# CVEs published 2026-07-20

266 CVEs were published on July 20, 2026: 45 critical, 101 high. Days are UTC.

- [CVE-2026-16327](https://cve.now/CVE-2026-16327.md): D-Link DNS-320 upload.php unrestricted upload (CVSS 6.9, D-Link DNS-320)
- [CVE-2026-63728](https://cve.now/CVE-2026-63728.md): Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Feature (CVSS 8.1, gitleaks)
- [CVE-2026-55833](https://cve.now/CVE-2026-55833.md): Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation (CVSS 7.5, netty · io.netty:netty-codec-http)
- [CVE-2026-55831](https://cve.now/CVE-2026-55831.md): Netty SPDY SETTINGS frame count materializes unbounded settings map (CVSS 7.5, netty · io.netty:netty-codec-http)
- [CVE-2026-15905](https://cve.now/CVE-2026-15905.md): Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap corruption via a malici (CVSS 7.8, Google Chrome)
- [CVE-2026-15904](https://cve.now/CVE-2026-15904.md): Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specif (CVSS 8.8, Google Chrome)
- [CVE-2026-15903](https://cve.now/CVE-2026-15903.md): Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a san (CVSS 8.8, Google Chrome)
- [CVE-2026-15902](https://cve.now/CVE-2026-15902.md): Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-15901](https://cve.now/CVE-2026-15901.md): Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to potentially exploit heap corruption via a cr (CVSS 9.6, Google Chrome)
- [CVE-2026-15900](https://cve.now/CVE-2026-15900.md): Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape (CVSS 9.6, Google Chrome)
- [CVE-2026-15899](https://cve.now/CVE-2026-15899.md): Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox e (CVSS 9.6, Google Chrome)
- [CVE-2026-57495](https://cve.now/CVE-2026-57495.md): AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake) (CVSS 8.2, @agenticmail/core · @agenticmail/claudecode +2)
- [CVE-2026-57852](https://cve.now/CVE-2026-57852.md): Authentication Bypass via Null Short-Circuit in Grav CMS Scheduler Webhook Token Check (CVSS 5.6, Trilby Media Grav CMS scheduler-webhook plugin)
- [CVE-2026-57494](https://cve.now/CVE-2026-57494.md): AgenticMail: Cross-agent task authorization bypass in AgenticMail API (CVSS 7.1, @agenticmail/api)
- [CVE-2026-47255](https://cve.now/CVE-2026-47255.md): AgenticMail API/storage and outbound relay hardening (CVSS 8.2, @agenticmail/api · @agenticmail/core)
- [CVE-2026-64626](https://cve.now/CVE-2026-64626.md): AVideo Encoder downloadURL SSRF via unpinned retry fallback (CVSS 5.3, WWBN AVideo)
- [CVE-2026-64625](https://cve.now/CVE-2026-64625.md): AVideo before 29.0 OS Command Injection via execAsync (CVSS 9.3, WWBN AVideo)
- [CVE-2026-64624](https://cve.now/CVE-2026-64624.md): FreeRDP RDP File Parser Remote Code Execution via CLI Options (CVSS 8.5, FreeRDP)
- [CVE-2026-47144](https://cve.now/CVE-2026-47144.md): Shamefile has an arbitrary file read via shamefile.yaml in shame next (CVSS 5.5, BKDDFS shamefile · shamefile)
- [CVE-2026-47128](https://cve.now/CVE-2026-47128.md): nono: Sandbox escape on Linux via D-Bus: \`systemd-run --user\` (CVSS 6.1, always-further nono · nono-cli)
- [CVE-2026-16324](https://cve.now/CVE-2026-16324.md): Metasoft 美特软件 MetaCRM upload.jsp unrestricted upload (CVSS 6.9, Metasoft 美特软件 MetaCRM)
- [CVE-2026-12900](https://cve.now/CVE-2026-12900.md): Spectra Gutenberg Blocks \<= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block (CVSS 6.4, brainstormforce Spectra Legacy – Gutenberg Blocks)
- [CVE-2026-47134](https://cve.now/CVE-2026-47134.md): ClearanceKit: Policy signing key in System Keychain has permissive ACL allowing any local-root process to forge signed policy (CVSS 6.9, craigjbass clearancekit)
- [CVE-2026-47133](https://cve.now/CVE-2026-47133.md): ClearanceKit's signed policy tables lack monotonic counter, allowing replay of older legitimately-signed snapshots (CVSS 6.9, craigjbass clearancekit)
- [CVE-2026-55550](https://cve.now/CVE-2026-55550.md): NextCRM has RBAC Bypass in MCP Product Tools that Allows Low-Privileged Users to Modify the CRM Product Catalog (CVSS 7.1, pdovhomilja nextcrm-app)
- [CVE-2026-55544](https://cve.now/CVE-2026-55544.md): NextCRM has BOLA/IDOR in MCP Campaign Tools that Allows Cross-User Campaign Disclosure and Tampering (CVSS 7.6, pdovhomilja nextcrm-app)
- [CVE-2026-47130](https://cve.now/CVE-2026-47130.md): NextCRM has a BOLA/IDOR in PATCH /api/crm/contacts/\[id\] that allows Cross-Tenant CRM Data Tampering (CVSS 7.1, pdovhomilja nextcrm-app)
- [CVE-2026-47129](https://cve.now/CVE-2026-47129.md): NextCRM has Broken Access Control in Server Actions that allows any authenticated user to deactivate/activate arbitrary accounts (CVSS 8.1, pdovhomilja nextcrm-app)
- [CVE-2026-56623](https://cve.now/CVE-2026-56623.md): Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows (CVSS 7.1, Apache Software Foundation Apache MINA SSHD)
- [CVE-2026-56624](https://cve.now/CVE-2026-56624.md): Apache MINA SSHD: SSH certificate options lack validations (CVSS 7.3, Apache Software Foundation Apache MINA SSHD)
- [CVE-2026-64650](https://cve.now/CVE-2026-64650.md): AI SDK Codex Harness Tool Relay Authorization Bypass (CVSS 6.3, vercel @ai-sdk/harness-codex)
- [CVE-2026-58624](https://cve.now/CVE-2026-58624.md): Apache MINA SSHD: Remote execution of JGit commands can write files on the server (CVSS 5.4, Apache Software Foundation Apache MINA SSHD)
- [CVE-2026-56452](https://cve.now/CVE-2026-56452.md): Apache MINA SSHD: Path traversal in SCP file reception (CVSS 7.5, Apache Software Foundation Apache MINA SSHD)
- [CVE-2026-64651](https://cve.now/CVE-2026-64651.md): AI SDK OpenCode Harness Tool Relay Authorization Bypass (CVSS 6.3, vercel @ai-sdk/harness-opencode)
- [CVE-2026-55219](https://cve.now/CVE-2026-55219.md): Paymenter: Race condition in payWithCredit() enables credit double-spend (CVSS 5.3, Paymenter · paymenter/paymenter)
- [CVE-2026-47198](https://cve.now/CVE-2026-47198.md): Paymenter: URL parameter injection bypasses paid plan limits at checkout (CVSS 8.5, Paymenter · paymenter/paymenter)
- [CVE-2026-53596](https://cve.now/CVE-2026-53596.md): FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS) (CVSS 5.3, freescout-help-desk freescout)
- [CVE-2026-53595](https://cve.now/CVE-2026-53595.md): FreeScout vulnerable to anonymous account takeover via /user-setup empty invite\_hash on MySQL (CVSS 9.4, freescout-help-desk freescout)
- [CVE-2026-13381](https://cve.now/CVE-2026-13381.md): VSee Clinic and API Insecure Direct Object Reference in File API Allows Unauthorized File Access and Deletion (CVSS 8.7, VSee Clinic)
- [CVE-2026-53594](https://cve.now/CVE-2026-53594.md): FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path (CVSS 4.9, freescout-help-desk freescout)
- [CVE-2026-13380](https://cve.now/CVE-2026-13380.md): VSee Clinic and API Exposes Cleartext SFTP Credentials in Unauthenticated HTTP Responses (CVSS 9.0, VSee Clinic)
- [CVE-2026-44585](https://cve.now/CVE-2026-44585.md): Paymenter: Broken object level authorization via service reference manipulation on ticket creation (CVSS 5.4, Paymenter · paymenter/paymenter)
- [CVE-2026-44583](https://cve.now/CVE-2026-44583.md): Paymenter: Blind Unauthenticated SSRF on the Paypal gateway module (CVSS 5.3, Paymenter · paymenter/paymenter)
- [CVE-2026-44584](https://cve.now/CVE-2026-44584.md): Paymenter doesn't reset email verification status after email change (CVSS 4.3, Paymenter · paymenter/paymenter)
- [CVE-2026-53593](https://cve.now/CVE-2026-53593.md): FreeScout Vulnerable to Authenticated Remote Code Execution via incomplete upload extension denylist (.pht) — bypass of CVE-2025-48471 (CVSS 8.8, freescout-help-desk freescout)
- [CVE-2026-53592](https://cve.now/CVE-2026-53592.md): FreeScout vulnerable to prototype pollution in getQueryParam (CVSS 4.6, freescout-help-desk freescout)
- [CVE-2026-53591](https://cve.now/CVE-2026-53591.md): FreeScout Vulnerable to Unauthenticated Conversation Thread Injection via HMAC Length Bypass in FetchEmails (CVSS 8.6, freescout-help-desk freescout)
- [CVE-2026-44230](https://cve.now/CVE-2026-44230.md): RT: Reflected Cross-Site Scripting in search results chart (CVSS 6.1, bestpractical rt)
- [CVE-2026-44231](https://cve.now/CVE-2026-44231.md): RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint (CVSS 9.1, bestpractical rt)
- [CVE-2026-44229](https://cve.now/CVE-2026-44229.md): RT: Cross-Site Scripting via inline-served uploaded content (CVSS 5.4, bestpractical rt)
- [CVE-2026-63766](https://cve.now/CVE-2026-63766.md): GPT-SoVITS 20250606v2pro OS Command Injection via webui.py (CVSS 9.3, RVC-Boss GPT-SoVITS)
- [CVE-2026-16337](https://cve.now/CVE-2026-16337.md): Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms (CVSS 9.4, dotCMS)
- [CVE-2026-63767](https://cve.now/CVE-2026-63767.md): ktransformers Unauthenticated Pickle Deserialization RCE via ZMQ (CVSS 9.3, kvcache-ai ktransformers)
- [CVE-2026-15788](https://cve.now/CVE-2026-15788.md): WCOW cache mount source selector resolves NTFS junctions outside of cache root (CVSS 5.6, moby BuildKit)
- [CVE-2026-63768](https://cve.now/CVE-2026-63768.md): cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State (CVSS 5.3, calcom cal.diy)
- [CVE-2026-63769](https://cve.now/CVE-2026-63769.md): Huginn \< 2026.09.09 SSRF via ScenarioImport fetch\_url Method (CVSS 6.3, huginn)
- [CVE-2026-63770](https://cve.now/CVE-2026-63770.md): Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypass (CVSS 8.2, glanceapp glance)
- [CVE-2026-63771](https://cve.now/CVE-2026-63771.md): Adminer \< 5.4.3 Cookie Injection via X-Forwarded-Prefix Header (CVSS 6.0, vrana adminer)
- [CVE-2026-64619](https://cve.now/CVE-2026-64619.md): FileCodeBox \< 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers (CVSS 8.7, vastsa FileCodeBox)
- [CVE-2026-61425](https://cve.now/CVE-2026-61425.md): Joomla Extension - balbooa.com - Authentication bypass in Gridbox \< 1.6.0 (CVSS 9.4, balbooa.com Gridbox extension for Joomla)
- [CVE-2026-63731](https://cve.now/CVE-2026-63731.md): HyperDX \< 2.31.0 SSRF via ClickHouse Proxy Test Endpoint (CVSS 6.3, hyperdxio hyperdx)
- [CVE-2026-63730](https://cve.now/CVE-2026-63730.md): HyperDX \< 2.31.0 SSRF via Webhook Test Endpoint (CVSS 5.3, hyperdxio hyperdx)
- [CVE-2026-61424](https://cve.now/CVE-2026-61424.md): Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds \< 3.11.2 (CVSS 10.0, dj-extensions.com DJ-Classifieds extension for Joomla)
- [CVE-2026-62414](https://cve.now/CVE-2026-62414.md): Joomla Extension - joomlack.fr - Improper access control in Page Builder CK \< 3.6.2 (CVSS 9.1, joomlack.fr Page Builder CK extension for Joomla)
- [CVE-2026-61900](https://cve.now/CVE-2026-61900.md): Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads \< 4.1.6 (CVSS 10.0, dj-extensions.com jDownloads extension for Joomla)
- [CVE-2026-61901](https://cve.now/CVE-2026-61901.md): Joomla Extension - hikashop.com - Open redirect in Hikashop \< 6.5.2 (CVSS 6.1, hikashop.com Hikashop extension for Joomla)
- [CVE-2026-63108](https://cve.now/CVE-2026-63108.md): Roo Code 3.54.0 Command Injection via Parameter Expansion Parsing (CVSS 7.7, RooCodeInc Roo-Code)
- [CVE-2026-12341](https://cve.now/CVE-2026-12341.md): SailPoint IdentityIQ Improper Bearer Token Validation Vulnerability (CVSS 8.8, SailPoint Technologies IdentityIQ)
- [CVE-2026-60027](https://cve.now/CVE-2026-60027.md): Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder \< 6.2.1 (CVSS 8.7, themexpert.com Quix Page Builder Pro extension for Joomla)
- [CVE-2026-48389](https://cve.now/CVE-2026-48389.md): DNG SDK | Stack-based Buffer Overflow (CWE-121) (CVSS 7.8, Adobe DNG Software Development Kit)
- [CVE-2026-63107](https://cve.now/CVE-2026-63107.md): LimeSurvey SSRF via REST API Survey Template Host Header (CVSS 6.3, LimeSurvey)
- [CVE-2026-60031](https://cve.now/CVE-2026-60031.md): Joomla Extension - themexpert.com - Information disclosure in Quix Page Builder \< 6.2.1 (CVSS 6.9, themexpert.com Quix Page Builder Pro extension for Joomla)
- [CVE-2026-60029](https://cve.now/CVE-2026-60029.md): Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder \< 6.2.1 (CVSS 5.1, themexpert.com Quix Page Builder Pro extension for Joomla)
- [CVE-2026-60026](https://cve.now/CVE-2026-60026.md): Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder \< 6.2.1 (CVSS 8.9, themexpert.com Quix Page Builder Pro extension for Joomla)
- [CVE-2026-60034](https://cve.now/CVE-2026-60034.md): Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension \< 1.6.0 (CVSS 9.4, themexpert.com JMedia extension for Joomla)
- [CVE-2026-60030](https://cve.now/CVE-2026-60030.md): Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder \< 6.2.1 (CVSS 8.7, themexpert.com Quix Page Builder Pro extension for Joomla)
- [CVE-2026-60033](https://cve.now/CVE-2026-60033.md): Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension \< 1.6.0 (CVSS 5.1, themexpert.com JMedia extension for Joomla)
- [CVE-2026-60032](https://cve.now/CVE-2026-60032.md): Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia \< 1.6.0 (CVSS 9.4, themexpert.com JMedia extension for Joomla)
- [CVE-2026-60028](https://cve.now/CVE-2026-60028.md): Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder \< 6.2.1 (CVSS 8.6, themexpert.com Quix Page Builder Pro extension for Joomla)
- [CVE-2026-64194](https://cve.now/CVE-2026-64194.md): Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains (CVSS 7.5, NLNETLABS Net::DNS)
- [CVE-2026-64193](https://cve.now/CVE-2026-64193.md): Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR (CVSS 9.8, NLNETLABS Net::DNS)
- [CVE-2026-44228](https://cve.now/CVE-2026-44228.md): RT: Stored Cross-Site Scripting via insufficient template escaping (CVSS 5.4, bestpractical rt)
- [CVE-2026-8170](https://cve.now/CVE-2026-8170.md): ExtremeXOS Privilege Escalation via Symlink Following in File Utilities (CVSS 8.7, Extreme Networks Switch Engine)
- [CVE-2026-8169](https://cve.now/CVE-2026-8169.md): ExtremeXOS Debug-Mode Privilege Escalation via Weak PRNG (CVSS 8.7, Extreme Networks Switch Engine)
- [CVE-2026-64612](https://cve.now/CVE-2026-64612.md): Libcupsfilters: cups-filters: libcupsfilters: cups image filter process abort via malformed png (CVSS 7.5, Red Hat Enterprise Linux)
- [CVE-2026-44227](https://cve.now/CVE-2026-44227.md): RT: Reflected Cross-Site Scripting via URL parameters (CVSS 6.1, bestpractical rt)
- [CVE-2026-48812](https://cve.now/CVE-2026-48812.md): FreeScout Allows Unauthenticated Access to Legacy Attachment Files (CVSS 7.5, freescout-help-desk freescout)
- [CVE-2026-45295](https://cve.now/CVE-2026-45295.md): FreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpoint (CVSS 6.5, freescout-help-desk freescout)
- [CVE-2026-55639](https://cve.now/CVE-2026-55639.md): xrdp: Out-of-bounds read in GCC Conference Create Request CS\_SECURITY processing (xrdp\_sec\_process\_mcs\_data\_CS\_SECURITY) (CVSS 5.3, neutrinolabs xrdp)
- [CVE-2026-55626](https://cve.now/CVE-2026-55626.md): xrdp: No authentication required with Xvnc backend on RHEL 9 (CVSS 8.0, neutrinolabs xrdp)
- [CVE-2026-34239](https://cve.now/CVE-2026-34239.md): Chamilo Authenticated Remote Code Execution (CVSS 7.5, chamilo-lms)
- [CVE-2026-46715](https://cve.now/CVE-2026-46715.md): Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance (CVSS 5.3, pallets-eco Flask-Security-Too · flask-security-too)
- [CVE-2026-39878](https://cve.now/CVE-2026-39878.md): Chamilo stored XSS via user registration leads to admin account takeover (CVSS 9.3, chamilo-lms)
- [CVE-2026-46555](https://cve.now/CVE-2026-46555.md): WhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltration (CVSS 7.7, verygoodplugins whatsapp-mcp)
- [CVE-2026-55238](https://cve.now/CVE-2026-55238.md): xrdp: Malformed Confirm Active capability sets cause out-of-bounds reads (CVSS 5.3, neutrinolabs xrdp)
- [CVE-2026-42210](https://cve.now/CVE-2026-42210.md): Webmin 2FA requirement bypass (CVSS 5.3, webmin)
- [CVE-2026-58484](https://cve.now/CVE-2026-58484.md): Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning (CVSS 7.1, Jovancoding Network-AI · network-ai)
- [CVE-2026-40187](https://cve.now/CVE-2026-40187.md): Authenticated RCE via Malicious eTemplate Upload in EGroupware (CVSS 8.6, egroupware · egroupware/egroupware)
- [CVE-2026-54538](https://cve.now/CVE-2026-54538.md): xrdp: Pre-auth infinite loop via totalLength=0 in TS\_SHARECONTROLHEADER (CVSS 7.5, neutrinolabs xrdp)
- [CVE-2026-39879](https://cve.now/CVE-2026-39879.md): SQL injection in syslog-ng SQL destionation driver (CVSS 7.1, syslog-ng)
- [CVE-2026-44978](https://cve.now/CVE-2026-44978.md): xrdp: Unchecked FIPS padding length in standard RDP Security causes heap out-of-bounds read in HMAC verification (CVSS 5.3, neutrinolabs xrdp)
- [CVE-2026-39385](https://cve.now/CVE-2026-39385.md): Frappe LMS enrollment bypass in paid courses via unrelated batch (CVSS 7.1, frappe lms)
- [CVE-2026-44178](https://cve.now/CVE-2026-44178.md): xrdp: Channel Data Forwarding Fixed-Size Buffer Overflow (CVSS 8.8, neutrinolabs xrdp)
- [CVE-2026-50743](https://cve.now/CVE-2026-50743.md): A CSRF vulnerability exists in the \`zone-include.php\` script in Revive Adserver 6.0.7. (CVSS 5.4, Revive Adserver)
- [CVE-2026-55645](https://cve.now/CVE-2026-55645.md): xrdp: Out-of-bounds read in Client Control PDU processing (xrdp\_rdp\_process\_data\_control) (CVSS 6.5, neutrinolabs xrdp)
- [CVE-2026-47276](https://cve.now/CVE-2026-47276.md): NULL Pointer Dereference in REST API properties\_parse via Malformed user\_properties (CVSS 6.5, nanomq)
- [CVE-2026-42218](https://cve.now/CVE-2026-42218.md): XRDP is vulnerable to a server timing attack, leading to user enumeration (CVSS 5.3, neutrinolabs xrdp)
- [CVE-2026-47275](https://cve.now/CVE-2026-47275.md): nanomq NULL Pointer Dereference in MQTTv5 Client CONNECT Decoder Leading to Remote DoS (CVSS 2.6, nanomq)
- [CVE-2026-41521](https://cve.now/CVE-2026-41521.md): xrdp: lib\_framebuffer\_update Has Integer Overflow Heap Info Leak & ASLR Bypass (CVSS 8.2, neutrinolabs xrdp)
- [CVE-2026-35217](https://cve.now/CVE-2026-35217.md): NanoMQ Incorrectly Accepts a Malformed SUBSCRIBE and Can Be Driven into an ASAN-Detectable Out-of-Bounds Read (CVSS 6.5, nanomq)
- [CVE-2026-58482](https://cve.now/CVE-2026-58482.md): Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions (CVSS 5.9, Jovancoding Network-AI · network-ai)
- [CVE-2026-46701](https://cve.now/CVE-2026-46701.md): Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret (CVSS 7.6, Jovancoding Network-AI · network-ai)
- [CVE-2026-58481](https://cve.now/CVE-2026-58481.md): Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory (CVSS 6.5, Jovancoding Network-AI · network-ai)
- [CVE-2026-41252](https://cve.now/CVE-2026-41252.md): xrdp: lib\_palette\_update Heap Buffer Overflow & RCE (CVSS 9.8, neutrinolabs xrdp)
- [CVE-2026-58414](https://cve.now/CVE-2026-58414.md): Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups (CVSS 5.5, Jovancoding Network-AI · network-ai)
- [CVE-2026-64207](https://cve.now/CVE-2026-64207.md): net/sched: dualpi2: fix GSO backlog accounting (no CVSS, Linux)
- [CVE-2026-64206](https://cve.now/CVE-2026-64206.md): Bluetooth: L2CAP: cancel pending\_rx\_work before taking conn-\>lock (CVSS 8.8, Linux)
- [CVE-2026-64205](https://cve.now/CVE-2026-64205.md): i2c: i801: fix hardware state machine corruption in error path (no CVSS, Linux)
- [CVE-2026-64192](https://cve.now/CVE-2026-64192.md): bpf: Reject BPF\_MAP\_TYPE\_INODE\_STORAGE creation if BPF LSM is uninitialized (no CVSS, Linux)
- [CVE-2026-64191](https://cve.now/CVE-2026-64191.md): i2c: stub: Reject I2C block transfers with invalid length (CVSS 7.8, Linux)
- [CVE-2026-64190](https://cve.now/CVE-2026-64190.md): net: team: fix NULL pointer dereference in team\_xmit during mode change (no CVSS, Linux)
- [CVE-2026-64189](https://cve.now/CVE-2026-64189.md): netfilter: ipset: fix race between dump and ip\_set\_list resize (CVSS 7.8, Linux)
- [CVE-2026-64188](https://cve.now/CVE-2026-64188.md): net: qualcomm: rmnet: fix endpoint use-after-free in rmnet\_dellink() (CVSS 7.8, Linux)
- [CVE-2026-64187](https://cve.now/CVE-2026-64187.md): xfs: fail recovery on a committed log item with no regions (no CVSS, Linux)
- [CVE-2026-35048](https://cve.now/CVE-2026-35048.md): Piwigo RCE via PHP Code Injection into Config File in Installer (CVSS 9.8, Piwigo)
- [CVE-2026-58413](https://cve.now/CVE-2026-58413.md): EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data (CVSS 6.1, Jovancoding Network-AI · network-ai)
- [CVE-2026-35591](https://cve.now/CVE-2026-35591.md): Possible heap-based buffer overflow when decoding TIFF image containing well-crafted tile (CVSS 7.0, libvips)
- [CVE-2026-54051](https://cve.now/CVE-2026-54051.md): Network-AI has an an OS Command Injection issue (CVSS 9.9, Jovancoding Network-AI · network-ai)
- [CVE-2026-35590](https://cve.now/CVE-2026-35590.md): Possible out-of-bounds read leading to crash when decoding well-crafted EXIF metadata (CVSS 6.8, libvips)
- [CVE-2026-33328](https://cve.now/CVE-2026-33328.md): Possible integer overflow on 32-bit systems when reading GIF images (CVSS 6.8, libvips)
- [CVE-2026-33327](https://cve.now/CVE-2026-33327.md): Possible integer overflow leading to potential heap-based buffer overflow (CVSS 7.0, libvips)
- [CVE-2026-32825](https://cve.now/CVE-2026-32825.md): dataCycle No Brute-Force Protection On Web And API Login Endpoints (CVSS 7.3, datacycle-engine dataCycle-CORE)
- [CVE-2026-32824](https://cve.now/CVE-2026-32824.md): dataCycle User API Password Reset And Confirmation Flows Trust Attacker- Controlled Redirect Targets (CVSS 7.3, datacycle-engine dataCycle-CORE)
- [CVE-2026-32823](https://cve.now/CVE-2026-32823.md): dataCycle State-Changing GET Endpoints Enable CSRF (CVSS 4.3, datacycle-engine dataCycle-CORE)
- [CVE-2026-32821](https://cve.now/CVE-2026-32821.md): API Collection Impersonation Via user\_email And Missing Object- Level Authorization (CVSS 8.1, datacycle-engine dataCycle-CORE)
- [CVE-2026-32806](https://cve.now/CVE-2026-32806.md): dataCycle Authorization Bypass Via /remote\_render (CVSS 7.5, datacycle-engine dataCycle-CORE)
- [CVE-2026-32820](https://cve.now/CVE-2026-32820.md): dataCycle Public Markdown Path Traversal Via /docs/\*path (CVSS 7.5, datacycle-engine dataCycle-CORE)
- [CVE-2026-32819](https://cve.now/CVE-2026-32819.md): dataCycle User Directory Enumeration Via /users/search (CVSS 4.3, datacycle-engine dataCycle-CORE)
- [CVE-2026-46671](https://cve.now/CVE-2026-46671.md): Rust OneNote File Parser: Path traversal in \`Parser::parse\_notebook\` allows reading files outside the notebook directory (CVSS 4.4, msiemens onenote.rs · onenote\_parser)
- [CVE-2026-63429](https://cve.now/CVE-2026-63429.md): HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context (CVSS 8.6, heyform)
- [CVE-2026-63428](https://cve.now/CVE-2026-63428.md): HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field set (CVSS 5.8, heyform)
- [CVE-2026-35198](https://cve.now/CVE-2026-35198.md): HeyForm vulnerable to stored XSS via form field titles (CVSS 9.0, heyform)
- [CVE-2026-45797](https://cve.now/CVE-2026-45797.md): HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload (CVSS 6.4, heyform)
- [CVE-2026-46428](https://cve.now/CVE-2026-46428.md): lettre has TLS hostname verification disabled when using Boring TLS backend (CVSS 9.1, lettre)
- [CVE-2026-32822](https://cve.now/CVE-2026-32822.md): dataCycle Unauthenticated Reflected DOM XSS Via flash\[...\] On Public Pages (CVSS 6.1, datacycle-engine dataCycle-CORE)
- [CVE-2026-32807](https://cve.now/CVE-2026-32807.md): dataCycle Public DataLink Text File Download Ignores Validity And Authorization (CVSS 7.5, datacycle-engine dataCycle-CORE)
- [CVE-2026-63102](https://cve.now/CVE-2026-63102.md): rConfig Core \< 8.2.8 Privilege Escalation via Users API role field (CVSS 5.3, rConfig v8 Core)
- [CVE-2026-28220](https://cve.now/CVE-2026-28220.md): Wazuh cluster DAPI arbitrary callable deserialization and RBAC context injection allow a cluster peer to execute privileged functions on the master node (CVSS 8.4, wazuh)
- [CVE-2026-6793](https://cve.now/CVE-2026-6793.md): Stored XSS in Bifra Engineering's Q-smart NexT Poll (CVSS 5.4, Bifra Engineering Consulting Q-smart NexT Poll)
- [CVE-2026-27823](https://cve.now/CVE-2026-27823.md): Remote Code Execution Vulnerability in EGroupware (CVSS 8.7, egroupware · egroupware/egroupware)
- [CVE-2026-46415](https://cve.now/CVE-2026-46415.md): Caddy Defender trusted proxy client IP bypass (CVSS 8.2, JasonLovesDoggo caddy-defender · pkg.jsn.cam/caddy-defender)
- [CVE-2026-21824](https://cve.now/CVE-2026-21824.md): A privilege escalation vulnerability affects HCL Commerce (CVSS 8.8, HCLSoftware Commerce)
- [CVE-2026-48824](https://cve.now/CVE-2026-48824.md): Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw) (CVSS 5.3, axllent mailpit · github.com/axllent/mailpit)
- [CVE-2026-45713](https://cve.now/CVE-2026-45713.md): Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes (CVSS 7.5, axllent mailpit · github.com/axllent/mailpit)
- [CVE-2026-45712](https://cve.now/CVE-2026-45712.md): Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write) (CVSS 5.9, axllent mailpit · github.com/axllent/mailpit)
- [CVE-2026-26199](https://cve.now/CVE-2026-26199.md): Buffer underflow in \`H5Iget\_name \`/\`H5G\_get\_name\` if size is zero (CVSS 5.9, HDFGroup hdf5)
- [CVE-2026-26197](https://cve.now/CVE-2026-26197.md): Array full size, element count, and element size are not checked to make sure they match in H5Odtype.c (CVSS 5.9, HDFGroup hdf5)
- [CVE-2026-25039](https://cve.now/CVE-2026-25039.md): The application evaluate UNC path in workspace name (CVSS 8.8, Scille parsec-cloud)
- [CVE-2026-45711](https://cve.now/CVE-2026-45711.md): Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs (CVSS 5.9, axllent mailpit · github.com/axllent/mailpit)
- [CVE-2026-45709](https://cve.now/CVE-2026-45709.md): Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer (CVSS 5.8, axllent mailpit · github.com/axllent/mailpit)
- [CVE-2026-13724](https://cve.now/CVE-2026-13724.md): Business Logic Bypass in Gobito's Corporate Training Management System (CVSS 4.3, Gobito Informatics Technologies Engineering Industry and Tr…)
- [CVE-2026-46412](https://cve.now/CVE-2026-46412.md): Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm (CVSS 10.0, beproduct-org-nestjs-auth · @beproduct/nestjs-auth)
- [CVE-2026-62418](https://cve.now/CVE-2026-62418.md): Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check (CVSS 8.1, Apache Software Foundation Apache Syncope)
- [CVE-2026-46516](https://cve.now/CVE-2026-46516.md): Frogman vulnerable to stored XSS in chat console formatter (escalation vector in multi-admin deployments) (CVSS 4.8, mwtcmi frogman)
- [CVE-2026-62183](https://cve.now/CVE-2026-62183.md): Apache Syncope: User self-service privilege escalation (CVSS 9.8, Apache Software Foundation Apache Syncope)
- [CVE-2026-63091](https://cve.now/CVE-2026-63091.md): ProFTPD mod\_sftp Signed Integer Overflow via SCP Size-Record Parser (CVSS 7.1, proftpd)
- [CVE-2026-63090](https://cve.now/CVE-2026-63090.md): ProFTPD mod\_sftp Heap Buffer Overflow via SFTP Packet Reassembly (CVSS 8.7, proftpd)
- [CVE-2026-57308](https://cve.now/CVE-2026-57308.md): Apache Syncope: SQL injection vulnerability in Audit Events search (CVSS 9.8, Apache Software Foundation Apache Syncope)
- [CVE-2026-53421](https://cve.now/CVE-2026-53421.md): Apache Syncope: Remote Code Execution via Scripted Connector (CVSS 9.8, Apache Software Foundation Apache Syncope)
- [CVE-2026-54910](https://cve.now/CVE-2026-54910.md): FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files (CVSS 7.7, gtsteffaniak filebrowser · github.com/gtsteffaniak/filebrow…)
- [CVE-2026-53405](https://cve.now/CVE-2026-53405.md): Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask (CVSS 9.8, Apache Software Foundation Apache Syncope)
- [CVE-2026-63071](https://cve.now/CVE-2026-63071.md): Apache Syncope: RCE via Groovy Sandbox bypass (CVSS 9.8, Apache Software Foundation Apache Syncope)
- [CVE-2026-12701](https://cve.now/CVE-2026-12701.md): Pulpcore: pulpcore: relative\_path\_validator bypass via directory traversal in filesystemexport (CVSS 9.0, Red Hat Ansible Automation Platform 2.5 for RHEL · Red H… +7)
- [CVE-2026-54685](https://cve.now/CVE-2026-54685.md): FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel (CVSS 5.3, gtsteffaniak filebrowser · github.com/gtsteffaniak/filebrow…)
- [CVE-2026-46410](https://cve.now/CVE-2026-46410.md): FileBrowser Quantum: unauthenticated user share share info (CVSS 8.7, gtsteffaniak filebrowser · github.com/gtsteffaniak/fileb… +1)
- [CVE-2026-45270](https://cve.now/CVE-2026-45270.md): CI4MS: Stored XSS in Pages Module Content via Broken html\_purify Validation Rule (CVSS 8.7, ci4-cms-erp ci4ms · ci4-cms-erp/ci4ms)
- [CVE-2026-16277](https://cve.now/CVE-2026-16277.md): Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbaddrlist() (CVSS 6.5, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-16252](https://cve.now/CVE-2026-16252.md): Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System Staffshinel Ds.jsp sql injection (CVSS 6.9, Beijing Shenzhou Shihan Technology Multimedia Integrated Bu…)
- [CVE-2026-45139](https://cve.now/CVE-2026-45139.md): CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations (CVSS 6.5, ci4-cms-erp ci4ms · ci4-cms-erp/ci4ms)
- [CVE-2026-59238](https://cve.now/CVE-2026-59238.md): Stored XSS in Pentestify via unsanitized finding images and report client logo (CVSS 6.9, maalfer Pentestify)
- [CVE-2026-57311](https://cve.now/CVE-2026-57311.md): Unrestricted Upload of File with Dangerous Type in Windu CMS (CVSS 5.3, JCD Windu CMS)
- [CVE-2026-57310](https://cve.now/CVE-2026-57310.md): Weak password hashing in Windu CMS (CVSS 6.3, JCD Windu CMS)
- [CVE-2026-57309](https://cve.now/CVE-2026-57309.md): Blind SQL Injection in Windu CMS (CVSS 9.3, JCD Windu CMS)
- [CVE-2026-16248](https://cve.now/CVE-2026-16248.md): Tenda AC10 httpd/netctrl AdvSetLanip fromAdvSetLanip stack-based overflow (CVSS 8.7, Tenda AC10)
- [CVE-2026-12080](https://cve.now/CVE-2026-12080.md): Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys (CVSS 7.3, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-16244](https://cve.now/CVE-2026-16244.md): itsourcecode Hospital Management System prescriptionorderreport.php sql injection (CVSS 5.3, itsourcecode Hospital Management System)
- [CVE-2026-15588](https://cve.now/CVE-2026-15588.md): Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering (CVSS 5.3, Red Hat Enterprise Linux · Cert Manager support for Red… +6)
- [CVE-2026-64623](https://cve.now/CVE-2026-64623.md): Network-AI before 5.13.4 Cryptographic Signature Verification Bypass (CVSS 8.8, Jovancoding Network-AI)
- [CVE-2026-64622](https://cve.now/CVE-2026-64622.md): Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox (CVSS 9.3, Jovancoding Network-AI)
- [CVE-2026-64621](https://cve.now/CVE-2026-64621.md): FreeRDP before 3.28.0 Double-Free via selectedmonitors (CVSS 9.3, FreeRDP)
- [CVE-2026-64620](https://cve.now/CVE-2026-64620.md): FreeRDP before 3.28.0 Heap Buffer Overflow via crypto\_rsa\_common (CVSS 9.3, FreeRDP)
- [CVE-2026-63763](https://cve.now/CVE-2026-63763.md): SurrealDB before 2.5.0 Privilege Escalation via Future Fields (CVSS 7.5, surrealdb)
- [CVE-2026-63762](https://cve.now/CVE-2026-63762.md): SurrealDB before v2.6.1 Denial of Service via scripting (CVSS 6.0, surrealdb)
- [CVE-2026-63761](https://cve.now/CVE-2026-63761.md): SurrealDB before 3.1.0 Algorithm Downgrade via ES512 (CVSS 5.3, surrealdb)
- [CVE-2026-63760](https://cve.now/CVE-2026-63760.md): SurrealDB before 3.1.0 Denial of Service via JSON Parser (CVSS 8.7, surrealdb)
- [CVE-2026-63759](https://cve.now/CVE-2026-63759.md): SurrealDB before 3.1.0 Denial of Service nested type annotations (CVSS 7.1, surrealdb)
- [CVE-2026-63758](https://cve.now/CVE-2026-63758.md): SurrealDB before 3.1.0 Authorization Bypass via KILL Statement (CVSS 5.3, surrealdb)
- [CVE-2026-63757](https://cve.now/CVE-2026-63757.md): SurrealDB before 3.1.0 Session Hijacking via /rpc sessions (CVSS 8.7, surrealdb)
- [CVE-2026-63756](https://cve.now/CVE-2026-63756.md): SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition (CVSS 9.2, surrealdb)
- [CVE-2026-63755](https://cve.now/CVE-2026-63755.md): SurrealDB before 3.1.0 Permission Bypass via WHERE Clause (CVSS 7.1, surrealdb)
- [CVE-2026-63754](https://cve.now/CVE-2026-63754.md): SurrealDB before 3.1.0 Denial of Service via LIVE Query (CVSS 7.1, surrealdb)
- [CVE-2026-63753](https://cve.now/CVE-2026-63753.md): SurrealDB before 3.1.0 Authentication Bypass via LIVE Query (CVSS 5.3, surrealdb)
- [CVE-2026-63752](https://cve.now/CVE-2026-63752.md): SurrealDB before 3.1.0 RELATE Statement Record Overwrite (CVSS 5.3, surrealdb)
- [CVE-2026-63751](https://cve.now/CVE-2026-63751.md): SurrealDB before 3.1.0 Field Permission Bypass via JSON Patch (CVSS 5.3, surrealdb)
- [CVE-2026-63750](https://cve.now/CVE-2026-63750.md): SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket (CVSS 6.9, surrealdb)
- [CVE-2026-63749](https://cve.now/CVE-2026-63749.md): SurrealDB before 3.1.0 Authentication Bypass via LIVE SELECT (CVSS 5.3, surrealdb)
- [CVE-2026-63748](https://cve.now/CVE-2026-63748.md): SurrealDB before 3.1.0 Information Disclosure via Error Messages (CVSS 5.3, surrealdb)
- [CVE-2026-63747](https://cve.now/CVE-2026-63747.md): SurrealDB before 3.1.0 Denial of Service via malformed RPC use (CVSS 8.7, surrealdb)
- [CVE-2026-63746](https://cve.now/CVE-2026-63746.md): SurrealDB before 3.1.0 Permission Bypass via Graph Traversal (CVSS 7.1, surrealdb)
- [CVE-2026-63745](https://cve.now/CVE-2026-63745.md): SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id (CVSS 5.3, surrealdb)
- [CVE-2026-63744](https://cve.now/CVE-2026-63744.md): SurrealDB before 3.1.5 SSRF via JWKS URL Redirect (CVSS 5.1, surrealdb)
- [CVE-2026-63743](https://cve.now/CVE-2026-63743.md): SurrealDB before 3.1.0 Port-Specific Deny Rule Bypass via HTTP Redirect (CVSS 5.3, surrealdb)
- [CVE-2026-63742](https://cve.now/CVE-2026-63742.md): SurrealDB before 3.1.0 Field Permission Bypass via Indexed COUNT (CVSS 5.3, surrealdb)
- [CVE-2026-63741](https://cve.now/CVE-2026-63741.md): SurrealDB before 3.1.0 Authentication Bypass via USE statement (CVSS 6.9, surrealdb)
- [CVE-2026-63740](https://cve.now/CVE-2026-63740.md): SurrealDB before 3.1.4 Array Element Permission Bypass (CVSS 7.1, surrealdb)
- [CVE-2026-63739](https://cve.now/CVE-2026-63739.md): SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZER (CVSS 8.3, surrealdb)
- [CVE-2026-63738](https://cve.now/CVE-2026-63738.md): SurrealDB 3.1.0 before 3.1.5 Field Permission Bypass via Traversal (CVSS 5.3, surrealdb)
- [CVE-2026-63737](https://cve.now/CVE-2026-63737.md): SurrealDB before 3.1.5 Denial of Service via deep operator chains (CVSS 7.1, surrealdb)
- [CVE-2026-63736](https://cve.now/CVE-2026-63736.md): SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolution (CVSS 5.1, surrealdb)
- [CVE-2026-63735](https://cve.now/CVE-2026-63735.md): SurrealDB before 3.2.0 Authentication Bypass via Custom API (CVSS 8.6, surrealdb)
- [CVE-2026-63734](https://cve.now/CVE-2026-63734.md): SurrealDB before 3.2.0 Denial of Service via malformed SurrealML import (CVSS 6.9, surrealdb)
- [CVE-2026-63733](https://cve.now/CVE-2026-63733.md): SurrealDB before 3.2.0 Permissions Bypass via PERMISSIONS Clause (CVSS 5.3, surrealdb · surrealdb-core)
- [CVE-2026-16247](https://cve.now/CVE-2026-16247.md): Insecure permission overwrite due to execution of LogPathConfig.exe while installing \_connect.BRAIN (CVSS 7.3, Bizerba SE & Co. KG \_connect.BRAIN)
- [CVE-2026-16246](https://cve.now/CVE-2026-16246.md): Insecure permission assignment due to execution of LogPathConfig.exe during setup (CVSS 7.3, Bizerba SE & Co. KG BRAIN2)
- [CVE-2026-14448](https://cve.now/CVE-2026-14448.md): Authenticated RCE in system\_certificates view (CVSS 8.6, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-16254](https://cve.now/CVE-2026-16254.md): Claircore: claircore: denial of service via out-of-bounds slice in claircore's apk installed-database parser (CVSS 4.3, Red Hat Advanced Cluster Security · Red Hat Quay)
- [CVE-2026-15813](https://cve.now/CVE-2026-15813.md): Kronosnet: kronosnet: memory corruption and out-of-bounds access via malformed network packet defragmentation (CVSS 6.5, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-2445](https://cve.now/CVE-2026-2445.md): Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification (CVSS 6.1, WSO2 API Manager · WSO2 API Control Plane +1)
- [CVE-2026-16242](https://cve.now/CVE-2026-16242.md): Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates (CVSS 9.4, Red Hat multicluster engine for Kubernetes · Red Hat Ope… +3)
- [CVE-2026-13577](https://cve.now/CVE-2026-13577.md): Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable (CVSS 8.2, Dancer2)
- [CVE-2026-16235](https://cve.now/CVE-2026-16235.md): Crypt::Password versions through 0.28 for Perl generate insecure random values for salts (CVSS 9.8, DRSTEVE Crypt::Password)
- [CVE-2026-6656](https://cve.now/CVE-2026-6656.md): Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks (CVSS 7.5, DRSTEVE Crypt::Password)
- [CVE-2026-9833](https://cve.now/CVE-2026-9833.md): Tag Groups \< 2.2.0 - Reflected XSS via 'tag\_groups\_task' Parameter (CVSS 7.1, Tag Groups is the Advanced Way to Display Your Taxonomy Ter…)
- [CVE-2026-8825](https://cve.now/CVE-2026-8825.md): Elementor \< 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API (CVSS 4.9, Elementor Website Builder)
- [CVE-2026-13432](https://cve.now/CVE-2026-13432.md): ThumbPress \< 6.2.2 - Subscriber+ Plugin Deactivation (CVSS 5.4, ThumbPress)
- [CVE-2026-13156](https://cve.now/CVE-2026-13156.md): MailerSend - Official SMTP Integration \< 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF (CVSS 5.4, MailerSend)
- [CVE-2026-13147](https://cve.now/CVE-2026-13147.md): Kirki \< 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki\_get\_apis (CVSS 9.1, Kirki)
- [CVE-2026-13142](https://cve.now/CVE-2026-13142.md): Passwordless Login by VentraConnect \< 1.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force (CVSS 8.1, Social Login, Passkeys, Magic Link & Email OTP)
- [CVE-2026-12973](https://cve.now/CVE-2026-12973.md): PayPlus Payment Gateway \< 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Modification (CVSS 6.5, PayPlus Payment Gateway)
- [CVE-2026-12972](https://cve.now/CVE-2026-12972.md): PayPlus Payment Gateway \< 8.2.2 - Unauthenticated Order Payment Metadata Tampering (CVSS 5.3, PayPlus Payment Gateway)
- [CVE-2026-12970](https://cve.now/CVE-2026-12970.md): LearnPress \< 4.4.1 - Reflected XSS via c\_search (CVSS 7.1, LearnPress)
- [CVE-2026-12898](https://cve.now/CVE-2026-12898.md): All-in-One WP Migration and Backup \< 7.106 - Unauthenticated Arbitrary-Location Log File Write via Path Traversal (CVSS 6.5, All-in-One WP Migration and Backup)
- [CVE-2026-12724](https://cve.now/CVE-2026-12724.md): Kirki \< 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password (CVSS 4.3, Kirki)
- [CVE-2026-12723](https://cve.now/CVE-2026-12723.md): Kirki \< 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library (CVSS 5.3, Kirki)
- [CVE-2026-12592](https://cve.now/CVE-2026-12592.md): SlimStat Analytics \< 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header (CVSS 7.5, SlimStat Analytics)
- [CVE-2026-11868](https://cve.now/CVE-2026-11868.md): WP Travel \< 11.7.1 - Unauthenticated Arbitrary Booking Cancellation (CVSS 5.3, WP Travel)
- [CVE-2026-11349](https://cve.now/CVE-2026-11349.md): Modern Events Calendar (Lite & Pro) \< 7.34.0 - Unauthenticated SQL Injection via mec\_list\_load\_more (CVSS 8.6, Modern Event Calendar Pro · Modern Events Calendar Lite)
- [CVE-2026-10755](https://cve.now/CVE-2026-10755.md): All in One SEO \< 4.9.9 – Contributor+ Incorrect Authorization via AI Integration (CVSS 2.7, All in One SEO)
- [CVE-2026-10724](https://cve.now/CVE-2026-10724.md): Reviews Feed \< 2.6.5 - Unauthenticated Stored Arbitrary Shortcode Execution via Google Reviews (CVSS 4.8, Reviews Feed)
- [CVE-2026-10081](https://cve.now/CVE-2026-10081.md): Unlimited Elements for Elementor \< 2.0.11 - Unauthenticated Stored XSS via Google Reviews Widget (CVSS 8.8, Unlimited Elements For Elementor)
- [CVE-2024-51311](https://cve.now/CVE-2024-51311.md): The Tenda TX9 V22.03.02.05 firmware has a stack overflow vulnerability in the sub\_4418CC function of the file /goform/SetNetControlList. (CVSS 9.8)
- [CVE-2024-51312](https://cve.now/CVE-2024-51312.md): The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub\_42EEE0 function of the file /goform/SetStaticRouteCfg. (CVSS 9.8)
- [CVE-2024-51313](https://cve.now/CVE-2024-51313.md): The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub\_42EA38 function of the file /goform/SetVirtualServerCfg. (CVSS 9.8)
- [CVE-2024-51314](https://cve.now/CVE-2024-51314.md): The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub\_424CE0 function of the file /goform/setMacFilterCfg. (CVSS 9.8)
- [CVE-2024-51315](https://cve.now/CVE-2024-51315.md): The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub\_425964 function of the file /goform/SetOnlineDevName (CVSS 9.8)
- [CVE-2024-51316](https://cve.now/CVE-2024-51316.md): The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update\_dev\_name function of the file /goform/SetOnlineDevNa (CVSS 7.5)
- [CVE-2026-26080](https://cve.now/CVE-2026-26080.md): HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. (CVSS 3.7, HAProxy)
- [CVE-2026-26081](https://cve.now/CVE-2026-26081.md): HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW\_TOKEN format. (CVSS 4.8, HAProxy)
- [CVE-2026-26483](https://cve.now/CVE-2026-26483.md): Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting (XSS) vulnerability in the template management functionality. (CVSS 6.1)
- [CVE-2026-51025](https://cve.now/CVE-2026-51025.md): Cross Site Scripting vulnerability in fuint Member Marketing System \<=v1.0 allows a remote attacker to execute arbitrary code via the Client (CVSS 6.1)
- [CVE-2026-51026](https://cve.now/CVE-2026-51026.md): Directory Traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a crafted request. (CVSS 6.5)
- [CVE-2026-51027](https://cve.now/CVE-2026-51027.md): An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component. (CVSS 9.9)
- [CVE-2026-51031](https://cve.now/CVE-2026-51031.md): FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint. (CVSS 7.5)
- [CVE-2026-51385](https://cve.now/CVE-2026-51385.md): An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code via the validate\_url, (CVSS 6.9)
- [CVE-2026-52349](https://cve.now/CVE-2026-52349.md): Directory Traversal vulnerability in Menyoo 2.0 Versions before commit 729aa48: fixed in commit 729aa48 allows a local attacker to execute a (CVSS 7.8)
- [CVE-2026-52656](https://cve.now/CVE-2026-52656.md): An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute a (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-07-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.