# CVEs published 2026-07-24

192 CVEs were published on July 24, 2026: 19 critical, 79 high. Days are UTC.

- [CVE-2026-66337](https://cve.now/CVE-2026-66337.md): Libsoup: libsoup: heap buffer over-read via integer underflow in soup\_filter\_input\_stream\_read\_until() (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2026-66338](https://cve.now/CVE-2026-66338.md): Libsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup\_body\_input\_stream\_read\_chunked() (CVSS 5.4, Red Hat Enterprise Linux)
- [CVE-2026-66339](https://cve.now/CVE-2026-66339.md): Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2026-60134](https://cve.now/CVE-2026-60134.md): Weintek cMT3092X Reliance on Cookies without Validation and Integrity Checking in a Security Decision (CVSS 8.8, Weintek cMT3092X firmware · Weintek EasyWeb)
- [CVE-2026-61892](https://cve.now/CVE-2026-61892.md): Weintek cMT3092X Incorrect Permission Assignment for Critical Resource (CVSS 8.8, Weintek cMT3092X firmware · Weintek EasyWeb)
- [CVE-2026-61886](https://cve.now/CVE-2026-61886.md): Weintek cMT3092X Plaintext Storage of a Password (CVSS 6.5, Weintek cMT3092X firmware · Weintek EasyWeb)
- [CVE-2026-60135](https://cve.now/CVE-2026-60135.md): Weintek cMT3092X Incorrect User Management (CVSS 6.5, Weintek cMT3092X firmware · Weintek EasyWeb)
- [CVE-2026-16280](https://cve.now/CVE-2026-16280.md): GPU DDK - Integer overflow in \_PMRLogicalOffsetToPhysicalOffset (CVSS 9.8, Imagination Technologies Graphics DDK)
- [CVE-2026-61884](https://cve.now/CVE-2026-61884.md): Tycon Systems TPDIN-Monitor-WEB2 Missing Authentication for Critical Function (CVSS 9.8, Tycon Systems TPDIN-Monitor-WEB2)
- [CVE-2026-55985](https://cve.now/CVE-2026-55985.md): Tycon Systems TPDIN-Monitor-WEB2 Cleartext Storage of Sensitive Information (CVSS 4.3, Tycon Systems TPDIN-Monitor-WEB2)
- [CVE-2025-71408](https://cve.now/CVE-2025-71408.md): NLTK \< 3.9.3 Eval Injection via collocations.py Command-Line Arguments (CVSS 8.5, ntlk · nltk)
- [CVE-2026-66041](https://cve.now/CVE-2026-66041.md): FFmpeg 7.0 - 8.1.2 Heap Out-of-Bounds Write via vf\_quirc Filter (CVSS 7.7, FFmpeg)
- [CVE-2026-66040](https://cve.now/CVE-2026-66040.md): FFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf Encoder (CVSS 8.7, FFmpeg)
- [CVE-2026-66039](https://cve.now/CVE-2026-66039.md): FFmpeg MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File (CVSS 8.7, FFmpeg)
- [CVE-2026-66038](https://cve.now/CVE-2026-66038.md): FFmpeg LCL/ZLIB Video Decoder Information Disclosure via lcldec.c (CVSS 7.1, FFmpeg)
- [CVE-2026-66037](https://cve.now/CVE-2026-66037.md): FFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix\_presentation\_obu() (CVSS 7.1, FFmpeg)
- [CVE-2026-66036](https://cve.now/CVE-2026-66036.md): FFmpeg Heap Out-of-Bounds Write in vf\_hqdn3d Filter (CVSS 7.7, FFmpeg)
- [CVE-2026-62835](https://cve.now/CVE-2026-62835.md): Azure Portal Information Disclosure Vulnerability (CVSS 9.3, Microsoft Azure Portal)
- [CVE-2026-57531](https://cve.now/CVE-2026-57531.md): Milkdown \< 7.21.3 DOM XSS via innerHTML Assignment (CVSS 5.1, milkdown)
- [CVE-2026-57530](https://cve.now/CVE-2026-57530.md): Milkdown \< 7.21.3 Stored XSS via javascript: URL in link href (CVSS 5.1, milkdown)
- [CVE-2026-17107](https://cve.now/CVE-2026-17107.md): Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster (CVSS 8.5, Red Hat multicluster engine for Kubernetes)
- [CVE-2026-48037](https://cve.now/CVE-2026-48037.md): Hulumi: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture (CVSS 6.3, kerberosmansour hulumi · @hulumi/baseline)
- [CVE-2026-48036](https://cve.now/CVE-2026-48036.md): Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts (CVSS 8.4, kerberosmansour hulumi · @hulumi/drift)
- [CVE-2026-48035](https://cve.now/CVE-2026-48035.md): Hulumi: AccountFoundation audit-delivery S3 bucket could be silently weakened (CVSS 7.1, kerberosmansour hulumi · @hulumi/baseline)
- [CVE-2026-48033](https://cve.now/CVE-2026-48033.md): Hulumi: Policy packs bypassed by a forged Pulumi-URN logical name (CVSS 8.4, kerberosmansour hulumi · @hulumi/policies)
- [CVE-2026-48032](https://cve.now/CVE-2026-48032.md): Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providers (CVSS 8.3, kerberosmansour hulumi · @hulumi/policies)
- [CVE-2026-48034](https://cve.now/CVE-2026-48034.md): HULUMI-H5 bypass via decoy sibling resources targeting a different bucket (CVSS 8.5, kerberosmansour hulumi · @hulumi/policies)
- [CVE-2026-48021](https://cve.now/CVE-2026-48021.md): epa4all Security Incident: Implement keystore based on Telematik TSL, implement hostname check and certificate check for lib-vau (CVSS 9.1, med-united epa4all)
- [CVE-2026-54342](https://cve.now/CVE-2026-54342.md): TLS Certificate Verification Disabled on CXF Transport Clients in epa4all (CVSS 8.1, med-united epa4all)
- [CVE-2026-66035](https://cve.now/CVE-2026-66035.md): libssh2 Heap Buffer Overflow via ETM Cipher Negotiation (CVSS 7.7, libssh2)
- [CVE-2026-66034](https://cve.now/CVE-2026-66034.md): libssh2 Heap Out-of-Bounds Read via publickey subsystem (CVSS 7.7, libssh2)
- [CVE-2026-66033](https://cve.now/CVE-2026-66033.md): libssh2 Integer Underflow DoS via AES-GCM Cipher Negotiation (CVSS 8.7, libssh2)
- [CVE-2026-66032](https://cve.now/CVE-2026-66032.md): libssh2 Double-Free Heap Corruption via sftp\_open() (CVSS 8.7, libssh2)
- [CVE-2026-65623](https://cve.now/CVE-2026-65623.md): Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit (CVSS 8.7, mtrudel bandit)
- [CVE-2026-65711](https://cve.now/CVE-2026-65711.md): sysPass 3.2.11 Authenticated OS Command Injection via Backup Path (CVSS 8.6, nuxsmin sysPass)
- [CVE-2026-65710](https://cve.now/CVE-2026-65710.md): sysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption (CVSS 7.1, nuxsmin sysPass)
- [CVE-2026-65709](https://cve.now/CVE-2026-65709.md): sysPass 3.2.11 Missing Object-Level Authorization via JSON-RPC API (CVSS 8.7, nuxsmin sysPass)
- [CVE-2026-65708](https://cve.now/CVE-2026-65708.md): sysPass 3.2.11 Insecure Direct Object Reference via AccountFileController (CVSS 8.6, nuxsmin sysPass)
- [CVE-2026-65707](https://cve.now/CVE-2026-65707.md): Likeshop 3.0.5 Authenticated SQL Injection via adjustAccount Endpoint (CVSS 8.5, likeadmin-likeshop likeshop)
- [CVE-2026-65693](https://cve.now/CVE-2026-65693.md): Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates (CVSS 8.6, microweber)
- [CVE-2026-64255](https://cve.now/CVE-2026-64255.md): wifi: iwlwifi: mld: validate sta\_mask before ffs() in BA session handlers (CVSS 8.8, Linux)
- [CVE-2026-64254](https://cve.now/CVE-2026-64254.md): NTB: epf: Avoid pci\_iounmap() with offset when PEER\_SPAD and CONFIG share BAR (no CVSS, Linux)
- [CVE-2026-64253](https://cve.now/CVE-2026-64253.md): kernel/fork: clear PF\_BLOCK\_TS in copy\_process() (no CVSS, Linux)
- [CVE-2026-64252](https://cve.now/CVE-2026-64252.md): MIPS: DEC: Prevent initial console buffer from landing in XKPHYS (no CVSS, Linux)
- [CVE-2026-64251](https://cve.now/CVE-2026-64251.md): pwrseq: core: fix use-after-free in pwrseq\_debugfs\_seq\_next() (CVSS 7.8, Linux)
- [CVE-2026-64250](https://cve.now/CVE-2026-64250.md): LoongArch: Report dying CPU to RCU in stop\_this\_cpu() (no CVSS, Linux)
- [CVE-2026-64249](https://cve.now/CVE-2026-64249.md): fpga: region: fix use-after-free in child\_regions\_with\_firmware() (no CVSS, Linux)
- [CVE-2026-64248](https://cve.now/CVE-2026-64248.md): MIPS: smp: report dying CPU to RCU in stop\_this\_cpu() (no CVSS, Linux)
- [CVE-2026-64247](https://cve.now/CVE-2026-64247.md): KVM: x86: hyper-v: Bound the bank index when querying sparse banks (CVSS 8.4, Linux)
- [CVE-2026-64246](https://cve.now/CVE-2026-64246.md): power: reset: linkstation-poweroff: fix use-after-free in the linkstation\_poweroff\_init() (no CVSS, Linux)
- [CVE-2026-64245](https://cve.now/CVE-2026-64245.md): fbdev: modedb: fix a possible UAF in fb\_find\_mode() (no CVSS, Linux)
- [CVE-2026-64244](https://cve.now/CVE-2026-64244.md): drivers/base/memory: set mem-\>altmap after successful device registration (no CVSS, Linux)
- [CVE-2026-64243](https://cve.now/CVE-2026-64243.md): ASoC: codecs: simple-mux: Fix enum control bounds check (CVSS 7.1, Linux)
- [CVE-2026-64242](https://cve.now/CVE-2026-64242.md): usb: gadget: net2280: Fix double free in probe error path (no CVSS, Linux)
- [CVE-2026-64241](https://cve.now/CVE-2026-64241.md): gpio: rockchip: teardown bugs and resource leaks (no CVSS, Linux)
- [CVE-2026-64240](https://cve.now/CVE-2026-64240.md): media: rc: igorplugusb: fix control request setup packet (no CVSS, Linux)
- [CVE-2026-64239](https://cve.now/CVE-2026-64239.md): mm/damon/sysfs-schemes: delete tried region in regions\_rmdirs() (no CVSS, Linux)
- [CVE-2026-64238](https://cve.now/CVE-2026-64238.md): gpio: shared: fix deadlock on shared proxy's parent removal (no CVSS, Linux)
- [CVE-2026-64237](https://cve.now/CVE-2026-64237.md): Input: elan\_i2c - validate firmware size before use (no CVSS, Linux)
- [CVE-2026-64236](https://cve.now/CVE-2026-64236.md): i2c: davinci: fix division by zero on missing clock-frequency (no CVSS, Linux)
- [CVE-2026-64235](https://cve.now/CVE-2026-64235.md): x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (CVSS 8.1, Linux)
- [CVE-2026-64234](https://cve.now/CVE-2026-64234.md): tty: serial: pch\_uart: add check for dma\_alloc\_coherent() (no CVSS, Linux)
- [CVE-2026-64233](https://cve.now/CVE-2026-64233.md): usb: gadget: uvc: hold opts-\>lock across XU walks in uvc\_function\_bind (no CVSS, Linux)
- [CVE-2026-66027](https://cve.now/CVE-2026-66027.md): Suna \< 0.9.102 Broken Access Control via Message Queue API (CVSS 8.7, kortix-ai suna)
- [CVE-2026-64232](https://cve.now/CVE-2026-64232.md): block: recompute nr\_integrity\_segments in blk\_insert\_cloned\_request (CVSS 9.8, Linux)
- [CVE-2026-64231](https://cve.now/CVE-2026-64231.md): drm/msm/dsi: don't dump registers past the mapped region (no CVSS, Linux)
- [CVE-2026-64230](https://cve.now/CVE-2026-64230.md): regulator: tps65219: fix irq\_data.rdev not being assigned (no CVSS, Linux)
- [CVE-2026-64229](https://cve.now/CVE-2026-64229.md): x86/mm: Disable broadcast TLB flush when PCID is disabled (no CVSS, Linux)
- [CVE-2026-64228](https://cve.now/CVE-2026-64228.md): net: ethtool: phy: avoid NULL deref when PHY driver is unbound (no CVSS, Linux)
- [CVE-2026-64227](https://cve.now/CVE-2026-64227.md): ACPI: driver: Check ACPI\_COMPANION() against NULL during probe (no CVSS, Linux)
- [CVE-2026-64226](https://cve.now/CVE-2026-64226.md): sched\_ext: Avoid UAF in scx\_root\_enable\_workfn() init failure path (CVSS 7.8, Linux)
- [CVE-2026-64225](https://cve.now/CVE-2026-64225.md): octeontx2-af: CGX: add bounds check to cgx\_speed\_mbps index (no CVSS, Linux)
- [CVE-2026-64224](https://cve.now/CVE-2026-64224.md): octeontx2-pf: fix double free in rvu\_rep\_rsrc\_init() (no CVSS, Linux)
- [CVE-2026-64223](https://cve.now/CVE-2026-64223.md): wifi: mac80211: consume only present negotiated TTLM maps (CVSS 8.1, Linux)
- [CVE-2026-64222](https://cve.now/CVE-2026-64222.md): octeontx2-pf: avoid double free of pool-\>stack on AQ init failure (CVSS 7.0, Linux)
- [CVE-2026-64221](https://cve.now/CVE-2026-64221.md): spi: ti-qspi: fix use-after-free after DMA setup failure (CVSS 7.8, Linux)
- [CVE-2026-64220](https://cve.now/CVE-2026-64220.md): device property: set fwnode-\>secondary to NULL in fwnode\_init() (no CVSS, Linux)
- [CVE-2026-64219](https://cve.now/CVE-2026-64219.md): drm/amd/display: Validate payload length and link\_index in dc\_process\_dmub\_aux\_transfer\_async (CVSS 7.0, Linux)
- [CVE-2026-64218](https://cve.now/CVE-2026-64218.md): batman-adv: bla: fix report\_work leak on backbone\_gw purge (CVSS 7.8, Linux)
- [CVE-2026-64217](https://cve.now/CVE-2026-64217.md): netfs: Fix overrun check in netfs\_extract\_user\_iter() (CVSS 7.8, Linux)
- [CVE-2026-64216](https://cve.now/CVE-2026-64216.md): netfs: Fix potential UAF in netfs\_unlock\_abandoned\_read\_pages() (CVSS 9.8, Linux)
- [CVE-2026-64215](https://cve.now/CVE-2026-64215.md): drm/msm/a6xx: Check kzalloc return in a8xx\_hfi\_send\_perf\_table (no CVSS, Linux)
- [CVE-2026-64214](https://cve.now/CVE-2026-64214.md): powerpc/time: Remove redundant preempt\_disable|enable() calls from arch\_irq\_work\_raise() (no CVSS, Linux)
- [CVE-2026-64213](https://cve.now/CVE-2026-64213.md): hwmon: (lm90) Add lock protection to lm90\_alert (no CVSS, Linux)
- [CVE-2026-64212](https://cve.now/CVE-2026-64212.md): wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it (no CVSS, Linux)
- [CVE-2026-64211](https://cve.now/CVE-2026-64211.md): srcu: Don't queue workqueue handlers to never-online CPUs (no CVSS, Linux)
- [CVE-2026-64210](https://cve.now/CVE-2026-64210.md): net/mlx5e: xsk: Fix unlocked writing to ICOSQ (CVSS 7.5, Linux)
- [CVE-2026-64209](https://cve.now/CVE-2026-64209.md): phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config (no CVSS, Linux)
- [CVE-2026-64208](https://cve.now/CVE-2026-64208.md): crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (CVSS 7.5, Linux)
- [CVE-2026-17039](https://cve.now/CVE-2026-17039.md): Pki-core: dogtag-pki: redhat-pki: pki-core: ca renewal request processing omits realm authorization check performed by enrollment path (CVSS 3.1, Red Hat Certificate System · Red Hat Enterprise Linux)
- [CVE-2026-58586](https://cve.now/CVE-2026-58586.md): Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp (CVSS 9.8, ZAPAD Image::WebP)
- [CVE-2026-66007](https://cve.now/CVE-2026-66007.md): Datasets Path Traversal via Unsanitized file\_name Metadata (CVSS 6.9, huggingface datasets · datasets)
- [CVE-2026-66006](https://cve.now/CVE-2026-66006.md): lakeFS Unauthenticated Operator Metadata Overwrite via setup\_comm\_prefs (CVSS 6.9, treeverse lakeFS)
- [CVE-2026-66005](https://cve.now/CVE-2026-66005.md): Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding (CVSS 5.3, janhq jan)
- [CVE-2026-49326](https://cve.now/CVE-2026-49326.md): Apache HBase: Missing scanner instance owner check in thrift delegation service (CVSS 6.5, Apache Software Foundation Apache HBase)
- [CVE-2026-16802](https://cve.now/CVE-2026-16802.md): Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local (CVSS 6.5, Devolutions PowerShell Universal)
- [CVE-2026-16801](https://cve.now/CVE-2026-16801.md): Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier (CVSS 8.8, Devolutions PowerShell Universal)
- [CVE-2026-16800](https://cve.now/CVE-2026-16800.md): Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier a (CVSS 8.8, Devolutions PowerShell Universal)
- [CVE-2026-16799](https://cve.now/CVE-2026-16799.md): Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an au (CVSS 5.0, Devolutions PowerShell Universal)
- [CVE-2026-16798](https://cve.now/CVE-2026-16798.md): Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows (CVSS 6.5, Devolutions PowerShell Universal)
- [CVE-2026-66004](https://cve.now/CVE-2026-66004.md): BlenderMCP Path Traversal via download\_polyhaven\_asset API (CVSS 6.0, ahujasid blender-mcp · blender-mcp)
- [CVE-2026-56163](https://cve.now/CVE-2026-56163.md): Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Azure Kubernetes Service)
- [CVE-2026-58630](https://cve.now/CVE-2026-58630.md): Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Azure App Service for Linux)
- [CVE-2026-57106](https://cve.now/CVE-2026-57106.md): Data Quality Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Purview Data Governance)
- [CVE-2026-8789](https://cve.now/CVE-2026-8789.md): Easy Appointments \<= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion (CVSS 8.1, easyappointments Easy Appointments)
- [CVE-2026-8308](https://cve.now/CVE-2026-8308.md): Reflected XSS Polen Media's Website Template (CVSS 6.1, Polen Media Software and Information Services Website Templ…)
- [CVE-2026-17059](https://cve.now/CVE-2026-17059.md): Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter (CVSS 6.5, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-55732](https://cve.now/CVE-2026-55732.md): Loytec LINX firmware: Out-of-bounds Read in BACnet packet parsing (bacdt\_datetime\_to\_tod) (CVSS 8.7, Loytec LIP-ME20xC · Loytec L-INX +6)
- [CVE-2026-55731](https://cve.now/CVE-2026-55731.md): Loytec LINX firmware: Unchecked input for loop condition in the SNMP agent (CVSS 6.6, Loytec LIP-ME20xC · Loytec L-INX +6)
- [CVE-2026-55730](https://cve.now/CVE-2026-55730.md): Loytec LWEB802: Reflected Cross-Site Scripting in LWEB802 (CVSS 8.7, Loytec LWEB-802)
- [CVE-2026-55729](https://cve.now/CVE-2026-55729.md): Loytec LWEB802: Exposure of Sensitive Information in browser localStorage (CVSS 7.7, Loytec LWEB-802)
- [CVE-2026-55728](https://cve.now/CVE-2026-55728.md): Loytec LINX firmware: Stack-based Buffer Overflow in cmd\_ipaddr\_conflict (CVSS 3.8, Loytec LIP-ME20xC · Loytec L-INX +6)
- [CVE-2026-12504](https://cve.now/CVE-2026-12504.md): Loytec LINX firmware: Improper Authentication in PAM configuration (CVSS 8.4, Loytec LIP-ME20xC · Loytec L-INX +6)
- [CVE-2026-12503](https://cve.now/CVE-2026-12503.md): Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm\_starter (CVSS 9.2, Loytec LIP-ME20xC · Loytec L-INX +6)
- [CVE-2026-12502](https://cve.now/CVE-2026-12502.md): Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo (CVSS 8.4, Loytec LIP-ME20xC · Loytec L-INX +6)
- [CVE-2026-12496](https://cve.now/CVE-2026-12496.md): Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server (CVSS 8.7, Loytec LIP-ME20xC · Loytec L-INX +6)
- [CVE-2026-7007](https://cve.now/CVE-2026-7007.md): Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image (CVSS 4.6, zephyrproject zephyr)
- [CVE-2026-17048](https://cve.now/CVE-2026-17048.md): Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api (CVSS 5.5, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-16743](https://cve.now/CVE-2026-16743.md): Accountsservice: accountsservice: arbitrary file read via seticonfile for systemd-homed users (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2026-7484](https://cve.now/CVE-2026-7484.md): Improper Access Control in Abis Technology's AVESİS (CVSS 5.3, ABIS Technology Ltd. AVESİS)
- [CVE-2026-9765](https://cve.now/CVE-2026-9765.md): CVE-2026-9765 CVE Record (CVSS 7.1, Grafana IRM)
- [CVE-2026-46452](https://cve.now/CVE-2026-46452.md): Apache NimBLE: Mesh Proxy SAR reassembly unbounded append and unchecked failure (CVSS 5.3, Apache Software Foundation Apache NimBLE)
- [CVE-2026-45816](https://cve.now/CVE-2026-45816.md): Apache NimBLE: NULL pointer dereference vulnerability in SMP LTK request (CVSS 7.5, Apache Software Foundation Apache NimBLE)
- [CVE-2026-45815](https://cve.now/CVE-2026-45815.md): Apache NimBLE: Remote reachable assertion in ATT Read Multiple Variable Response handler (CVSS 7.5, Apache Software Foundation Apache NimBLE)
- [CVE-2026-45813](https://cve.now/CVE-2026-45813.md): Apache NimBLE: Incorrect data validation in BASS add/modify source operation (CVSS 8.8, Apache Software Foundation Apache NimBLE)
- [CVE-2026-45812](https://cve.now/CVE-2026-45812.md): Apache NimBLE: OOB Read via sizeof(pointer) in Legacy Advertising Report Handler (CVSS 6.5, Apache Software Foundation Apache NimBLE)
- [CVE-2026-45811](https://cve.now/CVE-2026-45811.md): Apache NimBLE: Buffer overflow in socket HCI transport (CVSS 7.5, Apache Software Foundation Apache NimBLE)
- [CVE-2026-66144](https://cve.now/CVE-2026-66144.md): Apache Neethi: Remote PolicyReference fetch lacks resource bounds (CVSS 7.5, Apache Software Foundation Apache Neethi)
- [CVE-2026-66010](https://cve.now/CVE-2026-66010.md): DOMPurify before 3.4.12 Hook Bypass via CUSTOM\_ELEMENT\_HANDLING (CVSS 5.1, cure53 DOMPurify · dompurify)
- [CVE-2026-66009](https://cve.now/CVE-2026-66009.md): Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages (CVSS 6.3, parse-community parse-server)
- [CVE-2026-66008](https://cve.now/CVE-2026-66008.md): Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages (CVSS 6.3, parse-community parse-server)
- [CVE-2026-66143](https://cve.now/CVE-2026-66143.md): Apache Neethi: Missing global alternative-output budget across policy computation paths (CVSS 7.5, Apache Software Foundation Apache Neethi)
- [CVE-2026-66142](https://cve.now/CVE-2026-66142.md): Apache Neethi: Uncontrolled recursion in policy processing (CVSS 7.5, Apache Software Foundation Apache Neethi)
- [CVE-2026-15243](https://cve.now/CVE-2026-15243.md): Improper Validation of Certificate in CAS Client (CVSS 7.4, Java Apereo CAS Client · Apereo Jasig CAS Client)
- [CVE-2026-16730](https://cve.now/CVE-2026-16730.md): Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup (CVSS 5.5, Red Hat Enterprise Linux · Red Hat Update Infrastructure +2)
- [CVE-2026-10610](https://cve.now/CVE-2026-10610.md): Local privilege escalation in ESET security applications for macOS (CVSS 8.5, ESET spol. s.r.o. ESET Endpoint Security for macOS · ESET s…)
- [CVE-2026-15810](https://cve.now/CVE-2026-15810.md): Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover (CVSS 8.7, Google Cloud Looker)
- [CVE-2026-7483](https://cve.now/CVE-2026-7483.md): Local privilege escalation in ESET security applications for macOS (CVSS 8.5, ESET spol. s.r.o. ESET Endpoint Security for macOS · ESET s…)
- [CVE-2026-10033](https://cve.now/CVE-2026-10033.md): EventON Action User \<= 2.5.14 - Missing Authorization to Unauthenticated Privilege Escalation via evoau\_save\_capability AJAX Action (CVSS 7.3, EventON Action User)
- [CVE-2026-15663](https://cve.now/CVE-2026-15663.md): Ninja Forms \<= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key (CVSS 4.9, kstover Ninja Forms – The Contact Form Builder That Grows W…)
- [CVE-2026-15401](https://cve.now/CVE-2026-15401.md): VikBooking Hotel Booking Engine & PMS \<= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Parameter (CVSS 7.2, e4jvikwp VikBooking Hotel Booking Engine & PMS)
- [CVE-2026-16634](https://cve.now/CVE-2026-16634.md): TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99 (CVSS 9.8, FELIPE TOML::XS)
- [CVE-2026-49745](https://cve.now/CVE-2026-49745.md): GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0 (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2026-49744](https://cve.now/CVE-2026-49744.md): GPU DDK - Unchecked ui32TracePointer in rgxfw\_log\_ex() (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2026-49743](https://cve.now/CVE-2026-49743.md): GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2026-12702](https://cve.now/CVE-2026-12702.md): In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deploymen (CVSS 5.1, Octopus Deploy Octopus Server)
- [CVE-2026-24727](https://cve.now/CVE-2026-24727.md): SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type (CVSS 9.3, SUNNET Technology Co. Corporate Training Management System)
- [CVE-2026-63317](https://cve.now/CVE-2026-63317.md): Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML (CVSS 5.6, Apache Software Foundation Apache OpenNLP)
- [CVE-2026-15346](https://cve.now/CVE-2026-15346.md): VikBooking Hotel Booking Engine & PMS \<= 1.8.13 - Reflected Cross-Site Scripting via 'category\_id' Parameter (CVSS 6.1, e4jvikwp VikBooking Hotel Booking Engine & PMS)
- [CVE-2026-15739](https://cve.now/CVE-2026-15739.md): Rich Showcase for Google Reviews \<= 6.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pagination' Shortcode Attribute (CVSS 6.4, widgetpack Rich Showcase for Google Reviews)
- [CVE-2026-15821](https://cve.now/CVE-2026-15821.md): SureDash \<= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, brainstormforce SureDash – Community, Courses & Member Dash…)
- [CVE-2026-56392](https://cve.now/CVE-2026-56392.md): Heap-based Buffer Overflow in GNU coreutils (CVSS 1.8, GNU coreutils)
- [CVE-2026-56391](https://cve.now/CVE-2026-56391.md): Out‑of‑bounds Read in GNU coreutils (CVSS 4.6, GNU coreutils)
- [CVE-2026-15704](https://cve.now/CVE-2026-15704.md): CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components (CVSS 9.8, Eclipse Foundation Eclipse BaSyx Go Components)
- [CVE-2026-16519](https://cve.now/CVE-2026-16519.md): GeoVision GV-IP Device Utility DLL Search Order Hijacking Vulnerability (CVSS 7.3, GeoVision GV-IP Device Utility)
- [CVE-2026-15464](https://cve.now/CVE-2026-15464.md): WP Hotel Booking \<= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget\_search' Shortcode Attribute (CVSS 6.4, thimpress WP Hotel Booking)
- [CVE-2026-15653](https://cve.now/CVE-2026-15653.md): Visualizer \<= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'backend-title' Parameter (CVSS 6.4, themeisle Visualizer – Tables & Charts Manager with Built-i…)
- [CVE-2026-12654](https://cve.now/CVE-2026-12654.md): Payment Plugins for Stripe WooCommerce \<= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Secret (CVSS 5.3, paymentplugins Payment Plugins for Stripe WooCommerce)
- [CVE-2026-15648](https://cve.now/CVE-2026-15648.md): Brands for WooCommerce \<= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute (CVSS 6.4, berocket Brands for WooCommerce)
- [CVE-2026-15334](https://cve.now/CVE-2026-15334.md): Cozy Blocks \<= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute (CVSS 6.4, cozythemes Cozy Blocks – Page Builder for Gutenberg Editor…)
- [CVE-2026-15755](https://cve.now/CVE-2026-15755.md): Open User Map \<= 1.4.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, 100plugins Open User Map – Interactive Leaflet Maps)
- [CVE-2026-15333](https://cve.now/CVE-2026-15333.md): Cozy Blocks \<= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute (CVSS 6.4, cozythemes Cozy Blocks – Page Builder for Gutenberg Editor…)
- [CVE-2026-15665](https://cve.now/CVE-2026-15665.md): Fluent Support \<= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute (CVSS 6.4, wpmanageninja Fluent Support – Helpdesk & Customer Support…)
- [CVE-2026-16910](https://cve.now/CVE-2026-16910.md): Quay: ssrf in red hat quay notification webhooks (slack/generic) (CVSS 5.5, Red Hat OpenShift Update Service · Red Hat Quay)
- [CVE-2026-14603](https://cve.now/CVE-2026-14603.md): WowOptin \< 1.4.38 - Unauthenticated Opt-in Deactivation and Template Row Injection (CVSS 7.5, WowOptin: Next-Gen Popup Maker)
- [CVE-2026-12981](https://cve.now/CVE-2026-12981.md): CAFEHAUS API \<= 1.0.0 - Unauthenticated Arbitrary User Password Reset (CVSS 7.5, CAFEHAUS API)
- [CVE-2026-12877](https://cve.now/CVE-2026-12877.md): Software Issue Manager \< 5.1.0 - Unauthenticated SQL Injection via Search Parameter (CVSS 9.1, Project Management, Bug and Issue Tracking Plugin)
- [CVE-2026-12690](https://cve.now/CVE-2026-12690.md): ProfileGrid \< 5.9.9.7 - Subscriber+ Premium License Tampering via Missing Authorization (CVSS 3.8, ProfileGrid)
- [CVE-2026-12689](https://cve.now/CVE-2026-12689.md): ProfileGrid \< 5.9.9.7 - Subscriber+ Cross-User Private Message Thread Deletion and Tampering via Missing Authorization (CVSS 5.4, ProfileGrid)
- [CVE-2026-12688](https://cve.now/CVE-2026-12688.md): ProfileGrid \< 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery (CVSS 6.5, ProfileGrid)
- [CVE-2026-12497](https://cve.now/CVE-2026-12497.md): ProfilePress \< 4.16.18 - Unauthenticated Privilege Escalation via Registration Role Selection (CVSS 7.5, Paid Membership Plugin, Ecommerce, User Registration Form,…)
- [CVE-2026-14172](https://cve.now/CVE-2026-14172.md): Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation (CVSS 7.8, Rapid7 InsightVM · Rapid7 Nexpose +1)
- [CVE-2026-16870](https://cve.now/CVE-2026-16870.md): Multiple Security Vulnerabilities in Snowflake libsnowflakeclient (CVSS 8.8, Snowflake libsnowflakeclient · Snowflake PHP PDO Driver +1)
- [CVE-2026-66141](https://cve.now/CVE-2026-66141.md): Exim before 4.99.5 allows .forward privilege escalation because force\_command for a pipe transport is mishandled. (CVSS 7.4, Exim)
- [CVE-2026-66140](https://cve.now/CVE-2026-66140.md): Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments (CVSS 8.4, Exim)
- [CVE-2026-66139](https://cve.now/CVE-2026-66139.md): OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known. (CVSS 4.8, OpenStack Zaqar)
- [CVE-2026-66138](https://cve.now/CVE-2026-66138.md): In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a runni (CVSS 7.2, OpenStack Ironic Python Agent)
- [CVE-2026-54422](https://cve.now/CVE-2026-54422.md): In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extrac (CVSS 5.5, OpenStack Ironic Python Agent)
- [CVE-2026-11922](https://cve.now/CVE-2026-11922.md): Rate-limit Bypass in zenml-io/zenml (CVSS 6.5, zenml-io/zenml)
- [CVE-2026-11354](https://cve.now/CVE-2026-11354.md): Participants Database \<= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via 'id' Parameter (CVSS 5.3, xnau Participants Database)
- [CVE-2026-12736](https://cve.now/CVE-2026-12736.md): WPify Woo \<= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save\_option REST Endpoint (CVSS 8.0, WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and m…)
- [CVE-2025-9205](https://cve.now/CVE-2025-9205.md): MapSVG Lite \<= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, oyatek MapSVG – Vector maps, Image maps, Google Maps)
- [CVE-2026-15420](https://cve.now/CVE-2026-15420.md): Nexter Blocks \<= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus\_name' Parameter (CVSS 4.3, posimyththemes Nexter Blocks – Gutenberg Blocks, Page Build…)
- [CVE-2026-13464](https://cve.now/CVE-2026-13464.md): Kirki \<= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter (CVSS 5.3, themeum Kirki – Freeform Page Builder, Website Builder & Cu…)
- [CVE-2026-6454](https://cve.now/CVE-2026-6454.md): Firelight Lightbox \<= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute (CVSS 6.4, firelightwp Firelight Lightbox)
- [CVE-2026-15100](https://cve.now/CVE-2026-15100.md): Post Grid Gutenberg Blocks \<= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute (CVSS 6.4, wpxpo Post Grid Gutenberg Blocks – PostX)
- [CVE-2026-58275](https://cve.now/CVE-2026-58275.md): Azure DNS Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Azure DNS)
- [CVE-2026-62825](https://cve.now/CVE-2026-62825.md): Azure Key Vault Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Azure Key Vault)
- [CVE-2026-56191](https://cve.now/CVE-2026-56191.md): Microsoft Exchange Online Tampering Vulnerability (CVSS 10.0, Microsoft Exchange Online)
- [CVE-2026-50517](https://cve.now/CVE-2026-50517.md): Microsoft M365 Copilot Remote Code Execution Vulnerability (CVSS 9.9, Microsoft 365 Copilot)
- [CVE-2026-49159](https://cve.now/CVE-2026-49159.md): Microsoft Graph Information Disclosure Vulnerability (CVSS 6.5, Microsoft Graph)
- [CVE-2026-35425](https://cve.now/CVE-2026-35425.md): Azure API Management (APIM) Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Azure API Management)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-07-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.