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connectorn8n-io n8n · n8n
- CVE-2026-11404Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID ParsingCesanta Mongoose
- CVE-2026-60109Zeek < 8.0.9 Null Pointer Dereference DoS via Kerberos KRB_ERROR Parsingzeek
- CVE-2026-60108Zeek < 8.0.9 Uncontrolled Memory Consumption DoS via FTP Analyzerzeek
- CVE-2026-54801A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < VSiemens CPCI85 Central Processing/Communication · Siemens S…
- CVE-2026-4256LDAP Injection in PEAKUP's PassGatePEAKUP Technology PassGate
- CVE-2026-12593Privilege escalation via forged API token creation in Axivion Dashboard OIDC/OAuth2/SSO subsystemQt Axivion
- CVE-2026-9253WP Cost Estimation & Payment Forms Builder (E&P Forms) <= 10.5.97 - Unauthenticated Stored Cross-Site Scripting via 'customerInfos' Parameterloopus WP Cost Estimation & Payment Forms Builder
- CVE-2026-50644SQL Injection in SOPlanning Audit Retention ConfigurationSOPlanning
- CVE-2026-59692Gstreamer1-plugins-bad-free: gstreamer: dtls certificate subject dn stack buffer overflow in openssl_verify_callbackRed Hat Enterprise Linux
- CVE-2026-59691Gstreamer1-plugins-bad-free: gstreamer: rfbsrc/librfb hextile heap out-of-bounds write with 16bpp framebufferRed Hat Enterprise Linux
- CVE-2026-14372Bit Form <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion via '_old' Parameterbitpressadmin Bit Form – Contact Form, Payment Forms, Multi…
- CVE-2026-4275Divi Torque Lite <= 4.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Installation via 'install_plugin' REST Endpointbadhonrocks Divi Torque Lite – Divi Modules for the Divi Bu…
- CVE-2026-13441EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parametermetagauss EventPrime – Events Calendar, Bookings and Tickets
- CVE-2026-1989IDOR in PAVO Inc.'s PAVO PayPAVO Financial Technology Solutions PAVO Pay
- CVE-2026-8848Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder <= 1.22.0 - Missing Authorization to Authenticated (Editor+) Arbitrary Plugin Installationdanieliser Popup Maker – Boost Sales, Conversions, Optins,…
- CVE-2026-33390Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2026-31985Disabled and non-configurable TLS certificate validation in n2os-tui when connecting the Remote Collector to a Guardian or CMC, in Remote Collector before v26.2.0Nozomi Networks Remote Collector
- CVE-2026-31984DoS through oversized audit log entries in Guardian/CMC before 26.2.0Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2026-57111Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-OriginApache Software Foundation Apache Helix REST
- CVE-2026-15000Connect Contact Form 7 and Mailchimp <= 0.9.78.06 - Unauthenticated Stored Cross-Site Scripting via Mailchimp Merge Field Valuesrnzo Connect Contact Form 7 and Mailchimp
- CVE-2026-47840LDAP StartTLS unconditionally disables hostname verificationCloudFoundry Foundation UAA · CloudFoundry Foundation Cf-de…
- CVE-2026-47831Cryptographically Weak Password Generation in bosh-windows-stemcell-builder Allows Remote SSH Brute-Force AttacksCloud Foundry Foundation bosh-windows-stemcell-builder
- CVE-2026-47830Incorrect Permission Assignment Allows Local Privilege Escalation to SYSTEM via Executable OverwriteCloud Foundry Foundation bosh-windows-stemcell-builder
- CVE-2026-47829Argument Injection in BOSH CLI Allows Local Command Execution on Operator Workstations via Compromised DirectorCloudFoundry Foundation bosh-cli
- CVE-2026-47828Missing TLS Certificate Verification in BOSH CLI Allows Root Code Execution via Man-in-the-Middle Credential ReplayBOSH-Ecosystem / BOSH (bosh-cli) bosh-cli
- CVE-2026-11571Everest Forms < 3.5.0 - Unauthenticated Sensitive Information Exposure via Residual CSV ArtifactsEverest Forms
- CVE-2026-47826blobs.yaml Path Traversal Allows File WritesCloudFoundry Foundation BOSH CLI tool
- CVE-2026-5523Divi Form Builder <= 5.1.8 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via User Profile Update FormDivi Engine Divi Form Builder
- CVE-2026-41857BOSH CLI Shell InjectionCloudFoundry BOSH BOSH CLI
- CVE-2025-45422Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictions and make arbitrary changes
- CVE-2025-63579Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported.
- CVE-2026-38076An integer overflow in the jbig2_arith_iaid_ctx_new() function of Artifex commit cc37d0 allows attackers to cause a Denial of Service (DoS)
- CVE-2026-39246decompress before 4.2.2 allows arbitrary symlink creation during archive extraction.
- CVE-2026-51600Tenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in RTSP requests (including DESCRIBE, SETUP, and PLAY m
- CVE-2026-51601Tenda CP3 V3.0 firmware V31.1.9.91 contains a stack-based buffer overflow in the RTSP service.
- CVE-2026-51602A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote att
- CVE-2026-51603A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote att
- CVE-2026-51604A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote att
- CVE-2026-51605A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.991) allows an unauthenticated remote at
- CVE-2026-51606An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) causes the device to abruptly terminate
- CVE-2026-51923An Insecure Direct Object Reference (IDOR) vulnerability exists in docuForm GmbH Client v.11.11c allowing a remote attacker to execute arbit
- CVE-2026-51924An issue in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the file upload and report.php component
- CVE-2026-51925A Local File Inclusion (LFI) vulnerability exists in docuForm GmbH Client v.11.11c that allows a remote attacker to execute arbitrary code v
- CVE-2026-51926An issue in docuForm GmbH FSM Client v.11.11c allows a remote attacker to obtain sensitive information via the login.php component.
Medium, low and unrated 150
- CVE-2026-15311NousResearch hermes-agent Matrix Adapter matrix.py MatrixAdapter._markdown_to_html cross site scriptingNousResearch hermes-agent
- CVE-2026-59857Vim: Out-of-bounds Write in SAL Soundfoldingvim
- CVE-2026-44342New API CSRF in email and WeChat account binding endpointsQuantumNous new-api · github.com/QuantumNous/new-api
- CVE-2026-57501Zen: Context-menu "Open link in glance" / "Split link in new tab" loads a page-controlled link with the System principal, bypassing the web-content scheme restrictionzen-browser desktop
- CVE-2026-59854SiYuan: Incomplete IsSensitivePath denylist: globalCopyFiles reads home-dir credential dotfiles into the workspacesiyuan-note siyuan
- CVE-2026-59853SiYuan: Publish-mode Reader can exfiltrate private saved-search Criteria via /api/storage/getCriteria (missing publish-access filter)siyuan-note siyuan
- CVE-2026-59831GitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious Codespacecli
- CVE-2026-45780Discourse: Private event sample invitees are serialized to non-invited event viewersdiscourse
- CVE-2026-58144Cotonti Siena 0.9.26 Stored XSS via PFS Module ntitle ParameterCotonti
- CVE-2026-59828Discourse: Hidden post revisions leak through adjacent visible diffsdiscourse
- CVE-2026-53962Discourse: Insufficient SVG sanitization logicdiscourse
- CVE-2026-15276pdeljanov Symphonia Metadata denial of servicepdeljanov Symphonia
- CVE-2026-45788Discourse: Secure uploads exposed by hotlinked image copyingdiscourse
- CVE-2026-49256Discourse: Hidden tag names leaked via category serializersdiscourse
- CVE-2026-46413Discourse: Regular users can route multipart uploads into the admin backup storediscourse
- CVE-2026-53961Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding)discourse
- CVE-2026-15274lo48576 fbxcel Node Header parser.rs denial of servicelo48576 fbxcel
- CVE-2026-57054Junos OS: MX Series: Web filtering doesn't block specifically formatted URLsJuniper Networks Junos OS
- CVE-2026-57032Junos OS: EX Series: Subscribing to an unsupported telemetry sensor path causes fxpc process crashJuniper Networks Junos OS
- CVE-2026-57031Junos OS: MX Series: For subscribers configured on static interfaces, input filters are not in effectJuniper Networks Junos OS
- CVE-2026-57030Junos OS: SRX Series: Flow sessions are not getting cleared leading to a DoSJuniper Networks Junos OS
- CVE-2026-57029Junos OS Evolved: QFX Series: When sFlow collector reachability changes evo-pfemand process can crashJuniper Networks Junos OS Evolved
- CVE-2026-55605@arikusi/deepseek-mcp-server Missing Authentication on Self-Hosted HTTP MCP Endpointarikusi deepseek-mcp-server · @arikusi/deepseek-mcp-server
- CVE-2026-57027Junos OS: EX4100 Series, EX4400: With sFlow configured in a VC scenario multicast traffic leads to an FPC crashJuniper Networks Junos OS
- CVE-2026-57025Junos OS and Junos OS Evolved: EX Series, QFX Series, MX Series: A specific 'show l2-learning/ethernet-switching' command causes l2ald crashJuniper Networks Junos OS
- CVE-2026-57024Junos OS: MX with SPC3, SRX Series: Repeated VPN negotiation failures will eventually cause iked to crash continuouslyJuniper Networks Junos OS
- CVE-2026-55689OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unsetopenfga · github.com/openfga/openfga
- CVE-2026-57022Junos OS: MX Series with SPC3, SRX Series: Specific packet in response to a TCP connection establishment by the affected device can crash the PFEJuniper Networks Junos OS
- CVE-2026-57021Junos OS: SRX Series: If VPN compliance-check is configured an attacker can cause http-gk process crashJuniper Networks Junos OS
- CVE-2026-57020Junos OS: QFX10000 Series: IPv6 multicast traffic received on non-IRB interfaces causes a multicast floodJuniper Networks Junos OS
- CVE-2026-57019Junos OS: MX Series: Specific traffic causes an FPC to resetJuniper Networks Junos OS
- CVE-2026-55170OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisionsopenfga · github.com/openfga/openfga
- CVE-2026-33803Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attackerJuniper Networks Junos OS Evolved
- CVE-2026-33802Junos OS: EX Series: Unauthorized users can execute service-impacting CLI commandJuniper Networks Junos OS
- CVE-2026-33801Junos OS and Junos OS Evolved: When a specifically malformed BGP route update is received RPD crashesJuniper Networks Junos OS
- CVE-2026-33800Junos OS: MX Series: In a VC scenario a high rate of micro-BFD session flaps will cause an FPC crashJuniper Networks Junos OS
- CVE-2026-33799Junos OS and Junos OS Evolved: Receipt of a specific SNMPv3 request results in memory leak and eventual snmpd crashJuniper Networks Junos OS
- CVE-2026-33794Junos OS Evolved: PTX Series: Receipt of repeated ECMP routing updates results in PFE crashJuniper Networks Junos OS Evolved
- CVE-2026-21901Junos OS and Junos OS Evolved: Configuration of a specific SSH option results in mgd crashJuniper Networks Junos OS
- CVE-2026-60120Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.phpWebkul Bagisto
- CVE-2026-0275Prisma Browser: Local Privilege Escalation on macOSPalo Alto Networks Prisma Browser
- CVE-2026-0276Cortex XDR Broker VM: Privilege Escalation (PE) VulnerabilityPalo Alto Networks Cortex XDR Broker VM
- CVE-2026-0277Prisma Access Agent: Improper Certificate Validation on iOSPalo Alto Networks Prisma Access Agent
- CVE-2026-0278Prisma Access Agent: Multiple DLP Policy Bypass Vulnerabilities on WindowsPalo Alto Networks Prisma Access Agent
- CVE-2026-0279PAN-OS: Multiple Cross-Site Scripting (XSS) VulnerabilitiesPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2026-0280PAN-OS: IPv6 Firewall Policy BypassPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +2
- CVE-2026-0281PAN-OS: Information Disclosure Vulnerability in Management Web InterfacePalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2026-0282PAN-OS: File Deletion Vulnerability in Management Web InterfacePalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2026-0283PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN)Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2026-0284PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN)Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2026-0285PAN-OS: Server-Side Request Forgery Vulnerability in Management Web InterfacePalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2026-0286PAN-OS: Authenticated Command Injection in CLIPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2026-55590CakePHP: Open redirect weakness via backslash bypasscakephp authentication · cakephp/authentication
- CVE-2026-0287PAN-OS: Denial of Service Vulnerabilities in Network Traffic ProcessingPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2026-50188Kirby: Request header injection in `Http\Remote`getkirby kirby · getkirby/cms
- CVE-2026-54004Kirby: Access to files of top-level drafts is not protected by permissionsgetkirby kirby · getkirby/cms
- CVE-2026-49274Kirby: `pages.access` permission is not checked in the pages picker for parent pagesgetkirby kirby · getkirby/cms
- CVE-2026-58198ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainergunthercox ChatterBot · chatterbot
- CVE-2026-59149Mockoon: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)mockoon · @mockoon/commons-server +1
- CVE-2026-61344Superior Court of California Hearing Reminder Service unauthenticated information disclosureSuperior Court of California, County of Los Angeles Hearing…
- CVE-2026-15204TOTOLINK X5000R OpenVPN Export cstecgi.cgi exportOvpn path traversalTOTOLINK X5000R
- CVE-2026-59817Ghost: Paid gift memberships obtainable at minimal cost via the donations featureTryGhost Ghost · ghost
- CVE-2026-15202YzmCMS Header yzmphp.php get_url cross site scriptingYzmCMS
- CVE-2026-43752An authenticated administrator may be able to achieve arbitrary code execution on the host system by uploading a malicious file through the Claris FileMaker Server
- CVE-2026-15195apidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollutionapidevtools json-schema-ref-parser
- CVE-2026-59225Open WebUI: Arena task endpoints can bypass underlying model access controlsopen-webui
- CVE-2026-59212Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/deleteopen-webui
- CVE-2026-59223Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matchingopen-webui
- CVE-2026-15194Open5GS AMF context.c amf_context_final use after freeOpen5GS
- CVE-2026-59222Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentialsopen-webui
- CVE-2026-59215Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id bindingopen-webui
- CVE-2026-59213Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)open-webui
- CVE-2026-59217Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)open-webui
- CVE-2026-15193AidanPark openclaw-android Android WebView Bridge JsBridge.kt os command injectionAidanPark openclaw-android
- CVE-2026-15192mettle sendportal APIv1 Webhooks mailjet missing authenticationmettle sendportal
- CVE-2026-59715Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)open-webui
- CVE-2026-59220Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default configopen-webui
- CVE-2026-59226Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocationopen-webui
- CVE-2026-15191mettle sendportal Campaign Creation Endpoint CampaignStoreRequest.php authorizationmettle sendportal
- CVE-2026-59227Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permissionopen-webui
- CVE-2026-59218Open WebUI: Account enumeration via observable login timing discrepancyopen-webui
- CVE-2026-15190SourceCodester Simple and Nice Shopping Cart Script login.php sql injectionSourceCodester Simple and Nice Shopping Cart Script
- CVE-2026-15189aerostackdev aerostack-mcp mcp-whatsapp upload_media server-side request forgeryaerostackdev aerostack-mcp
- CVE-2026-15188manjurulhoque django-job-portal Employee Dashboard Endpoint views.py EditEmployeeProfileAPIView access controlmanjurulhoque django-job-portal
- CVE-2026-61474MISP: Improper sharing group authorization check when adding attributesmisp
- CVE-2026-15187enquirer Public Package API Enquirer.set prototype pollutionenquirer
- CVE-2026-54800A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < VSiemens CPCI85 Central Processing/Communication · Siemens S…
- CVE-2026-54799A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < VSiemens CPCI85 Central Processing/Communication · Siemens S…
- CVE-2026-54798A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < VSiemens CPCI85 Central Processing/Communication · Siemens S…
- CVE-2026-5005Stored XSS in Twiser's OKRs & GoalsTwiser Informatics Technology Consulting, Trade and Educati…
- CVE-2026-60095Vinchin Backup & Recovery 9.0.0.86562 Stack Buffer Overflow via ModuleHandShakeVinchin Backup & Recovery
- CVE-2026-60094Vinchin Backup & Recovery 9.0.0.86562 Heap Buffer Overflow via agentlink_serverVinchin Backup & Recovery
- CVE-2026-15186macrozheng mall Portal Endpoint create resource injectionmacrozheng mall
- CVE-2026-12879Cross-Tenant Data Exfiltration in Apigee via BigQuery Confused DeputyGoogle Cloud Apigee
- CVE-2026-15185GPAC MP4Box vobsub.c vobsub_read_idx out-of-boundsGPAC
- CVE-2026-15184GNU LibreDWG DWG File dwg.c dwg_next_entity null pointer dereferenceGNU LibreDWG
- CVE-2026-15182GNU LibreDWG BMP Image dwg.c dwg_bmp heap-based overflowGNU LibreDWG
- CVE-2026-58307Out-of-bounds read, Reachable assertion vulnerability in Samsung Open Source Escargot allows Overread Buffers, Input Data Manipulation.Samsung Open Source Escargot
- CVE-2026-12590body-parser vulnerable to denial of service when invalid limit value silently disables size enforcementbody-parser
- CVE-2026-58306Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.Samsung Open Source Escargot
- CVE-2026-58305Access of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.Samsung Open Source Escargot
- CVE-2026-58304Out-of-bounds read, Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers.Samsung Open Source Escargot
- CVE-2026-58303Stack-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.Samsung Open Source Escargot
- CVE-2026-12428Blocks for ACF Fields <= 1.6.2 - Missing Authorization to Authenticated (Author+) Arbitrary ACF Field Value Disclosure via 'id' Parametergamaup Blocks for ACF Fields — Display Custom Fields in the…
- CVE-2026-9021Easy Invoice <= 2.1.19 - Unauthenticated Arbitrary Quote Accept/Decline and Invoice Creation via easy_invoice_accept_quote / easy_invoice_decline_quote AJAX Actionsmatrixaddons Easy Invoice – Invoice Generator, PDF Quotes &…
- CVE-2026-9237Employee, Leave and Recruitment Management System <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Job Deletion via crewhrm_singleJobAction AJAX Actioncrewhrm Employee, Leave and Recruitment Management System –…
- CVE-2026-9235DHL eCommerce (Benelux) for WooCommerce <= 2.2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shipping Label Creation and Deletion via dhlpwc_label_create and dhlpwc_label_delete AJAX Actionsdhlparcel DHL eCommerce (Benelux) for WooCommerce
- CVE-2026-4298DSGVO All in one for WP <= 4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Resetmlfactory DSGVO All in one for WP
- CVE-2026-9028CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Missing Authorization to Unauthenticated Arbitrary Order Cancellation via 'order_number' Parametercorvusinfo CorvusPay WooCommerce Payment Gateway
- CVE-2026-9027CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST Endpointcorvusinfo CorvusPay WooCommerce Payment Gateway
- CVE-2026-9240Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.9.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Modification via lpc_order_affect AJAX actioniscpcolissimo Colissimo shipping methods for WooCommerce
- CVE-2026-56289Loop with Unreachable Exit Condition in GNU patchGNU patch
- CVE-2026-56288NULL Pointer Dereference in GNU patchGNU patch
- CVE-2026-56460HCL DevOps Deploy / HCL Launch is susceptible to an Insertion of Sensitive Information Into Sent Data vulnerabilityHCLSoftware HCL DevOps Deploy / HCL Launch
- CVE-2026-56458HCL DevOps Deploy is susceptible to a Permissive Cross-domain Security Policy with Untrusted DomainsHCLSoftware HCL DevOps Deploy
- CVE-2026-1365Information Disclosure in Sayax's OSOSSayax Energy Technologies OSOS
- CVE-2026-12433Hydra Booking <= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameterthemefic Hydra Booking — Appointment Scheduling & Booking C…
- CVE-2026-56459HCL DevOps Deploy / HCL Launch is susceptible to sensitive information disclosureHCLSoftware HCL DevOps Deploy / HCL Launch
- CVE-2026-5793XSS in Inrove Software's BiEticaretInrove Software and Internet Services BiEticaret
- CVE-2026-14342Mail Mint <= 1.24.2 - Authenticated (Administrator+) SQL Injection via 'contact_ids' Parametergetwpfunnels Mail Mint – Email Marketing, Newsletter, Email…
- CVE-2026-12418User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf_files_data' Parameterwedevs User Frontend: AI Powered Frontend Posting, User Dir…
- CVE-2026-11359Memberships and User Profiles for WooCommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) ProfileGrid Plugin Installation and Activationmetagauss Memberships and User Profiles for WooCommerce – P…
- CVE-2026-13450GamiPress <= 7.9.4 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'access' Parameterrubengc GamiPress – Gamification plugin to reward points, a…
- CVE-2026-13011ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support <= 1.17.5 - Authenticated (HR Manager+) SQL Injection via 'orderby' Parameterwedevs ERP: Complete HR, Accounting & CRM Suite Built for W…
- CVE-2026-13334Mang Board WP <= 2.3.4 - Reflected Cross-Site Scripting via 'stag' Parameterkitae-park Mang Board WP
- CVE-2026-12406User Frontend <= 4.3.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attach_id' Parameterwedevs User Frontend: AI Powered Frontend Posting, User Dir…
- CVE-2026-31983Missing authentication in SSH keys synchronization endpoint in Guardian/CMC before 26.2.0Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2026-31982Open Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.0Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2026-31981HTML injection in Diagram tab and Graph view in Guardian/CMC before 26.2.0Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2026-59269Privilege Escalation via Active Directory LDAP injection in Pinniped Supervisor can be executed by an attacker who can edit LDAP Group DN entriesVMware Pinniped
- CVE-2026-6910Bookero.pl <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributessafistudio Bookero.pl – system rezerwacji online
- CVE-2026-8996Backup and Staging by WP Time Capsule <= 1.22.26 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via download_recent_decrypted_file_wptc Functionrevmakx Backup and Staging by WP Time Capsule
- CVE-2026-13771Customer Reviews for WooCommerce <= 5.113.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attributeivole Customer Reviews for WooCommerce
- CVE-2026-13080WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parametergetwpfunnels WPFunnels – Funnel Builder for WooCommerce wit…
- CVE-2026-7558Age Verification & Identity Verification by Token of Trust <= 4.0.2 - Missing Authorization to Unauthenticated Information Exposure via 'tot_export_table' Parametertokenoftrust Age Verification & Identity Verification by To…
- CVE-2026-14343Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributescodename065 Download Manager
- CVE-2026-12170AcyMailing <= 10.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' Attributeacyba AcyMailing – An Ultimate Newsletter Plugin and Market…
- CVE-2026-13253Post Grid Gutenberg Blocks for News, Magazines, Blog Websites <= 5.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attributewpxpo Post Grid Gutenberg Blocks – PostX
- CVE-2026-4653Block, Suspend, Report for BuddyPress <= 3.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link' Parameterbouncingsprout Block, Suspend, Report for BuddyPress
- CVE-2026-12517Fediverse Embeds < 1.5.8 - Unauthenticated SSRF via Site Info EndpointFediverse Embeds
- CVE-2026-12516Fediverse Embeds < 1.5.8 - Unauthenticated SSRF via Media ProxyFediverse Embeds
- CVE-2026-12270Everest Forms < 3.5.0 - Unauthenticated Missing Authorization via Site Assistant REST EndpointsEverest Forms
- CVE-2026-11875WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated Support Ticket Access via Session Cookie ForgeryWP Support Plus Responsive Ticket System
- CVE-2026-11869WP DSGVO Tools (GDPR) < 3.1.40 - Unauthenticated Sensitive Information Disclosure via Subject Access RequestWP DSGVO Tools
- CVE-2026-15138tumf mcp-text-editor text_editor.py _validate_file_path path traversaltumf mcp-text-editor
- CVE-2026-15137code-projects Interview Management System View.php sql injectioncode-projects Interview Management System
- CVE-2026-31267Mercusys MW302R MW302R(EU)_V1_1.4.10 Build 231023 is vulnerable to Buffer Overflow in the administrative web interface.
- CVE-2026-39243decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption.decompress
- CVE-2026-39245decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write.
- CVE-2026-51598An input validation vulnerability in the RTSP service of MERCURY MIPC252W IP Camera v1.0.5 Build 230306 Rel.79931n) allows an unauthenticate