CVEs published July 12, 2026
63 CVEs were published on July 12, 2026: 3 critical, 17 high.
- Published
- 63
- Critical
- 3
- High
- 17
- Medium
- 41
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 30
Most affected products
- Capgo
- 7
- zephyrproject zephyr
- 6
- TRENDnet TEW-821DAP
- 5
- Eleveo Call Recording Software
- 4
- AstrBotDevs AstrBot
- 3
- openwrt luci
- 3
- RafyMrX TOKO-ONLINE-ROTI
- 3
- SonicCloudOrg sonic-agent
- 3
- Crawl4AI
- 2
- Leantime
- 2
Critical 3
High 17
- CVE-2026-15506SecureAge CatchPulse Driver saappctl.sys heap-based overflowSecureAge CatchPulse
- CVE-2026-10667SMP use-after-free in Zephyr `CONFIG_USERSPACE` dynamic kernel-object tracking, reachable from unprivileged user threadszephyrproject zephyr
- CVE-2026-10666Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`zephyrproject zephyr
- CVE-2026-10665Heap buffer overflow on WireGuard receive path via unbounded incoming packet lengthzephyrproject zephyr
- CVE-2026-58596Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2026-61875luci-app-upnp Stored XSS via UPnP Port Mapping Descriptionopenwrt luci
- CVE-2026-59260OpenWrt luci-app-samba4 read ACL remote code execution via smbdopenwrt luci
- CVE-2026-56313Capgo - Cross-Organization Account Disruption via SSO Prelink EndpointCapgo
- CVE-2026-56308Capgo - Insufficient Authentication in Email Change EndpointCapgo
- CVE-2026-56260Crawl4AI - Arbitrary File Write via output_path ParameterCrawl4AI
- CVE-2026-56259Crawl4AI - LLM Credential Exfiltration via base_url and Environment Variable ResolutionCrawl4AI
- CVE-2026-56241Capgo - RBAC Demotion Privilege Retention via Stale org_users.user_rightCapgo
- CVE-2026-56238Capgo - Unauthenticated Information Disclosure via PostgREST global_stats EndpointCapgo
- CVE-2026-15484TRENDnet TEW-821DAP ssi tools_nslookup sub_41EC14 buffer overflowTRENDnet TEW-821DAP
- CVE-2026-15483TRENDnet TEW-821DAP ssi tools_nslookup sub_41EC14 buffer overflowTRENDnet TEW-821DAP
- CVE-2026-15481Trendnet TEW-635BRM IPoA WAN Connection Setup rc ipoa_test command injectionTrendnet TEW-635BRM
- CVE-2026-15480Trendnet TEW-635BRM Web Service rc start_httpd stack-based overflowTrendnet TEW-635BRM
Medium, low and unrated 43
- CVE-2026-15514Metasoft 美特软件 MetaCRM PHPRPC Remote Call rpc.jsp RPCService.query sql injectionMetasoft 美特软件 MetaCRM
- CVE-2026-15513Wavlink WL-NU516U1 adm.cgi wlink_uci_set_value os command injectionWavlink WL-NU516U1
- CVE-2026-15512pig-mesh Pig pig-codegen GeneratorServiceImpl.java code injectionpig-mesh Pig
- CVE-2026-15510Leantime API saveSetting improper authorizationLeantime
- CVE-2026-15509Leantime JSON-RPC Endpoint addUser improper authorizationLeantime
- CVE-2026-15508Helicone ai-gateway AWS Metadata Service service.rs build_target_url server-side request forgeryHelicone ai-gateway
- CVE-2026-15507coollabsio Coolify Policy Policies authorizationcoollabsio Coolify
- CVE-2026-15505vnotex vnote YAML Frontmatter markdownit.js cross site scriptingvnotex vnote
- CVE-2026-10668Host-triggerable control-endpoint wedge (DoS) in Nuvoton NuMaker HSUSBD UDC driverzephyrproject zephyr
- CVE-2026-10664Out-of-bounds write in nRF70 Wi-Fi driver power-save event handler (unbounded TWT flow count)zephyrproject zephyr
- CVE-2026-10663Use-after-free / double-free of the root USB device in the experimental USB host stackzephyrproject zephyr
- CVE-2026-15502AojiaoZero Antaris PayPal IPN Payment ipn.php _rewardPurchase sql injectionAojiaoZero Antaris
- CVE-2026-15501AstrBotDevs AstrBot MCP Test Endpoint tools.py ToolsRoute.test_mcp_connection server-side request forgeryAstrBotDevs AstrBot
- CVE-2026-61874filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Deletefilebrowser
- CVE-2026-56336Capgo - Information Disclosure via Unauthenticated SSO check-domain EndpointCapgo
- CVE-2026-56281Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats EndpointCapgo
- CVE-2026-56252Capgo - Scope Isolation Failure in Webhook Test EndpointCapgo
- CVE-2026-15500AstrBotDevs AstrBot market_list Endpoint plugin.py get_online_plugins server-side request forgeryAstrBotDevs AstrBot
- CVE-2026-15499AstrBotDevs AstrBot Scheduled Task cron_tools.py FutureTaskTool.call improper authorizationAstrBotDevs AstrBot
- CVE-2026-15498sergomanov SmartHomeAdatum Login users.php sql injectionsergomanov SmartHomeAdatum
- CVE-2026-15497SonicCloudOrg sonic-agent JWT Authentication Filter ExchangeController.java code injectionSonicCloudOrg sonic-agent
- CVE-2026-15496SonicCloudOrg sonic-agent Groovy Script GroovyScriptImpl.java evalIsFailed os command injectionSonicCloudOrg sonic-agent
- CVE-2026-15495SonicCloudOrg sonic-agent Android WebSocket Server AndroidWSServer.java os command injectionSonicCloudOrg sonic-agent
- CVE-2026-15494AMTT Hotel Broadband Operation System switch_status.php sql injectionAMTT Hotel Broadband Operation System
- CVE-2026-15493Akpali9 Attendance-Management-System absent.php cross site scriptingAkpali9 Attendance-Management-System
- CVE-2026-15492igweze wizgrade studentConductManager.php cross site scriptingigweze wizgrade
- CVE-2026-15491RafyMrX TOKO-ONLINE-ROTI missing authenticationRafyMrX TOKO-ONLINE-ROTI
- CVE-2026-15490RafyMrX TOKO-ONLINE-ROTI add.php sql injectionRafyMrX TOKO-ONLINE-ROTI
- CVE-2026-15489RafyMrX TOKO-ONLINE-ROTI login.php sql injectionRafyMrX TOKO-ONLINE-ROTI
- CVE-2026-15488hcr707305003 shiroiAdmin FileController.php upload unrestricted uploadhcr707305003 shiroiAdmin
- CVE-2026-15487TRENDnet TEW-821DAP Firmware Update system_ntp sub_41FBD0 os command injectionTRENDnet TEW-821DAP
- CVE-2026-15486TRENDnet TEW-821DAP Firmware Update tools_ddns sub_42026C os command injectionTRENDnet TEW-821DAP
- CVE-2026-15485TRENDnet TEW-821DAP DNS Lookup tools_nslookup sub_43F2C4 os command injectionTRENDnet TEW-821DAP
- CVE-2026-15482Aster Telecom Azcall HTTP sis.php sql injectionAster Telecom Azcall
- CVE-2026-15479H3C NX15 Administrator Password Modification Endpoint modify change_passwd password recoveryH3C NX15
- CVE-2026-15478IceHRM UserReport Endpoint EmployeeAttendanceReport.php sql injectionIceHRM
- CVE-2026-15477Bahmni bahmnicore Search Endpoint sql additionalParams sql injectionbahmnicore
- CVE-2026-15476QILING Disk Master Kernel Driver diskbckp.sys access controlQILING Disk Master
- CVE-2026-15475MiniTool Partition Wizard Signed Kernel Driver pwdrvio.sys access controlMiniTool Partition Wizard
- CVE-2026-15474Eleveo Call Recording Software audio.jsp improper authorizationEleveo Call Recording Software
- CVE-2026-15473Eleveo Call Recording Software Recorded Calls restoreCallAction.do improper authorizationEleveo Call Recording Software
- CVE-2026-15472Eleveo Call Recording Software composeEmailAction.do improper authorizationEleveo Call Recording Software
- CVE-2026-15471Eleveo Call Recording Software pci_dss_status.jsp improper authorizationEleveo Call Recording Software