CVEs published July 28, 2026
243 CVEs were published on July 28, 2026: 20 critical, 119 high.
- Published
- 243
- Critical
- 20
- High
- 119
- Medium
- 93
- Low
- 11
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 133
Most affected products
- Xen
- 18
- koxudaxi datamodel-code-generator · datamodel-code-generator
- 12
- IBM WebSphere Application Server
- 10
- Adobe Bridge
- 8
- dompdf · dompdf/dompdf
- 6
- IBM Sterling B2B Integrator · IBM Sterling File Gateway
- 6
- juev nebula-mesh · github.com/juev/nebula-mesh
- 5
- pivotick
- 5
- ads-tec Industrial IT DVG-IRF1401 · ads-tec Industrial I… +4
- 4
- cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order No…
- 4
Critical 20
- CVE-2026-54658@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL executionhypequery · @hypequery/clickhouse
- CVE-2026-64863goshs --no-delete WebDAV MOVE bypass allows file deletion/overwritegoshs-labs goshs · github.com/patrickhener/goshs +3
- CVE-2026-62325goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)goshs-labs goshs · goshs.de/goshs +2
- CVE-2026-14446IBM WebSphere Application Server is affected by a privilege escalationIBM WebSphere Application Server
- CVE-2026-14512IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive informationIBM WebSphere Application Server
- CVE-2026-14958OS command injection in IBM Aspera FaspexIBM Aspera Faspex
- CVE-2026-14959OS Command Injection in IBM Aspera FaspexIBM Aspera Faspex
- CVE-2026-14973Path Traversal in IBM Desktop AppIBM Aspera Desktop App
- CVE-2026-6881Authenticated SQL Injection Enables Unauthorized Access to Sensitive Information in Ellucian Advance Web and Legacy AdvanceEllucian Advance Web · Ellucian Legacy Advance
- CVE-2026-16498terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless modeHashiCorp Tooling
- CVE-2026-50737When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table's default expressionsEnterpriseDB pglogical
- CVE-2026-50736The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes messageEnterpriseDB pglogical
- CVE-2026-67174DOM-Based Cross-Site Scripting via Unsafe String and SVG Icon Rendering in Pivotickpivotick
- CVE-2026-66713Apache Axis2/Java: deserialization of untrusted DataApache Software Foundation Apache Axis2/Java
- CVE-2026-65880Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3balbooa.com Balbooa Forms component for Joomla
- CVE-2026-16462SQL injection via unauthenticated GetGridData endpointWeidmueller Interface PROCON-WEB SCADA
- CVE-2026-11841CVE-2026-11841SICK AG InspectorP61x · SICK AG InspectorP62x +4
- CVE-2026-11756Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026xDassault Systèmes Station Launcher App in 3DEXPERIENCE plat…
- CVE-2026-15014SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parametercozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order No…
- CVE-2026-14545TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password ResetTrueBooker
High 119
- CVE-2026-56822Netty: TOCTOU in OcspServerCertificateValidatornetty · io.netty:netty-handler-ssl-ocsp
- CVE-2026-56821Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidatornetty · io.netty:netty-handler-ssl-ocsp
- CVE-2026-54650openhole-server vulnerable to path traversal via URL-decoded request pathbablilayoub openhole · github.com/bablilayoub/openhole
- CVE-2026-54638td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decodegotd td · github.com/gotd/td
- CVE-2026-47219find-my-way is Vulnerable to DDoS with HTTP2delvedor find-my-way · find-my-way
- CVE-2026-54719goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)goshs-labs goshs · github.com/patrickhener/goshs +3
- CVE-2026-55389datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`koxudaxi datamodel-code-generator · datamodel-code-generator
- CVE-2026-54653`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema fieldkoxudaxi datamodel-code-generator · datamodel-code-generator
- CVE-2026-55391datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebindingkoxudaxi datamodel-code-generator · datamodel-code-generator
- CVE-2026-54656`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-datakoxudaxi datamodel-code-generator · datamodel-code-generator
- CVE-2026-54690datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)koxudaxi datamodel-code-generator · datamodel-code-generator
- CVE-2026-55415datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statementskoxudaxi datamodel-code-generator · datamodel-code-generator
- CVE-2026-54621`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union descriptionkoxudaxi datamodel-code-generator · datamodel-code-generator
- CVE-2026-54655`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generatorkoxudaxi datamodel-code-generator · datamodel-code-generator
- CVE-2026-54691datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirectskoxudaxi datamodel-code-generator · datamodel-code-generator
- CVE-2026-55390Arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gatekoxudaxi datamodel-code-generator · datamodel-code-generator
- CVE-2026-54654`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` fieldkoxudaxi datamodel-code-generator · datamodel-code-generator
- CVE-2026-13442Langflow is affected by NET Misconfiguration: Use of Impersonation due to multiple unauthenticated and insufficiently authorized API endpointsIBM Langflow OSS
- CVE-2026-13463Due to use of IBM Storage Protect, IBM Cloud Pak System is affected by vulnerability []IBM Cloud Pak System
- CVE-2026-14528IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive informationIBM WebSphere Application Server
- CVE-2026-14893IBM Instana Observability is affected by multiple Prototype Pollution within Instana Agent container imageIBM Observability with Instana
- CVE-2026-14974IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilitiesIBM WebSphere Application Server
- CVE-2026-14976IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerabilityIBM WebSphere Application Server - Liberty
- CVE-2026-14981IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilitiesIBM WebSphere Application Server
- CVE-2026-14996Multiple vulnerabilities in IBM Aspera FaspexIBM Aspera Faspex
- CVE-2026-15057IBM WebSphere Application Server Liberty is affected by a denial of service vulnerabilityIBM WebSphere Application Server - Liberty
- CVE-2026-15064IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilitiesIBM WebSphere Application Server
- CVE-2026-15280IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerabilityIBM WebSphere Application Server - Liberty
- CVE-2026-15325IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilitiesIBM WebSphere Application Server
- CVE-2026-15328IBM WebSphere Application Server and WebSphere Application Server Liberty is inconsistent Interpretation of HTTP RequestsIBM WebSphere Application Server
- CVE-2026-16347Improper restriction of excessive authentication attempts in MikroTik RouterOS and Cloud Hosted RouterMikroTik RouterOS · MikroTik Cloud Hosted Router
- CVE-2026-16184IBM WebSphere Application Server is affected by an authentication bypassIBM WebSphere Application Server
- CVE-2026-16192IBM WebSphere Application Server Liberty is affected by a denial of serviceIBM WebSphere Application Server - Liberty
- CVE-2026-57510SuperPlane < 0.27.0 Broken Object Level Authorization via CanvasService gRPCsuperplanehq superplane
- CVE-2026-48060Litestar: HTML Injection Through CSRF Tokenlitestar-org litestar · litestar
- CVE-2026-49258Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)juev nebula-mesh · github.com/juev/nebula-mesh
- CVE-2026-15992WP Password Policy <= 3.7.1 - Authenticated (Subscriber+) Privilege Escalationteydeastudio WP Password Policy
- CVE-2026-18107Criu: criu: container escape via rseq critical section hijack during checkpoint/restoreRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-16771CVE-2026-16771AT&T Arris BGW210‑700
- CVE-2026-66745Artica Proxy 4.50 Session Fixation via fw.login.phpArticaTech Artica Proxy
- CVE-2026-59932PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustionPHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet
- CVE-2026-48394Bridge | Out-of-bounds Write (CWE-787)Adobe Bridge
- CVE-2026-48391Bridge | Untrusted Search Path (CWE-426)Adobe Bridge
- CVE-2026-48374Bridge | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)Adobe Bridge
- CVE-2026-48392Bridge | Out-of-bounds Write (CWE-787)Adobe Bridge
- CVE-2026-48390Bridge | Incorrect Authorization (CWE-863)Adobe Bridge
- CVE-2026-7769SQL injection Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File GatewayIBM Sterling B2B Integrator · IBM Sterling File Gateway
- CVE-2026-48395Bridge | Untrusted Search Path (CWE-426)Adobe Bridge
- CVE-2026-48393Bridge | Out-of-bounds Write (CWE-787)Adobe Bridge
- CVE-2026-48396Bridge | Incorrect Authorization (CWE-863)Adobe Bridge
- CVE-2026-47726nebula-mesh: GET /api/v1/audit-log discloses all entries to any operatorjuev nebula-mesh · github.com/juev/nebula-mesh
- CVE-2026-16496terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another userHashiCorp Tooling
- CVE-2026-50738A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be dereferenced after the underlying slEnterpriseDB pglogical
- CVE-2026-14869terraform-mcp-server vulnerable to server side request forgery leading to token exposureHashiCorp Tooling
- CVE-2026-48372Format Plugins | Heap-based Buffer Overflow (CWE-122)Adobe Format Plugins
- CVE-2026-48388Photoshop Installer | CWE-427: Uncontrolled Search Path ElementAdobe Photoshop Installer
- CVE-2026-59933PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustionPHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet
- CVE-2026-59931PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelistPHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet
- CVE-2026-54635pytonapi has a Webhook Custom Path Authentication Bypassnessshon tonapi · pytonapi
- CVE-2026-16313Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --exportRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-54609QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwardingQuiet-Terminal-Interactive QTINeon · com.quietterminal:q… +1
- CVE-2026-67185TinyWeb 0.0.8 Path Traversal via URL Path ComponentGeneralSandman TinyWeb
- CVE-2026-54603OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker hostruby-oauth oauth2 · oauth2
- CVE-2026-67184TinyWeb 0.0.8 Null Pointer Dereference DoS via Malformed HTTP RequestGeneralSandman TinyWeb
- CVE-2026-54605OAuth: Cross-origin token-request redirects can expose signed request metadataruby-oauth oauth · oauth
- CVE-2026-67183TinyWeb 0.0.8 Memory Leak DoS via HTTP Request HandlingGeneralSandman TinyWeb
- CVE-2026-18084Cross-Site Scripting (XSS) in Management Console of BlackBerry UEMBlackBerry UEM
- CVE-2026-66754Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encodingtomaka rouille
- CVE-2026-47483NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause uncontrolled reNVIDIA DCGM
- CVE-2026-61609Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)pterodactyl panel · pterodactyl/panel
- CVE-2026-54593Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissionspterodactyl panel · pterodactyl/panel +1
- CVE-2026-43910Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutorappium java-client · io.appium:java-client
- CVE-2026-45293WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerabilityWordPress-Coding-Standards · wp-coding-standards/wpcs
- CVE-2026-47427GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handlergithub-mcp-server · github.com/github/github-mcp-server
- CVE-2026-66749Let's Chat 0.4.0 - 0.4.8 Denial of Service via Null Dereference in Room Lookupsdelements lets-chat
- CVE-2026-66748Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Fieldowen2345 camaleon-cms
- CVE-2026-54545@wakaru/cli arbitrary file write during bundle unpackpionxzh wakaru · @wakaru/cli
- CVE-2026-67178Open Redirect in MISP Installer-Generated Apache Configurationmisp
- CVE-2026-66299Apache Tomcat: DoS via WebSocket chat exampleApache Software Foundation Apache Tomcat
- CVE-2026-63727Anchore Enterprise Privilege Escalation via User Management APIAnchore Enterprise
- CVE-2026-8164Search Order Hijacking in ArkSigner's ArkSigner Desktop ClientArkSigner Software and Hardware Industry and Trade ArkSigne…
- CVE-2026-59878Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoSApache Software Foundation Apache ActiveMQ AMQP · Apache So…
- CVE-2026-66920Pivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph DataPivotick
- CVE-2026-66918DOM-Based Cross-Site Scripting via Unsanitized SVG Node Iconspivotick
- CVE-2026-65881Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1joomdle.com Joomdle component for Joomla
- CVE-2026-62433correct buffer checks for DM_OP hypercallsXen
- CVE-2026-62432evtchn: Race between FIFO expand and resetXen
- CVE-2026-62431Viridian STIMER division by zeroXen
- CVE-2026-62430x86: Out-of-bounds read in vRTC emulationXen
- CVE-2026-62428grant-table: type confusion in grant-copyXen
- CVE-2026-62427sysctl and platform-op locks open to abuseXen
- CVE-2026-62426sysctl and platform-op locks open to abuseXen
- CVE-2026-42492vIRQ event channel binding may break XenstoreXen
- CVE-2026-42493x86 shadow paging is deprecatedXen
- CVE-2026-7187Improper Authentication in Universal Sotware's UKBSUniversal Software UKBS
- CVE-2026-49332Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreamsRed Hat OpenShift Container Platform
- CVE-2026-13440StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'message_popup' Parameterwedevs StoreGrowth – Upsell, BOGO, Quick View, Direct Check…
- CVE-2026-15025Uncanny Automator <= 7.3.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Integration Metadata Disclosure via Multiple AJAX Endpointsuncannyowl Uncanny Automator – Easy Automation, Integration…
- CVE-2026-21047Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote attackers to potentially execute arbitrary code.Samsung Mobile Devices
- CVE-2026-63301Denial of Service in Quick.CMSOpenSolution Quick.CMS
- CVE-2026-59248Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoSninenines cowlib
- CVE-2026-14785Web Directory Free <= 1.7.13 - Unauthenticated SQL Injectionmihail-chepovskiy Web Directory Free
- CVE-2026-14328Eazy Plugin Manager <= 4.4.1 - Authenticated (Subscriber+) Privilege Escalation via pos_get_option AJAX Action and admin/login REST Endpointeazyplugins Eazy Plugin Manager – Powerful Plugin Managemen…
- CVE-2026-10207PickPlugins Question Answer <= 1.2.73 - Unauthenticated SQL Injection via 'id' ParameterPickPlugins Question Answer
- CVE-2026-14169ads-tec Industrial IT: Account lockout via non-atomic user creationads-tec Industrial IT DVG-IRF1401 · ads-tec Industrial I… +4
- CVE-2026-14168ads-tec Industrial IT: Vertical privilege escalation via configuration table writeads-tec Industrial IT DVG-IRF1401 · ads-tec Industrial I… +4
- CVE-2026-14167ads-tec Industrial IT: Privilege escalation during configuration importads-tec Industrial IT DVG-IRF1401 · ads-tec Industrial I… +4
- CVE-2026-61376ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings.ELECOM CO. WAB-M1775-PS · ELECOM CO. WAB-S1775 +3
- CVE-2026-59764ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI.ELECOM CO. WRC-X3000GS3-B · ELECOM CO. WRC-X3000GS3A-B
- CVE-2026-12800Premium Packages <= 6.2.0 - Unauthenticated SQL Injectioncodename065 Premium Packages – Sell Digital Products Secure…
- CVE-2026-13161TrueBooker <= 1.2.2 - Unauthenticated SQL Injectionthemetechmount TrueBooker – Appointment Booking and Schedul…
- CVE-2026-14516Online Scheduling and Appointment Booking System <= 27.5 - Unauthenticated SQL Injectionladela Online Scheduling and Appointment Booking System – B…
- CVE-2024-14041ML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash)Legion of the Bouncy Castle BC-JAVA
- CVE-2026-12741WP Fast Total Search <= 1.80.280 - Unauthenticated SQL Injectionepsiloncool WP Fast Total Search – The Power of Indexed Sea…
- CVE-2026-14924Tablesome < 1.1.31 - Unauthenticated Post Creation and ModificationTablesome Table
- CVE-2026-14870Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_idDatabase for Contact Form 7, WPforms, Elementor forms
- CVE-2026-16585Better Messages <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameterwordplus Better Messages – Chat Rooms, Group Chat, Private…
- CVE-2026-14490Demi <= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX actiondeveasel Demi – One Click Demo Import, Backup & Site Migrat…
- CVE-2026-17524Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the zip-lib
Medium, low and unrated 104
- CVE-2026-59921Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncodernetty · io.netty:netty-codec-http
- CVE-2026-54659Pagy I18n locale option is not validated before being used in a file pathddnexus pagy · pagy
- CVE-2026-66064goshs has ACL Bypass & Path Traversalgoshs-labs goshs · github.com/patrickhener/goshs/v2 +3
- CVE-2026-66063goshs has a Path Traversal issuegoshs-labs goshs · github.com/patrickhener/goshs +3
- CVE-2026-55403datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemaskoxudaxi datamodel-code-generator · datamodel-code-generator
- CVE-2026-14515IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilitiesIBM WebSphere Application Server
- CVE-2026-59941Dompdf: Uncontrolled resource consumption based on declared BMP dimensionsdompdf · dompdf/dompdf
- CVE-2026-59942Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmapsdompdf · dompdf/dompdf
- CVE-2026-49447Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokensazukaar Cosmos-Server · github.com/azukaar/cosmos-server
- CVE-2026-59943Dompdf: Embedded SVG images can leak existence of files and directories within the filesystemdompdf · dompdf/dompdf
- CVE-2026-56722Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URIdompdf · dompdf/dompdf
- CVE-2026-16581Inclusion of sensitive information in source code in igloohome Smart Lock Mobile Applicationigloohome Smart Lock Mobile Application
- CVE-2026-16107TS4500 CLI tool addresses security vulnerabilityIBM TS4500 CLI tool
- CVE-2026-1918IBM Sterling B2B Integrator and IBM Sterling File Gateway store sensitive information in a log fileIBM Sterling B2B Integrator · IBM Sterling File Gateway
- CVE-2026-3157Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosure in mailbox UIIBM Sterling B2B Integrator · IBM Sterling File Gateway
- CVE-2026-3158Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosureIBM Sterling B2B Integrator · IBM Sterling File Gateway
- CVE-2026-55554Dompdf: Chroot Validation Bypassdompdf · dompdf/dompdf
- CVE-2026-55555Dompdf: File existence oracle via font-face stylesheet declarationdompdf · dompdf/dompdf
- CVE-2026-57511SuperPlane < 0.30.0 SMTP Header Injection via Webhook Event Titlesuperplanehq superplane
- CVE-2026-11391Tanium addressed a SQL injection vulnerability in Patch.Tanium Patch
- CVE-2026-48058nebula-mesh: Session and OIDC state cookies lack the Secure attributejuev nebula-mesh · github.com/juev/nebula-mesh
- CVE-2026-4912Media Cleaner: Clean your WordPress! <= 7.0.3 - Authenticated (Administrator+) Server-Side Request Forgerytigroumeow Media Cleaner: Clean your WordPress!
- CVE-2026-5114SpeedyCache <= 1.3.8 - Authenticated (Administrator+) Arbitrary File Readsoftaculous SpeedyCache – Cache, Optimization, Performance
- CVE-2026-15304Plugin Organizer <= 10.2.4 - Authenticated (Subscriber+) SQL Injectionfoomagoo Plugin Organizer
- CVE-2026-47768nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)juev nebula-mesh · github.com/juev/nebula-mesh
- CVE-2026-4932This Power System update is being released to address Insufficient EntropyIBM PowerVM Hypervisor
- CVE-2026-7362Improper Access Control Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File GatewayIBM Sterling B2B Integrator · IBM Sterling File Gateway
- CVE-2026-47725nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpointsjuev nebula-mesh · github.com/juev/nebula-mesh
- CVE-2026-50735pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copyinEnterpriseDB pglogical
- CVE-2026-48025nebula-mesh: Decrypted CA private key persists in heap after signingjuev nebula-mesh · github.com/forgekeep/nebula-mesh +1
- CVE-2026-54620sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbackssparklemotion sqlite3-ruby · sqlite3-ruby +1
- CVE-2026-18085Improper Input Validation Leads to Arbitrary File Download and Potential Denial of Service in BlackBerry UEMBlackBerry UEM
- CVE-2026-54619sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Aritysparklemotion sqlite3-ruby · sqlite3-ruby +1
- CVE-2026-67182Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Header Injectiontomaka rouille
- CVE-2026-54332GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoSgopacket · github.com/gopacket/gopacket
- CVE-2026-54345GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)gopacket · github.com/gopacket/gopacket
- CVE-2026-67181Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding Headertomaka rouille
- CVE-2026-66746Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injectiontomaka rouille
- CVE-2026-7775Cross-site Scripting Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File GatewayIBM Sterling B2B Integrator · IBM Sterling File Gateway
- CVE-2026-7868This Power System update is being released to address incorrect authorizationIBM OPENBMC
- CVE-2026-8058This Power System update is being released to address a sensitive information disclosureIBM OPENBMC
- CVE-2026-66753tiny-http 0.12.0 HTTP Response Splitting via Header Injectiontiny-http
- CVE-2026-66752tiny-http 0.12.0 HTTP Request Smuggling via Transfer-Encoding Handlingtiny-http
- CVE-2026-66751Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:roomsdelements lets-chat
- CVE-2026-66750Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files routesdelements lets-chat
- CVE-2026-62828Microsoft Edge for Android (Chromium-based) Tampering VulnerabilityMicrosoft Edge for Android
- CVE-2026-7521SAML certificate deletion allows path traversal to delete arbitrary files outside the config directoryMattermost
- CVE-2026-6879Quadratic Behavior in xml.etree.ElementPath Index PredicatesPython Software Foundation CPython
- CVE-2026-61487Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinationsApache Software Foundation Apache ActiveMQ Broker · Apac… +1
- CVE-2026-67173Pivotick Unvalidated Node Image URLs Allow Unintended Client-Side Requestspivotick
- CVE-2026-66922Pivotick Prototype-Key Collision in Tree Layout and Cycle Detection Allows Graph Manipulation and Denial of Servicepivotick
- CVE-2026-66921Pivotick - Stored DOM-Based Cross-Site Scripting via Unescaped Markdown Node Referencespivotick
- CVE-2026-66919Stored DOM-Based Cross-Site Scripting in Node Modal HeadersPivotick
- CVE-2026-18038nextlevelbuilder GoClaw jq Handler tools_invoke.go ExecTool.Execute information disclosurenextlevelbuilder GoClaw
- CVE-2026-18047Dogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint authentication bypass via trailing slashRed Hat Certificate System · Red Hat Enterprise Linux
- CVE-2026-15393Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postMeta.font.size' Block Attributecozythemes Cozy Blocks – Page Builder for Gutenberg Editor…
- CVE-2026-15016Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions <= 3.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scriptingstrangerstudios Paid Memberships Pro – Content Restriction,…
- CVE-2026-65882Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1joomdle.com Joomdle component for Joomla
- CVE-2026-62434PoD: Don't try to reclaim special pagesXen
- CVE-2026-62429vNUMA domain cleanup may race other operationsXen
- CVE-2026-62436grant-table: version change racing with other operationsXen
- CVE-2026-62435grant-table: version change racing with other operationsXen
- CVE-2026-62425buffer overruns in libfsimage iso9660 handlingXen
- CVE-2026-62424buffer overruns in libfsimage iso9660 handlingXen
- CVE-2026-62423buffer overruns in libfsimage iso9660 handlingXen
- CVE-2026-42495buffer overruns in libfsimage iso9660 handlingXen
- CVE-2026-42494buffer overruns in libfsimage iso9660 handlingXen
- CVE-2026-66913Zip Bomb in Lookyloo Capture Upload Allows Denial of Servicelookyloo
- CVE-2026-41874Hard-coded admin credentials in Quick.CartOpenSolution Quick.Cart
- CVE-2026-4648Insufficient Encryption Level in CasfID Servicios Tecnológicos NFC WristbandsCasfID Servicios Tecnológicos NFC Wristbands
- CVE-2026-13110StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via bogo_category_msg_create AJAX Actionwedevs StoreGrowth – Upsell, BOGO, Quick View, Direct Check…
- CVE-2026-15411StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Options Update via create_popup AJAX Actionwedevs StoreGrowth – Upsell, BOGO, Quick View, Direct Check…
- CVE-2026-15444Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameterthemeum Tutor LMS – eLearning and online course solution
- CVE-2026-16773WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Actionquantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…
- CVE-2026-16774WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Actionquantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…
- CVE-2026-63303Path Traversal in Quick.CMSOpenSolution Quick.CMS
- CVE-2026-63302Local File Inclusion in Quick.CMSOpenSolution Quick.CMS
- CVE-2026-18028Missing authorization check in event quick setup viewpretix
- CVE-2026-18029Insufficient validation of payment status in pretix-girosolutionpretix-girosolution
- CVE-2026-17072Gstreamer1-plugins-good: gst-plugins-good: 4-byte heap over-read in gst_matroska_parse_flac_stream_headers when parsing flac codec data in matroska containersRed Hat Enterprise Linux
- CVE-2026-65624Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustionninenines cowboy
- CVE-2026-58246Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP PlatformSAP_SE SAP NetWeaver Application Server for ABAP
- CVE-2026-11598Shortcodify <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attributelrnz Shortcodify
- CVE-2026-14171ads-tec Industrial IT: Post-login open redirect in the web interfaceads-tec Industrial IT DVG-IRF1401 · ads-tec Industrial I… +4
- CVE-2026-9680MCP Server Exposure via Insecure Default Binding on alibabacloud-rds-openapi-mcp-serverAlibaba Cloud RDS OpenAPI MCP Server
- CVE-2026-44387ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI.ELECOM CO. WAB-M1775-PS · ELECOM CO. WAB-S1775 +3
- CVE-2026-15267Taskbuilder <= 5.0.9 - Authenticated (Subscriber+) SQL InjectionTaskbuilder – Project Management & Task Management Tool Wit…
- CVE-2026-8167Reflected XSS in theWP's News Theme V8THEWP Digital Solutions News Theme
- CVE-2026-55977Bypass of application rate-limiting mechanismESharePro
- CVE-2026-15730GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode Attributerubengc GamiPress – Gamification plugin to reward points, a…
- CVE-2026-15673SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' Settingscozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order No…
- CVE-2026-15670SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parametercozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order No…
- CVE-2026-15671SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parametercozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order No…
- CVE-2026-14926FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDORFluentCart A New Era of eCommerce
- CVE-2026-14821Quiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Template DeletionQuiz and Survey Master
- CVE-2026-14819Event Tickets < 5.28.4 - Editor+ Stored XSS via Ticket MoveEvent Tickets and Registration
- CVE-2026-16811ShopLentor <= 3.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameterdevitemsllc ShopLentor – All-in-One WooCommerce Growth & St…
- CVE-2026-16587Advanced Form Integration <= 2.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite via auth_redirect() Functionnasirahmed Advanced Form Integration — Connect Forms to 200…
- CVE-2026-15136Cookie Banner for GDPR / CCPA – WPLP Cookie Consent <= 4.3.7 - Cross-Site Request Forgery via Bulk Action to Delete/Resolve Entrieswplegalpages WPLP Cookie Consent – Cookie Banner & Consent…
- CVE-2026-16797ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameterdevitemsllc ShopLentor – All-in-One WooCommerce Growth & St…
- CVE-2026-15012Demi <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copydeveasel Demi – One Click Demo Import, Backup & Site Migrat…
- CVE-2026-6251Chaty Pro <= 3.5.5 - Authenticated (Subscriber+) SQL Injection via 'widget_id' ParameterChaty Pro
- CVE-2026-12124PDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameterwpeverest PDFDraft – Drag & Drop PDF Builder, PDF Viewer, E…
- CVE-2026-17528Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element.nice-select2