# CVEs published 2026-07-17

291 CVEs were published on July 17, 2026: 35 critical, 97 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2026-56171](https://cve.now/CVE-2026-56171.md): Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability (CVSS 7.1, Microsoft Remote Desktop Web Client · Microsoft Windows Adm…)
- [CVE-2026-57980](https://cve.now/CVE-2026-57980.md): Microsoft Edge (Chromium-based) Tampering Vulnerability (CVSS 5.4, Microsoft Edge)
- [CVE-2026-56740](https://cve.now/CVE-2026-56740.md): JLine: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables (CVSS 7.5, jline3 · org.jline:jline-remote-telnet)
- [CVE-2026-56741](https://cve.now/CVE-2026-56741.md): JLine: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry (CVSS 7.5, jline3 · org.jline:jline-remote-telnet)
- [CVE-2026-48049](https://cve.now/CVE-2026-48049.md): @hapi/inert: Static-file confinement bypass via sibling-prefix path (CVSS 5.3, hapijs inert · @hapi/inert)
- [CVE-2026-48022](https://cve.now/CVE-2026-48022.md): @hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects (CVSS 6.5, hapijs wreck · @hapi/wreck)
- [CVE-2026-44979](https://cve.now/CVE-2026-44979.md): @hapi/wreck : Sensitive \`Proxy-Authorization\` header leaked across cross-hostname redirects (CVSS 6.3, hapijs wreck · @hapi/wreck)
- [CVE-2026-49485](https://cve.now/CVE-2026-49485.md): HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint (CVSS 7.5, hapifhir org.hl7.fhir.core · ca.uhn.hapi.fhir:org.hl7.fh… +7)
- [CVE-2026-54335](https://cve.now/CVE-2026-54335.md): Feathersjs: Prototype pollution in @feathersjs/commons \_.merge via JSON-parsed \_\_proto\_\_ (CVSS 3.7, feathersjs feathers · @feathersjs/commons)
- [CVE-2026-54490](https://cve.now/CVE-2026-54490.md): websocket-driver: Resource limit bypass via message compression (CVSS 6.3, faye websocket-driver-node · websocket-driver)
- [CVE-2026-54466](https://cve.now/CVE-2026-54466.md): websocket-driver: Message corruption via abuse of protocol length headers (CVSS 9.2, faye websocket-driver-node · websocket-driver)
- [CVE-2026-55518](https://cve.now/CVE-2026-55518.md): Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation (CVSS 9.6, avo-hq avo · avo)
- [CVE-2026-54498](https://cve.now/CVE-2026-54498.md): view\_component: around\_render HTML-Safety Bypass (CVSS 8.7, ViewComponent view\_component · view\_component)
- [CVE-2026-54497](https://cve.now/CVE-2026-54497.md): view\_component: Reused Component Instances Retain Stale Render Context (CVSS 6.8, ViewComponent view\_component · view\_component)
- [CVE-2026-13445](https://cve.now/CVE-2026-13445.md): Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints (CVSS 8.1, IBM Langflow OSS)
- [CVE-2026-13446](https://cve.now/CVE-2026-13446.md): Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints (CVSS 9.8, IBM Langflow OSS)
- [CVE-2026-50271](https://cve.now/CVE-2026-50271.md): dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS (CVSS 7.5, DataDog dd-trace-py · ddtrace)
- [CVE-2026-50274](https://cve.now/CVE-2026-50274.md): dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS (CVSS 7.5, DataDog dd-trace-go · github.com/DataDog/dd-trace-go +1)
- [CVE-2026-54159](https://cve.now/CVE-2026-54159.md): ps\_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE (CVSS 10.0, PrestaShop ps\_facetedsearch · prestashop/ps\_facetedsearch)
- [CVE-2026-45785](https://cve.now/CVE-2026-45785.md): OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycle (CVSS 6.2, openmcdf)
- [CVE-2026-48062](https://cve.now/CVE-2026-48062.md): CodeIgniter: Uploaded file extension validation bypass in \`ext\_in\` rule (CVSS 9.8, CodeIgniter4 · codeigniter4/framework)
- [CVE-2026-53727](https://cve.now/CVE-2026-53727.md): css\_parser: SSRF and Local File Disclosure in \`CssParser::Parser#read\_remote\_file\` (CVSS 8.9, premailer css\_parser · css\_parser)
- [CVE-2026-50272](https://cve.now/CVE-2026-50272.md): dd-trace: Improper parsing of W3C baggage headers may lead to DoS (CVSS 7.5, DataDog dd-trace-js · dd-trace)
- [CVE-2026-45784](https://cve.now/CVE-2026-45784.md): rust-openssl: Potential out-of-bounds write in \`CipherCtxRef::cipher\_update\_inplace\` for AES-KW-PAD ciphers (CVSS 5.1, rust-openssl · openssl)
- [CVE-2026-54243](https://cve.now/CVE-2026-54243.md): Statamic: CSV formula injection in form submission exports (CVSS 6.1, statamic cms · statamic/cms)
- [CVE-2026-54242](https://cve.now/CVE-2026-54242.md): Statamic: Server-Side Request Forgery via Glide (DNS rebinding) (CVSS 4.9, statamic cms · statamic/cms)
- [CVE-2026-54244](https://cve.now/CVE-2026-54244.md): Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors (CVSS 3.5, statamic cms · statamic/cms)
- [CVE-2026-49977](https://cve.now/CVE-2026-49977.md): tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies (CVSS 4.3, AmauriC tarteaucitron.js · tarteaucitronjs)
- [CVE-2026-54163](https://cve.now/CVE-2026-54163.md): secure\_headers: CSP directive injection via sandbox, plugin\_types, and report\_to when given untrusted input (CVSS 4.7, github secure\_headers · secure\_headers)
- [CVE-2026-44891](https://cve.now/CVE-2026-44891.md): Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder (CVSS 7.5, netty · io.netty:netty-codec-stomp)
- [CVE-2026-16074](https://cve.now/CVE-2026-16074.md): AstrBotDevs AstrBot Plugin Update plugin.py update\_all\_plugins server-side request forgery (CVSS 5.3, AstrBotDevs AstrBot)
- [CVE-2026-48504](https://cve.now/CVE-2026-48504.md): OpenTelemetry Rust: Unbounded memory allocation in W3C Baggage propagation (CVSS 5.3, open-telemetry opentelemetry-rust · opentelemetry\_sdk)
- [CVE-2026-44974](https://cve.now/CVE-2026-44974.md): Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters (CVSS 7.7, hapijs content · @hapi/content)
- [CVE-2026-54171](https://cve.now/CVE-2026-54171.md): Excon: redact additional sensitive/risky headers when following redirects (CVSS 6.5, excon)
- [CVE-2026-54465](https://cve.now/CVE-2026-54465.md): websocket-driver: Memory exhaustion in HTTP header parser (CVSS 6.3, faye websocket-driver-ruby · websocket-driver)
- [CVE-2026-54463](https://cve.now/CVE-2026-54463.md): websocket-driver: Memory exhaustion via abuse of protocol length headers (CVSS 6.9, faye websocket-driver-ruby · websocket-driver)
- [CVE-2026-54464](https://cve.now/CVE-2026-54464.md): websocket-driver: Resource limit bypass via message compression (CVSS 6.3, faye websocket-driver-ruby · websocket-driver)
- [CVE-2026-13448](https://cve.now/CVE-2026-13448.md): Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints (CVSS 8.1, IBM Langflow OSS)
- [CVE-2026-13473](https://cve.now/CVE-2026-13473.md): IBM Storage Protect Client is vulnerable to Heap-Based Buffer Overflow (CVSS 8.1, IBM Storage Protect Client)
- [CVE-2026-14499](https://cve.now/CVE-2026-14499.md): Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-14501](https://cve.now/CVE-2026-14501.md): Use of Potentially Dangerous Functionthat in IBM Db2 Genius Hub (CVSS 4.3, IBM Db2 Genius Hub · IBM Agentics)
- [CVE-2026-55254](https://cve.now/CVE-2026-55254.md): NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation (CVSS 4.8, ncalc · NCalc.Core +1)
- [CVE-2026-46420](https://cve.now/CVE-2026-46420.md): setup-php: Command Injection in Repository-Derived PHP Version Resolution (CVSS 5.6, shivammathur setup-php)
- [CVE-2026-14971](https://cve.now/CVE-2026-14971.md): This PowerVM Novalink update is being released to address (CVSS 3.9, IBM PowerVM Novalink)
- [CVE-2026-45799](https://cve.now/CVE-2026-45799.md): Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service (CVSS 7.5, square wire · com.squareup.wire:wire-runtime-jvm +1)
- [CVE-2026-14979](https://cve.now/CVE-2026-14979.md): IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack (CVSS 5.3, IBM Engineering Lifecycle Management)
- [CVE-2026-48819](https://cve.now/CVE-2026-48819.md): Hey API: \`buildClientParams\` template: prototype chain substitution via unknown \`$\<slot\>\_\_\_proto\_\_\` key (CVSS 4.8, hey-api openapi-ts · @hey-api/openapi-ts)
- [CVE-2026-16118](https://cve.now/CVE-2026-16118.md): Xdgmime: heap-based buffer overflow in \_xdg\_mime\_magic\_parse\_magic\_line() in xdgmimemagic.c (CVSS 7.1, xdgmime · Red Hat Enterprise Linux +5)
- [CVE-2026-50289](https://cve.now/CVE-2026-50289.md): systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux (CVSS 8.7, sebhildebrandt systeminformation · systeminformation)
- [CVE-2026-50151](https://cve.now/CVE-2026-50151.md): oras-go: credential forwarding via unvalidated Location header in blob upload (CVSS 7.5, oras-project oras-go · oras.land/oras-go/v2)
- [CVE-2026-15069](https://cve.now/CVE-2026-15069.md): Multiple Vulnerabilities in IBM Engineering AI hub. (CVSS 5.4, IBM Engineering AI Hub)
- [CVE-2026-50162](https://cve.now/CVE-2026-50162.md): oras-go: file store write outside workingDir via symlink traversal (CVSS 6.9, oras-project oras-go · oras.land/oras-go/v2)
- [CVE-2026-15091](https://cve.now/CVE-2026-15091.md): Multiple Vulnerabilities in IBM Engineering AI hub. (CVSS 9.3, IBM Engineering AI Hub)
- [CVE-2026-15093](https://cve.now/CVE-2026-15093.md): Multiple Vulnerabilities in IBM Engineering AI hub. (CVSS 4.3, IBM Engineering AI Hub)
- [CVE-2026-15415](https://cve.now/CVE-2026-15415.md): Path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-server (CVSS 6.8, aws-healthomics-mcp-server)
- [CVE-2026-50163](https://cve.now/CVE-2026-50163.md): oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in \`oras-go\` tar extraction (CVSS 7.1, oras-project oras-go · oras.land/oras-go/v2)
- [CVE-2026-15322](https://cve.now/CVE-2026-15322.md): Multiple Vulnerabilities in IBM Engineering AI hub. (CVSS 7.5, IBM Engineering AI Hub)
- [CVE-2026-48978](https://cve.now/CVE-2026-48978.md): oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (CVSS 2.1, oras-project oras-go · oras.land/oras-go/v2 +1)
- [CVE-2026-15995](https://cve.now/CVE-2026-15995.md): IBM Cognos Analytics 12.1.3 general availability package contains a data integrity issue in the Agentic AI assistant that may cause incorrect report summaries or report-processing errors under concurrent use (CVSS 5.4, IBM Cognos Analytics)
- [CVE-2026-4938](https://cve.now/CVE-2026-4938.md): Incorrect Authorization in IBM Verify Identity Access and IBM Security Verify Access (CVSS 6.5, IBM Verify Identity Access · IBM Security Verify Access)
- [CVE-2026-4942](https://cve.now/CVE-2026-4942.md): IBM i is Affected by Algorithm Downgrade in Transport Layer Security \[\] (CVSS 5.9, IBM i)
- [CVE-2026-7364](https://cve.now/CVE-2026-7364.md): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (CVSS 3.1, IBM Verify Identity Access · IBM Security Verify Access)
- [CVE-2026-48373](https://cve.now/CVE-2026-48373.md): Acrobat Reader | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Acrobat DC · Adobe Acrobat Reader DC +1)
- [CVE-2026-50197](https://cve.now/CVE-2026-50197.md): Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests (CVSS 7.8, zalando skipper · github.com/zalando/skipper)
- [CVE-2026-7667](https://cve.now/CVE-2026-7667.md): Path Traversal Vulnerability in API Request Component Content-Disposition Header Processing (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-49834](https://cve.now/CVE-2026-49834.md): sigstore-go: Multi-log threshold bypass via single compromised log (CVSS 5.9, sigstore-go · github.com/sigstore/sigstore-go)
- [CVE-2026-7754](https://cve.now/CVE-2026-7754.md): SSRF Protection Configuration Vulnerability (CVSS 7.7, IBM Langflow OSS)
- [CVE-2026-7755](https://cve.now/CVE-2026-7755.md): MCP Server Configuration Validator Bypass via File Upload API (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-49284](https://cve.now/CVE-2026-49284.md): SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned \`Response/InResponseTo\` is combined with a signed assertion lacking \`SubjectConfirmationData/InResponseTo\` (CVSS 7.1, simplesamlphp · simplesamlphp/simplesamlphp)
- [CVE-2026-7771](https://cve.now/CVE-2026-7771.md): IBM® Db2® is vulnerable to a trap when compiling specially crafted statements containing subqueries could lead to a denial of service (CVSS 5.5, IBM Db2)
- [CVE-2026-7872](https://cve.now/CVE-2026-7872.md): Path Traversal Vulnerability in File Component Leading to Arbitrary File Read and Authentication Bypass (CVSS 7.5, IBM Langflow OSS)
- [CVE-2026-49852](https://cve.now/CVE-2026-49852.md): joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363) (CVSS 8.7, authlib joserfc · joserfc)
- [CVE-2026-63030](https://cve.now/CVE-2026-63030.md): WordPress \< 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution (CVSS 9.8, KEV, WordPress)
- [CVE-2026-60137](https://cve.now/CVE-2026-60137.md): WordPress \< 7.0.2 - Facilitated SQL Injection via author\_\_not\_in in WP\_Query (CVSS 5.9, KEV, WordPress)
- [CVE-2026-8056](https://cve.now/CVE-2026-8056.md): Parameter Injection Vulnerability in API Graph Execution Engine (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-45704](https://cve.now/CVE-2026-45704.md): Pimcore: CustomReports Share Bypass (CVSS 7.1, pimcore · pimcore/pimcore)
- [CVE-2026-8476](https://cve.now/CVE-2026-8476.md): Disk Cache Deserialization Remote Code Execution Vulnerability (CVSS 9.9, IBM Langflow OSS)
- [CVE-2026-8481](https://cve.now/CVE-2026-8481.md): Remote Code Execution via Code Validation Endpoint (CVSS 9.9, IBM Langflow OSS)
- [CVE-2026-44739](https://cve.now/CVE-2026-44739.md): Pimcore: SQL Injection in Custom Reports Column Configuration (CVSS 8.7, pimcore · pimcore/pimcore)
- [CVE-2026-45260](https://cve.now/CVE-2026-45260.md): Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling (CVSS 8.1, pimcore · pimcore/pimcore)
- [CVE-2026-8505](https://cve.now/CVE-2026-8505.md): Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow Execution (CVSS 9.8, IBM Langflow OSS · langflow)
- [CVE-2026-12283](https://cve.now/CVE-2026-12283.md): SQL injection in Amazon Athena Synapse connector (CVSS 6.1, aws-athena-query-federation)
- [CVE-2026-8635](https://cve.now/CVE-2026-8635.md): Arbitrary Code Execution in Python Interpreter Component (CVSS 9.9, IBM Langflow OSS)
- [CVE-2026-8859](https://cve.now/CVE-2026-8859.md): Path Traversal in APIRequest Component via Content-Disposition Header (CVSS 9.9, IBM Langflow OSS)
- [CVE-2026-8861](https://cve.now/CVE-2026-8861.md): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (CVSS 5.3, IBM Verify Identity Access · IBM Security Verify Access)
- [CVE-2026-45703](https://cve.now/CVE-2026-45703.md): Pimcore: WordExport Authorization Bypass for Unauthorized Document Export (CVSS 6.4, pimcore · pimcore/pimcore)
- [CVE-2026-45162](https://cve.now/CVE-2026-45162.md): Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed\_classes Restriction (CVSS 8.0, pimcore · pimcore/pimcore)
- [GHSA-RJWR-M7QX-3FJR](https://cve.now/GHSA-RJWR-M7QX-3FJR.md): oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code (low (no CVSS), github.com/oapi-codegen/oapi-codegen/v2)
- [CVE-2026-9103](https://cve.now/CVE-2026-9103.md): Unauthenticated Superuser Token Issuance via Auto-Login Endpoint (CVSS 9.8, IBM Langflow OSS)
- [CVE-2026-9135](https://cve.now/CVE-2026-9135.md): Policies Component Dynamic CodeInput Fields Bypass Custom Component Validation (CVSS 9.9, IBM Langflow OSS)
- [CVE-2026-58195](https://cve.now/CVE-2026-58195.md): Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync (CVSS 8.8, ruvnet agentic-flow · agentic-flow)
- [CVE-2026-45309](https://cve.now/CVE-2026-45309.md): AsyncSSH \`AuthorizedKeysFile %u\` path traversal allows attacker-selected authorized keys to authenticate a traversal username (CVSS 8.2, ronf asyncssh · asyncssh)
- [CVE-2026-50185](https://cve.now/CVE-2026-50185.md): RustCrypto Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set (CVSS 2.0, RustCrypto utils · cmov)
- [CVE-2026-52746](https://cve.now/CVE-2026-52746.md): JSONata: Malicious inputs to "$toMillis" function can cause resource exhaustion (CVSS 7.5, jsonata-js jsonata · jsonata)
- [CVE-2026-48487](https://cve.now/CVE-2026-48487.md): Zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet (CVSS 5.3, python-zeroconf · zeroconf)
- [CVE-2026-48045](https://cve.now/CVE-2026-48045.md): Zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood (CVSS 6.5, python-zeroconf · zeroconf)
- [CVE-2026-9171](https://cve.now/CVE-2026-9171.md): Vulnerabilities in IBM WebSphere Application affects IBM PowerVM Novalink. (CVSS 7.5, IBM PowerVM Novalink)
- [CVE-2026-47184](https://cve.now/CVE-2026-47184.md): Zeroconf: Unbounded DNS record cache allows LAN-local memory exhaustion via multicast flood (CVSS 6.5, python-zeroconf · zeroconf)
- [CVE-2026-47183](https://cve.now/CVE-2026-47183.md): Zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion (CVSS 6.5, python-zeroconf · zeroconf)
- [CVE-2026-47180](https://cve.now/CVE-2026-47180.md): Zeroconf: Unbounded recursion in DNS compression-pointer decoder allows LAN-local denial of service (CVSS 6.5, python-zeroconf · zeroconf)
- [CVE-2026-53712](https://cve.now/CVE-2026-53712.md): SCRAM: Silent channel-binding authentication downgrade via unsupported certificate algorithms (CVSS 8.2, ongres scram · com.ongres.scram:scram-client +1)
- [CVE-2026-49835](https://cve.now/CVE-2026-49835.md): Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality (CVSS 5.9, sigstore timestamp-authority · github.com/sigstore/times… +1)
- [CVE-2026-16073](https://cve.now/CVE-2026-16073.md): AstrBotDevs AstrBot T2I Feature base.py NetworkRenderStrategy.render cross site scripting (CVSS 5.1, AstrBotDevs AstrBot)
- [CVE-2026-50273](https://cve.now/CVE-2026-50273.md): Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS (CVSS 7.5, DataDog dd-trace-dotnet · Datadog.Trace +1)
- [CVE-2026-48009](https://cve.now/CVE-2026-48009.md): Shopware: Admin Account Takeover via User Recovery Hash Exposure (CVSS 6.8, shopware · shopware/platform +1)
- [CVE-2026-48014](https://cve.now/CVE-2026-48014.md): Shopware: Admin API ACL Bypass in Order State Transition Endpoints (CVSS 6.5, shopware · shopware/platform +1)
- [CVE-2026-48010](https://cve.now/CVE-2026-48010.md): Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts (CVSS 6.5, shopware · shopware/platform +1)
- [CVE-2026-48016](https://cve.now/CVE-2026-48016.md): Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment (CVSS 4.3, shopware · shopware/platform +1)
- [CVE-2026-48015](https://cve.now/CVE-2026-48015.md): Shopware: Stored XSS via SVG file upload — no SVG sanitization (CVSS 4.9, shopware · shopware/core +1)
- [CVE-2026-48008](https://cve.now/CVE-2026-48008.md): Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass (CVSS 6.5, shopware · shopware/platform +1)
- [CVE-2026-9198](https://cve.now/CVE-2026-9198.md): Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation (CVSS 9.8, KEV, IBM Langflow OSS)
- [CVE-2026-9202](https://cve.now/CVE-2026-9202.md): Unauthenticated User Registration Could Lead to Remote Code Execution (CVSS 9.8, IBM Langflow OSS)
- [CVE-2026-9762](https://cve.now/CVE-2026-9762.md): IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control (CVSS 7.8, IBM Db2)
- [CVE-2025-59866](https://cve.now/CVE-2025-59866.md): The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecure file permissions Leading to Privilege Escalation’ vulnerabil (CVSS 3.3, HCLSoftware DFMPro for CATIA · HCLSoftware DFXAnalytics +1)
- [CVE-2026-21764](https://cve.now/CVE-2026-21764.md): Insufficient Input Validation in DevOps Loop (CVSS 3.1, HCLSoftware DevOps Loop)
- [CVE-2026-21762](https://cve.now/CVE-2026-21762.md): Missing HTTP Security Headers in DevOps Loop (CVSS 3.7, HCLSoftware DevOps Loop)
- [CVE-2026-21761](https://cve.now/CVE-2026-21761.md): CORS Misconfiguration in DevOps Loop (CVSS 4.2, HCLSoftware DevOps Loop)
- [CVE-2026-21760](https://cve.now/CVE-2026-21760.md): Unauthorized Access to Admin Functionality via Forced Browsing (CVSS 4.6, HCLSoftware DevOps Loop)
- [CVE-2026-12694](https://cve.now/CVE-2026-12694.md): Missing Authorization in Vimesoft's Enterprise Video Platform (CVSS 9.1, Vimesoft Enterprise Video Platform)
- [CVE-2026-54496](https://cve.now/CVE-2026-54496.md): Missing copy constraint in halo2\_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness (CVSS 9.3, ZcashFoundation zebra · zcash halo2\_gadgets +7)
- [CVE-2026-12693](https://cve.now/CVE-2026-12693.md): IDOR in Vimesoft's Enterprise Video Platform (CVSS 9.4, Vimesoft Enterprise Video Platform)
- [CVE-2026-16104](https://cve.now/CVE-2026-16104.md): Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins (CVSS 4.3, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-16103](https://cve.now/CVE-2026-16103.md): Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption (CVSS 4.3, Red Hat Build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-16106](https://cve.now/CVE-2026-16106.md): Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles (CVSS 4.9, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-16108](https://cve.now/CVE-2026-16108.md): Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2 (CVSS 4.3, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-16093](https://cve.now/CVE-2026-16093.md): Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers (CVSS 5.4, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-44722](https://cve.now/CVE-2026-44722.md): pyzipper: Encryption bypass for small files encrypted with pyzipper (CVSS 6.2, danifus pyzipper · pyzipper)
- [CVE-2026-12692](https://cve.now/CVE-2026-12692.md): Improper Authentication in Vimesoft's Enterprise Video Platform (CVSS 9.8, Vimesoft Enterprise Video Platform)
- [CVE-2026-12691](https://cve.now/CVE-2026-12691.md): Authentication Bypass in Vimesoft's Enterprise Video Platform (CVSS 7.5, Vimesoft Enterprise Video Platform)
- [CVE-2026-49215](https://cve.now/CVE-2026-49215.md): Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted (CVSS 2.1, symfony ux · symfony/ux-live-component)
- [CVE-2026-57860](https://cve.now/CVE-2026-57860.md): ForgeCode Arbitrary Code Execution via Unvetted .mcp.json in Untrusted Repository (CVSS 8.4, tailcallhq forgecode)
- [CVE-2026-49216](https://cve.now/CVE-2026-49216.md): Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data (CVSS 5.1, symfony ux · symfony/ux-autocomplete)
- [CVE-2026-63309](https://cve.now/CVE-2026-63309.md): SurrealDB \< 3.1.5 Information Disclosure via ORDER BY (CVSS 5.3, surrealdb)
- [CVE-2026-49211](https://cve.now/CVE-2026-49211.md): Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil (CVSS 6.9, symfony ux · symfony/ux-autocomplete)
- [CVE-2026-63308](https://cve.now/CVE-2026-63308.md): Helm Files.Lines Denial of Service via Empty Chart Files (CVSS 5.3, helm)
- [CVE-2026-63307](https://cve.now/CVE-2026-63307.md): Chat2DB \< 5.3.0 Insecure Direct Object Reference via GET /api/connection/datasource (CVSS 7.1, OtterMind Chat2DB)
- [CVE-2026-49208](https://cve.now/CVE-2026-49208.md): Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor (CVSS 6.9, symfony ux · symfony/ux-live-component)
- [CVE-2026-49210](https://cve.now/CVE-2026-49210.md): Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag (CVSS 2.3, symfony ux · symfony/ux-live-component)
- [CVE-2026-49212](https://cve.now/CVE-2026-49212.md): Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding (CVSS 6.9, symfony ux · symfony/ux-live-component)
- [CVE-2026-49209](https://cve.now/CVE-2026-49209.md): Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests (CVSS 5.3, symfony ux · symfony/ux-live-component)
- [CVE-2026-9588](https://cve.now/CVE-2026-9588.md): Authenticated Stored Cross-Site Scripting (XSS) in Switchvox SMB Web Portal (CVSS 7.0, Sangoma Switchvox SMB Edition)
- [CVE-2026-9587](https://cve.now/CVE-2026-9587.md): Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal (CVSS 7.1, Sangoma Switchvox SMB Edition)
- [CVE-2026-9586](https://cve.now/CVE-2026-9586.md): Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB (CVSS 9.3, KEV, Sangoma Switchvox SMB Edition)
- [CVE-2026-11763](https://cve.now/CVE-2026-11763.md): IDOR in GIS Informatics' GisLab Laboratory Management System (CVSS 6.5, Gis Informatics Engineering Consulting Laboratory R&D and S…)
- [CVE-2026-9585](https://cve.now/CVE-2026-9585.md): Unauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web Portal (CVSS 8.6, Sangoma Switchvox SMB Edition)
- [CVE-2026-63101](https://cve.now/CVE-2026-63101.md): Open Event Server 1.19.1 Unauthenticated Member Roster Export via CSV Export Endpoint (CVSS 8.7, fossasia open-event-server)
- [CVE-2026-8297](https://cve.now/CVE-2026-8297.md): SQLi in GIS Informatics' GisLab Laboratory Management System (CVSS 9.8, Gis Informatics Engineering Consulting Laboratory R&D and S…)
- [CVE-2026-58148](https://cve.now/CVE-2026-58148.md): Joomla Extension - chronoengine.com - Stored XSS in ChronoForms extension for Joomla 8.0 - 8.0.52 (CVSS 8.7, chronoengine.com ChronoForms extension for Joomla)
- [CVE-2026-60024](https://cve.now/CVE-2026-60024.md): Joomla Extension - joomdonation.com - Insecure default configuration Events Booking \< 5.8.0 (CVSS 9.8, joomdonation.com Events Booking extension for Joomla)
- [CVE-2026-58149](https://cve.now/CVE-2026-58149.md): Joomla Extension - joomdonation.com - User enumeration in Events Booking \< 5.8.0 (CVSS 5.3, joomdonation.com Events Booking extension for Joomla)
- [CVE-2026-63100](https://cve.now/CVE-2026-63100.md): Maybe 0.6.0 Missing Authorization via HostingsController show/update (CVSS 7.1, maybe-finance maybe)
- [CVE-2026-60025](https://cve.now/CVE-2026-60025.md): Joomla Extension - joomdonation.com - User enumeration in Events Booking \< 5.8.0 (CVSS 8.8, joomdonation.com Events Booking extension for Joomla)
- [CVE-2026-63099](https://cve.now/CVE-2026-63099.md): TheHive 4.1.24 Broken Object Level Authorization via Attachment Download Endpoints (CVSS 7.1, TheHive-Project TheHive)
- [CVE-2026-63098](https://cve.now/CVE-2026-63098.md): TheHive 4.1.24 Unauthenticated Information Disclosure via /api/status Endpoint (CVSS 6.9, TheHive-Project TheHive)
- [CVE-2026-63097](https://cve.now/CVE-2026-63097.md): Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State Exposure (CVSS 5.3, matrix-org dendrite)
- [CVE-2026-63096](https://cve.now/CVE-2026-63096.md): Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint (CVSS 6.9, matrix-org dendrite)
- [CVE-2026-9537](https://cve.now/CVE-2026-9537.md): Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison (CVSS 5.3, JBERGER Mojo::JWT)
- [CVE-2026-63095](https://cve.now/CVE-2026-63095.md): Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint (CVSS 7.1, matrix-org dendrite)
- [CVE-2026-15783](https://cve.now/CVE-2026-15783.md): Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed reading private repository metadata via delegated bypass rule suites (CVSS 5.3, GitHub Enterprise Server)
- [CVE-2026-14741](https://cve.now/CVE-2026-14741.md): HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse\_date (CVSS 7.5, OALDERS HTTP::Date)
- [CVE-2026-15343](https://cve.now/CVE-2026-15343.md): Path traversal vulnerability in GitHub Enterprise Server allowed writing files to arbitrary repository paths, including GitHub Actions workflow files, via unchecked Dependabot dependency-file paths (CVSS 8.6, GitHub Enterprise Server)
- [CVE-2026-15007](https://cve.now/CVE-2026-15007.md): Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via deeply nested YAML in release notes configuration (CVSS 5.7, GitHub Enterprise Server)
- [CVE-2026-12715](https://cve.now/CVE-2026-12715.md): Missing Authorization in Firebase Studio allows Cross-Tenant Source Code Theft (CVSS 8.5, Google Cloud Firebase Studio)
- [CVE-2026-14871](https://cve.now/CVE-2026-14871.md): osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure (CVSS 7.1, osTicket)
- [CVE-2026-12705](https://cve.now/CVE-2026-12705.md): Integrity mechanism of KNX-device FW-files can be bypassed in ABB Update Tool (CVSS 6.4, KNX Update Tool · ABB KNX Update Tool)
- [CVE-2026-63093](https://cve.now/CVE-2026-63093.md): Cursor for Windows 3.2.16 RCE via Malicious git.exe in Workspace (CVSS 8.7, Anysphere Cursor)
- [CVE-2026-63094](https://cve.now/CVE-2026-63094.md): SigNoz \< 0.134.0 SSO OAuth State Manipulation Session Token Theft (CVSS 7.6, signoz)
- [CVE-2026-16089](https://cve.now/CVE-2026-16089.md): Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session (CVSS 5.4, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-16017](https://cve.now/CVE-2026-16017.md): mosaxiv clawlet cron Chat Tool tool\_cron.go remove authorization (CVSS 5.3, mosaxiv clawlet)
- [CVE-2026-9592](https://cve.now/CVE-2026-9592.md): Sensitive Information Disclosure in HTTP header (CVSS 7.5, SEPPmail Secure Email Gateway & SEPPmail Cloud)
- [CVE-2024-23572](https://cve.now/CVE-2024-23572.md): HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk associated with this i (CVSS 4.2, HCLSoftware Aftermarket EPC)
- [CVE-2024-23570](https://cve.now/CVE-2024-23570.md): HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack technique where an attacker loads a vulnera (CVSS 4.3, HCLSoftware Aftermarket EPC)
- [CVE-2024-23578](https://cve.now/CVE-2024-23578.md): HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS) policy for this requ (CVSS 4.2, HCLSoftware Aftermarket EPC)
- [CVE-2024-23569](https://cve.now/CVE-2024-23569.md): HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" header (CVSS 4.3, HCLSoftware Aftermarket EPC)
- [CVE-2024-23577](https://cve.now/CVE-2024-23577.md): HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requeste (CVSS 4.3, HCLSoftware Aftermarket EPC)
- [CVE-2024-23574](https://cve.now/CVE-2024-23574.md): HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to either guess or conf (CVSS 5.3, HCLSoftware Aftermarket EPC)
- [CVE-2024-42214](https://cve.now/CVE-2024-42214.md): HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server. (CVSS 5.3, HCLSoftware Aftermarket EPC)
- [CVE-2024-23575](https://cve.now/CVE-2024-23575.md): HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing (CVSS 5.3, HCLSoftware Aftermarket EPC)
- [CVE-2024-23571](https://cve.now/CVE-2024-23571.md): HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifying the extent to which (CVSS 4.3, HCLSoftware Aftermarket EPC)
- [CVE-2024-23573](https://cve.now/CVE-2024-23573.md): HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. (CVSS 3.7, HCLSoftware Aftermarket EPC)
- [CVE-2026-16072](https://cve.now/CVE-2026-16072.md): Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation (CVSS 4.9, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2024-23568](https://cve.now/CVE-2024-23568.md): HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by the web server. (CVSS 5.3, HCLSoftware Aftermarket EPC)
- [CVE-2024-23565](https://cve.now/CVE-2024-23565.md): HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password f (CVSS 5.3, HCLSoftware Aftermarket EPC)
- [CVE-2024-23566](https://cve.now/CVE-2024-23566.md): HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented. (CVSS 6.5, HCLSoftware Aftermarket EPC)
- [CVE-2026-16016](https://cve.now/CVE-2026-16016.md): poco-ai poco-claw task.py run\_task server-side request forgery (CVSS 6.9, poco-ai poco-claw)
- [CVE-2024-23567](https://cve.now/CVE-2024-23567.md): HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL para (CVSS 4.3, HCLSoftware Aftermarket EPC)
- [CVE-2024-23564](https://cve.now/CVE-2024-23564.md): HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from th (CVSS 9.1, HCL Software Aftermarket EPC)
- [CVE-2026-16015](https://cve.now/CVE-2026-16015.md): poco-ai poco-claw executor\_manager API tasks.py create\_task missing authentication (CVSS 5.3, poco-ai poco-claw)
- [CVE-2026-7488](https://cve.now/CVE-2026-7488.md): Sensitive Data Exposure in IKAS Technologies' E-Commerce (CVSS 7.5, IKAS Technology E-Commerce)
- [CVE-2026-13082](https://cve.now/CVE-2026-13082.md): GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets (CVSS 5.3, BURAK GD::SecurityImage)
- [CVE-2026-13410](https://cve.now/CVE-2026-13410.md): Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled (CVSS 8.2, GARU Dancer::Plugin::Auth::Google)
- [CVE-2026-16014](https://cve.now/CVE-2026-16014.md): code-projects Hospital Bed Management System Login Form sql injection (CVSS 6.9, code-projects Hospital Bed Management System)
- [CVE-2026-7189](https://cve.now/CVE-2026-7189.md): Sensitive Data Exposure in Proliz's OBS (CVSS 7.5, Proliz Software Ltd. Proliz's OBS)
- [CVE-2026-8396](https://cve.now/CVE-2026-8396.md): XXE in Netcad's NetGIS (CVSS 7.5, Netcad Software NetGIS)
- [CVE-2026-15943](https://cve.now/CVE-2026-15943.md): Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change (CVSS 5.5, Red Hat Build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-16013](https://cve.now/CVE-2026-16013.md): liftoff-sr CIPster cipepath.cc deserialize\_symbolic out-of-bounds (CVSS 6.9, liftoff-sr CIPster)
- [CVE-2026-16009](https://cve.now/CVE-2026-16009.md): itsourcecode Hospital Management System prescriptionorderdetail.php sql injection (CVSS 5.3, itsourcecode Hospital Management System)
- [CVE-2026-16008](https://cve.now/CVE-2026-16008.md): sagold json-schema-library propertyDependencies.ts parsePropertyDependencies prototype pollution (CVSS 5.3, sagold json-schema-library)
- [CVE-2026-59252](https://cve.now/CVE-2026-59252.md): Missing gas\_limit validation in mpp Tempo fee-payer enables wallet drain (CVSS 8.2, ZenHive mpp)
- [CVE-2026-59694](https://cve.now/CVE-2026-59694.md): Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment (CVSS 8.3, ZenHive mpp)
- [CVE-2026-59695](https://cve.now/CVE-2026-59695.md): Unbounded max\_fee\_per\_gas in mpp Tempo fee-payer enables single-request wallet drain (CVSS 8.3, ZenHive mpp)
- [CVE-2026-8075](https://cve.now/CVE-2026-8075.md): Posting a malicious markdown image crashes the Mattermost Desktop App (CVSS 6.5, Mattermost)
- [CVE-2026-9602](https://cve.now/CVE-2026-9602.md): Mattermost Desktop App crashes when malformed arguments are provided to some exposed IPC methods (CVSS 5.7, Mattermost)
- [CVE-2026-22104](https://cve.now/CVE-2026-22104.md): Improper access control in Hashtopolis server chunk activity component (CVSS 7.1, hashtopolis server)
- [CVE-2026-62764](https://cve.now/CVE-2026-62764.md): Apache Accumulo: A user can trigger a graceful shutdown of services without the relevant system permissions (CVSS 5.7, Apache Software Foundation Apache Accumulo)
- [CVE-2026-15380](https://cve.now/CVE-2026-15380.md): Local privilege escalation in Symantec ITMS (CVSS 5.1, Broadcom Symantec Management Suite)
- [CVE-2026-9656](https://cve.now/CVE-2026-9656.md): HubSpot All-In-One Marketing \<= 11.3.62 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Localized Script (CVSS 4.3, hubspotdev HubSpot All-In-One Marketing – Forms, Popups, Li…)
- [CVE-2026-15379](https://cve.now/CVE-2026-15379.md): Arbitrary File Read as SYSTEM in Symantec ITMS (CVSS 5.1, Broadcom Symantec IT Management Suite)
- [CVE-2019-25764](https://cve.now/CVE-2019-25764.md): \*\*UNSUPPORTED WHEN ASSIGNED\*\* Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC driver allows a local user to bypass the (CVSS 7.3, ASUS AURA SYNC)
- [CVE-2026-9810](https://cve.now/CVE-2026-9810.md): AI Chatbot & Workflow Automation by AIWU \< 1.5.4 - Unauthenticated Privilege Escalation via MCP OAuth (CVSS 9.8, AI Copilot)
- [CVE-2026-13402](https://cve.now/CVE-2026-13402.md): Royal Elementor Addons \< 1.7.1063 - Unauthenticated Private Mega Menu Template Disclosure (CVSS 5.3, Royal Addons for Elementor)
- [CVE-2026-12393](https://cve.now/CVE-2026-12393.md): WPS Bookings for WooCommerce \< 3.11.7 - Subscriber+ Arbitrary Booking Order Cancellation via IDOR (CVSS 5.4, WPS Bookings for WooCommerce)
- [CVE-2026-11966](https://cve.now/CVE-2026-11966.md): User Registration & Membership \< 5.2.3 - Unauthenticated Limited User Deletion via Stripe Subscription Handler (CVSS 5.3, User Registration & Membership)
- [CVE-2026-11961](https://cve.now/CVE-2026-11961.md): User Registration & Membership \< 5.2.3 - Unauthenticated Privilege Escalation via Unbound members\_data Membership ID (CVSS 8.1, User Registration & Membership)
- [CVE-2026-11575](https://cve.now/CVE-2026-11575.md): PhonePe Payment Solutions \< 3.1.0 - Unauthenticated Payment Bypass via Forged Callback (CVSS 7.5, PhonePe Payment Solutions)
- [CVE-2026-10525](https://cve.now/CVE-2026-10525.md): NEX-Forms \< 9.2.3 - Unauthenticated Stored XSS via Form Submission (CVSS 6.1, NEX-Forms)
- [CVE-2026-15094](https://cve.now/CVE-2026-15094.md): WP Hotel Booking \<= 2.3.2 - Reflected Cross-Site Scripting via 'check\_in\_date' Parameter (CVSS 6.1, thimpress WP Hotel Booking)
- [CVE-2026-15982](https://cve.now/CVE-2026-15982.md): Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit \<= 2.8.4 - Unauthenticated Privilege Escalation via 'aiomatic\_call\_google\_ai\_function' (CVSS 9.8, CodeRevolution Aimogen Pro - All-in-One AI Content Writer,…)
- [CVE-2026-21770](https://cve.now/CVE-2026-21770.md): HCL Traveler for Microsoft Outlook (HTMO) is susceptible to DLL hijacking (CVSS 6.5, HCLSoftware HCL Traveler for Microsoft Outlook)
- [CVE-2026-58317](https://cve.now/CVE-2026-58317.md): Unsigned to Signed Conversion Error (CWE-196) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. (CVSS 6.3, TeraTerm Project TTSSH2)
- [CVE-2026-60060](https://cve.now/CVE-2026-60060.md): Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Projec (CVSS 6.3, TeraTerm Project TTSSH2)
- [CVE-2026-41993](https://cve.now/CVE-2026-41993.md): Improper Access Control vulnerability in the Removable Media Validation function of TXOne Networks products allows a local attacker with adm (CVSS 4.4, TXOne Networks SafePortAgent · TXOne Networks StellarProtect)
- [CVE-2026-13765](https://cve.now/CVE-2026-13765.md): LearnPress \<= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints (CVSS 7.5, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2026-15161](https://cve.now/CVE-2026-15161.md): Ninja Forms - Excel Export \<= 3.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'filter' Parameter (CVSS 6.4, SaturdayDrive Ninja Forms - Excel Export)
- [CVE-2026-15759](https://cve.now/CVE-2026-15759.md): ChatHelp \<= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'number' and 'group' Shortcode Attributes (CVSS 6.4, themeatelier ChatHelp – Click to Chat Button, WooCommerce C…)
- [CVE-2026-13352](https://cve.now/CVE-2026-13352.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \<= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload\_mimes Filter Expansion (CVSS 8.8, properfraction Paid Membership Plugin, Ecommerce, User Regi…)
- [CVE-2026-15349](https://cve.now/CVE-2026-15349.md): ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce \<= 1.17.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Company Location Creation via wp\_ajax\_erp-company-location AJAX Handler (CVSS 4.3, wedevs ERP: Complete HR, Accounting & CRM Suite Built for W…)
- [CVE-2026-14503](https://cve.now/CVE-2026-14503.md): pCloud WP Backup \<= 2.0.3 - Missing Authorization on the 'start\_backup' AJAX Method to Authenticated (Subscriber+) Arbitrary File Read (CVSS 6.5, ploudapp pCloud WP Backup)
- [CVE-2026-15457](https://cve.now/CVE-2026-15457.md): Kirki \<= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter (CVSS 4.9, themeum Kirki – Freeform Page Builder, Website Builder & Cu…)
- [CVE-2026-15395](https://cve.now/CVE-2026-15395.md): Kali Forms \<= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value (CVSS 7.2, wpchill Kali Forms — Contact Form & Drag-and-Drop Builder)
- [CVE-2026-11324](https://cve.now/CVE-2026-11324.md): WooCommerce Placetopay Gateway \<= 3.2.2 - Reflected Cross-Site Scripting via 'redirect-url' (CVSS 6.1, evertec WooCommerce Placetopay Gateway Belice · evertec… +3)
- [CVE-2026-15159](https://cve.now/CVE-2026-15159.md): Ninja Forms - Excel Export \<= 3.3.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Data Disclosure via 'spreadsheet\_export\_form\_id' Parameter (CVSS 4.3, SaturdayDrive Ninja Forms - Excel Export)
- [CVE-2026-15160](https://cve.now/CVE-2026-15160.md): Ninja Forms - Excel Export \<= 3.3.6 - Missing Authorization to Authenticated (Subscriber+) XLS Write via Path Traversal (CVSS 4.3, SaturdayDrive Ninja Forms - Excel Export)
- [CVE-2026-8616](https://cve.now/CVE-2026-8616.md): Fense Proxy & VPN Blocker \<= 3.0.1 - Missing Authorization to Unauthenticated Plugin Option/Transient Deletion via fense\_bpvt\_save\_settings AJAX Action (CVSS 5.3, devozon Fense Proxy & VPN Blocker)
- [CVE-2026-14956](https://cve.now/CVE-2026-14956.md): Bricksforge \<= 3.1.8.6 - Unauthenticated Privilege Escalation via Pro Forms fieldIds Parameter (CVSS 9.8, Bricksforge)
- [CVE-2026-2594](https://cve.now/CVE-2026-2594.md): Smart Custom Fields \<= 5.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title (CVSS 6.4, inc2734 Smart Custom Fields)
- [CVE-2026-62387](https://cve.now/CVE-2026-62387.md): Grav \< 1.0.0-rc.16 CORS Misconfiguration via API Plugin (CVSS 7.1, getgrav grav)
- [CVE-2026-62386](https://cve.now/CVE-2026-62386.md): Grav \< 1.0.0-rc.16 Authentication Bypass via token URL Parameter (CVSS 8.2, getgrav grav)
- [CVE-2026-62241](https://cve.now/CVE-2026-62241.md): clawvet \< 0.7.5 Hard-coded JWT Secret Session Forgery (CVSS 9.3, MohibShaikh clawvet)
- [CVE-2026-62238](https://cve.now/CVE-2026-62238.md): OpenRemote \< 1.26.0 SQL Injection via Crosstab Export (CVSS 7.2, openremote · io.openremote:openremote-manager)
- [CVE-2026-62237](https://cve.now/CVE-2026-62237.md): Grav \< 2.0.4 ReDoS via regex\_replace in Sandbox (CVSS 6.0, getgrav grav · getgrav/grav)
- [CVE-2026-62236](https://cve.now/CVE-2026-62236.md): grav-plugin-login \< 3.8.11 CSRF via regenerate2FASecret (CVSS 2.3, getgrav grav)
- [CVE-2026-62235](https://cve.now/CVE-2026-62235.md): Grav Flex-Objects \< 1.4.3 Authorization Bypass via API (CVSS 2.3, getgrav grav)
- [CVE-2026-62234](https://cve.now/CVE-2026-62234.md): Grav \< 2.0.4 SSRF via Unrestricted cURL Protocols (CVSS 8.4, getgrav grav)
- [CVE-2026-62233](https://cve.now/CVE-2026-62233.md): grav-plugin-api \< 1.0.6 Privilege Escalation via createApiKey (CVSS 8.7, getgrav grav)
- [CVE-2026-62232](https://cve.now/CVE-2026-62232.md): Grav \< 2.0.4 2FA Bypass via Secret Regeneration (CVSS 9.1, getgrav grav · getgrav/grav)
- [CVE-2026-62231](https://cve.now/CVE-2026-62231.md): Grav \< 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator (CVSS 8.6, getgrav grav)
- [CVE-2026-62230](https://cve.now/CVE-2026-62230.md): Grav \< 2.0.4 File Access Bypass via Case Variation (CVSS 8.7, getgrav grav · getgrav/grav)
- [CVE-2026-62229](https://cve.now/CVE-2026-62229.md): OpenClaw \< 2026.5.18 Authorization Bypass via Glob Matching (CVSS 7.7, OpenClaw)
- [CVE-2026-62228](https://cve.now/CVE-2026-62228.md): OpenClaw \< 2026.6.5 Authorization Bypass via Node Exec Approvals (CVSS 7.7, OpenClaw)
- [CVE-2026-62227](https://cve.now/CVE-2026-62227.md): OpenClaw 2026.4.14 \< 2026.5.26 SSRF via Browser Snapshot (CVSS 4.9, OpenClaw)
- [CVE-2026-62226](https://cve.now/CVE-2026-62226.md): OpenClaw 2026.3.28 \< 2026.5.19 Authorization Bypass via Browser Act Route (CVSS 5.1, OpenClaw)
- [CVE-2026-62225](https://cve.now/CVE-2026-62225.md): OpenClaw \< 2026.5.18 Authorization Bypass via Skill Command Dispatch (CVSS 2.3, OpenClaw)
- [CVE-2026-62224](https://cve.now/CVE-2026-62224.md): OpenClaw MS Teams \< 2026.5.12 Authorization Bypass (CVSS 2.3, openclaw msteams)
- [CVE-2026-62223](https://cve.now/CVE-2026-62223.md): OpenClaw \< 2026.5.18 Authorization Bypass via Device-pair (CVSS 7.7, OpenClaw)
- [CVE-2026-62222](https://cve.now/CVE-2026-62222.md): OpenClaw \< 2026.5.22 Untrusted Plugin Loading via Setup-mode (CVSS 7.1, OpenClaw)
- [CVE-2026-62221](https://cve.now/CVE-2026-62221.md): OpenClaw 2026.5.12 \< 2026.5.26 Authorization Bypass via allowFrom (CVSS 2.3, OpenClaw)
- [CVE-2026-62220](https://cve.now/CVE-2026-62220.md): OpenClaw 2026.2.25 \< 2026.5.26 WebSocket Rate Limit Bypass (CVSS 6.3, OpenClaw)
- [CVE-2026-62219](https://cve.now/CVE-2026-62219.md): OpenClaw 2026.2.12 \< 2026.5.26 Authorization Bypass via Blank Agent IDs (CVSS 6.0, OpenClaw)
- [CVE-2026-62218](https://cve.now/CVE-2026-62218.md): OpenClaw 2026.1.20 \< 2026.5.27 Authorization Bypass via device.pair.approve (CVSS 8.7, OpenClaw)
- [CVE-2026-62217](https://cve.now/CVE-2026-62217.md): OpenClaw 2026.5.14-beta.1 \< 2026.5.27 Authentication Bypass via exec approvals (CVSS 7.7, OpenClaw)
- [CVE-2026-62216](https://cve.now/CVE-2026-62216.md): OpenClaw 2026.4.20 \< 2026.5.28 Policy Bypass via Media Upload (CVSS 2.3, OpenClaw)
- [CVE-2026-62215](https://cve.now/CVE-2026-62215.md): OpenClaw \< 2026.6.5 Authentication Bypass via HTTP Canvas (CVSS 5.1, OpenClaw)
- [CVE-2026-62214](https://cve.now/CVE-2026-62214.md): OpenClaw \< 2026.5.28 Bot Framework SSRF via serviceUrl Parameter Validation (CVSS 6.0, openclaw msteams)
- [CVE-2026-62213](https://cve.now/CVE-2026-62213.md): OpenClaw \< 2026.5.27 Token Leakage via MS Teams Outbound Requests (CVSS 6.0, openclaw msteams)
- [CVE-2026-62212](https://cve.now/CVE-2026-62212.md): OpenClaw \< 2026.5.28 Authentication Bypass via safeFetch (CVSS 5.1, OpenClaw)
- [CVE-2026-62211](https://cve.now/CVE-2026-62211.md): OpenClaw \< 2026.6.1 Credential Redaction Bypass via Trajectory Export (CVSS 4.1, OpenClaw)
- [CVE-2026-62210](https://cve.now/CVE-2026-62210.md): OpenClaw \< 2026.6.1 Denial of Service via Remote Media URLs (CVSS 6.0, OpenClaw)
- [CVE-2026-62209](https://cve.now/CVE-2026-62209.md): OpenClaw 2026.5.10-beta.1 \< 2026.6.5 Authorization Bypass via agent-mode dispatch (CVSS 7.6, OpenClaw)
- [CVE-2026-62208](https://cve.now/CVE-2026-62208.md): OpenClaw \< 2026.6.5 Authorization Header Forwarding via SSE (CVSS 6.0, OpenClaw)
- [CVE-2026-62207](https://cve.now/CVE-2026-62207.md): OpenClaw \< 2026.6.5 Authentication Bypass via Admin Tools (CVSS 7.7, OpenClaw)
- [CVE-2026-62206](https://cve.now/CVE-2026-62206.md): OpenClaw \< 2026.6.9 Authentication Bypass via Moderation Actions (CVSS 6.0, OpenClaw)
- [CVE-2026-62205](https://cve.now/CVE-2026-62205.md): OpenClaw 2026.4.12-beta.1 \< 2026.6.6 Authorization Bypass via message actions (CVSS 6.0, OpenClaw)
- [CVE-2026-62203](https://cve.now/CVE-2026-62203.md): OpenClaw \< 2026.6.6 Environment Variable Injection via rustup (CVSS 7.7, OpenClaw)
- [CVE-2026-62202](https://cve.now/CVE-2026-62202.md): OpenClaw 2026.6.1 \< 2026.6.9 Privilege Escalation via Cron (CVSS 7.7, OpenClaw)
- [CVE-2026-62201](https://cve.now/CVE-2026-62201.md): OpenClaw \< 2026.6.6 Network Policy Bypass via exec-server (CVSS 4.9, OpenClaw)
- [CVE-2026-44251](https://cve.now/CVE-2026-44251.md): Wazuh : size\_t underflow in msgs.c ReadSecMSG causes wazuh-remoted DoS and potential heap overflow via crafted agent message (CVSS 6.5, wazuh)
- [CVE-2025-51677](https://cve.now/CVE-2025-51677.md): An issue was discovered in openRISC OR1200 commit 83ac6b. (CVSS 9.1)
- [CVE-2025-51678](https://cve.now/CVE-2025-51678.md): An issue was discovered in RISC-V PicoRV32 commit 87c89a. (CVSS 7.5)
- [CVE-2025-60357](https://cve.now/CVE-2025-60357.md): AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentEvent/list endpoint. (CVSS 8.1)
- [CVE-2026-36669](https://cve.now/CVE-2026-36669.md): An unauthenticated arbitrary file upload vulnerability in ck\_upload\_handler.php in Feng Office 3.11.13.11 allows remote attackers to upload (CVSS 9.8)
- [CVE-2026-42168](https://cve.now/CVE-2026-42168.md): django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd\_receive and cmd\_send fields on the Partner model. (CVSS 9.1)
- [CVE-2026-51080](https://cve.now/CVE-2026-51080.md): libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity (XXE) vulnerability. (CVSS 9.8)
- [CVE-2026-51081](https://cve.now/CVE-2026-51081.md): A cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and Proxmox Virtual Environment (PVE) 8.x 4.3.16 a (CVSS 6.1)
- [CVE-2026-51082](https://cve.now/CVE-2026-51082.md): A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x pve-manager before 9.1.9 and 8.x b (CVSS 7.2)
- [CVE-2026-51083](https://cve.now/CVE-2026-51083.md): Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited (CVSS 6.5)
- [CVE-2026-51833](https://cve.now/CVE-2026-51833.md): Xenforo 2.3.8 is vulnerable to SSRF. (CVSS 7.5)
- [CVE-2026-52199](https://cve.now/CVE-2026-52199.md): An issue in Generic OEM UZ801\_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component (CVSS 9.1)
- [CVE-2026-52203](https://cve.now/CVE-2026-52203.md): An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter. (CVSS 7.5)
- [CVE-2026-52348](https://cve.now/CVE-2026-52348.md): cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java. (CVSS 9.8)
- [CVE-2026-52584](https://cve.now/CVE-2026-52584.md): Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG (CVSS 7.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-07-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.