# CVEs published 2026-07-28

243 CVEs were published on July 28, 2026: 20 critical, 119 high. Days are UTC.

- [CVE-2026-56822](https://cve.now/CVE-2026-56822.md): Netty: TOCTOU in OcspServerCertificateValidator (CVSS 7.4, netty · io.netty:netty-handler-ssl-ocsp)
- [CVE-2026-56821](https://cve.now/CVE-2026-56821.md): Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator (CVSS 7.4, netty · io.netty:netty-handler-ssl-ocsp)
- [CVE-2026-59921](https://cve.now/CVE-2026-59921.md): Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder (CVSS 5.7, netty · io.netty:netty-codec-http)
- [CVE-2026-54659](https://cve.now/CVE-2026-54659.md): Pagy I18n locale option is not validated before being used in a file path (CVSS 6.9, ddnexus pagy · pagy)
- [CVE-2026-54650](https://cve.now/CVE-2026-54650.md): openhole-server vulnerable to path traversal via URL-decoded request path (CVSS 8.6, bablilayoub openhole · github.com/bablilayoub/openhole)
- [CVE-2026-54658](https://cve.now/CVE-2026-54658.md): @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution (CVSS 9.8, hypequery · @hypequery/clickhouse)
- [CVE-2026-54638](https://cve.now/CVE-2026-54638.md): td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode (CVSS 7.5, gotd td · github.com/gotd/td)
- [CVE-2026-47219](https://cve.now/CVE-2026-47219.md): find-my-way is Vulnerable to DDoS with HTTP2 (CVSS 7.5, delvedor find-my-way · find-my-way)
- [CVE-2026-66064](https://cve.now/CVE-2026-66064.md): goshs has ACL Bypass & Path Traversal (CVSS 5.3, goshs-labs goshs · github.com/patrickhener/goshs/v2 +3)
- [CVE-2026-66063](https://cve.now/CVE-2026-66063.md): goshs has a Path Traversal issue (CVSS 6.5, goshs-labs goshs · github.com/patrickhener/goshs +3)
- [CVE-2026-64863](https://cve.now/CVE-2026-64863.md): goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite (CVSS 9.1, goshs-labs goshs · github.com/patrickhener/goshs +3)
- [CVE-2026-54719](https://cve.now/CVE-2026-54719.md): goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189) (CVSS 7.5, goshs-labs goshs · github.com/patrickhener/goshs +3)
- [CVE-2026-62325](https://cve.now/CVE-2026-62325.md): goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884) (CVSS 9.1, goshs-labs goshs · goshs.de/goshs +2)
- [CVE-2026-55389](https://cve.now/CVE-2026-55389.md): datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema \`$ref\` (\`file://\` and \`../\` traversal), bypassing \`--no-allow-remote-refs\` (CVSS 7.5, koxudaxi datamodel-code-generator · datamodel-code-generator)
- [CVE-2026-54653](https://cve.now/CVE-2026-54653.md): \`datamodel-code-generator\` vulnerable to code injection in via attacker-controlled \`default\_factory\` schema field (CVSS 8.8, koxudaxi datamodel-code-generator · datamodel-code-generator)
- [CVE-2026-55391](https://cve.now/CVE-2026-55391.md): datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding (CVSS 7.5, koxudaxi datamodel-code-generator · datamodel-code-generator)
- [CVE-2026-54656](https://cve.now/CVE-2026-54656.md): \`datamodel-code-generator\` vulnerable to code execution on import via unescaped \`validators\` entries in --extra-template-data (CVSS 7.8, koxudaxi datamodel-code-generator · datamodel-code-generator)
- [CVE-2026-54690](https://cve.now/CVE-2026-54690.md): datamodel-code-generator vulnerable to SSRF via JSON-Schema \`$ref\` to HTTP URL (silent by default) (CVSS 8.2, koxudaxi datamodel-code-generator · datamodel-code-generator)
- [CVE-2026-55415](https://cve.now/CVE-2026-55415.md): datamodel-code-generator vulnerable to code injection via \`x-python-import\` / \`customTypePath\` in generated import statements (CVSS 7.5, koxudaxi datamodel-code-generator · datamodel-code-generator)
- [CVE-2026-54621](https://cve.now/CVE-2026-54621.md): \`datamodel-code-generator\` vulnerable to code injection via unescaped carriage return in GraphQL Union description (CVSS 7.8, koxudaxi datamodel-code-generator · datamodel-code-generator)
- [CVE-2026-54655](https://cve.now/CVE-2026-54655.md): \`datamodel-code-generator\` vulnerable to code execution on import via \`x-python-type\` JSON-Schema extension in datamodel-code-generator (CVSS 7.8, koxudaxi datamodel-code-generator · datamodel-code-generator)
- [CVE-2026-55403](https://cve.now/CVE-2026-55403.md): datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas (CVSS 3.7, koxudaxi datamodel-code-generator · datamodel-code-generator)
- [CVE-2026-54691](https://cve.now/CVE-2026-54691.md): datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects (CVSS 8.2, koxudaxi datamodel-code-generator · datamodel-code-generator)
- [CVE-2026-55390](https://cve.now/CVE-2026-55390.md): Arbitrary local file read via XSD \`schemaLocation\` (\`xs:include\`/\`xs:import\`) path traversal, with no remote-ref gate (CVSS 7.5, koxudaxi datamodel-code-generator · datamodel-code-generator)
- [CVE-2026-54654](https://cve.now/CVE-2026-54654.md): \`datamodel-code-generator\` vulnerable to code injection via unescaped carriage return in \`--extra-template-data\` \`comment\` field (CVSS 7.8, koxudaxi datamodel-code-generator · datamodel-code-generator)
- [CVE-2026-13442](https://cve.now/CVE-2026-13442.md): Langflow is affected by NET Misconfiguration: Use of Impersonation due to multiple unauthenticated and insufficiently authorized API endpoints (CVSS 7.1, IBM Langflow OSS)
- [CVE-2026-13463](https://cve.now/CVE-2026-13463.md): Due to use of IBM Storage Protect, IBM Cloud Pak System is affected by vulnerability \[\] (CVSS 7.5, IBM Cloud Pak System)
- [CVE-2026-14446](https://cve.now/CVE-2026-14446.md): IBM WebSphere Application Server is affected by a privilege escalation (CVSS 9.8, IBM WebSphere Application Server)
- [CVE-2026-14515](https://cve.now/CVE-2026-14515.md): IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities (CVSS 6.1, IBM WebSphere Application Server)
- [CVE-2026-14512](https://cve.now/CVE-2026-14512.md): IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information (CVSS 9.8, IBM WebSphere Application Server)
- [CVE-2026-59941](https://cve.now/CVE-2026-59941.md): Dompdf: Uncontrolled resource consumption based on declared BMP dimensions (CVSS 6.3, dompdf · dompdf/dompdf)
- [CVE-2026-59942](https://cve.now/CVE-2026-59942.md): Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps (CVSS 6.3, dompdf · dompdf/dompdf)
- [CVE-2026-14528](https://cve.now/CVE-2026-14528.md): IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information (CVSS 7.4, IBM WebSphere Application Server)
- [CVE-2026-14893](https://cve.now/CVE-2026-14893.md): IBM Instana Observability is affected by multiple Prototype Pollution within Instana Agent container image (CVSS 7.3, IBM Observability with Instana)
- [CVE-2026-14958](https://cve.now/CVE-2026-14958.md): OS command injection in IBM Aspera Faspex (CVSS 9.1, IBM Aspera Faspex)
- [CVE-2026-49447](https://cve.now/CVE-2026-49447.md): Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens (CVSS 5.3, azukaar Cosmos-Server · github.com/azukaar/cosmos-server)
- [CVE-2026-14959](https://cve.now/CVE-2026-14959.md): OS Command Injection in IBM Aspera Faspex (CVSS 9.1, IBM Aspera Faspex)
- [CVE-2026-14973](https://cve.now/CVE-2026-14973.md): Path Traversal in IBM Desktop App (CVSS 9.3, IBM Aspera Desktop App)
- [CVE-2026-14974](https://cve.now/CVE-2026-14974.md): IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities (CVSS 8.1, IBM WebSphere Application Server)
- [CVE-2026-14976](https://cve.now/CVE-2026-14976.md): IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability (CVSS 7.1, IBM WebSphere Application Server - Liberty)
- [CVE-2026-14981](https://cve.now/CVE-2026-14981.md): IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities (CVSS 7.5, IBM WebSphere Application Server)
- [CVE-2026-14996](https://cve.now/CVE-2026-14996.md): Multiple vulnerabilities in IBM Aspera Faspex (CVSS 8.2, IBM Aspera Faspex)
- [CVE-2026-59943](https://cve.now/CVE-2026-59943.md): Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem (CVSS 6.3, dompdf · dompdf/dompdf)
- [CVE-2026-56722](https://cve.now/CVE-2026-56722.md): Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI (CVSS 6.3, dompdf · dompdf/dompdf)
- [CVE-2026-15057](https://cve.now/CVE-2026-15057.md): IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability (CVSS 7.5, IBM WebSphere Application Server - Liberty)
- [CVE-2026-15064](https://cve.now/CVE-2026-15064.md): IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities (CVSS 8.7, IBM WebSphere Application Server)
- [CVE-2026-15280](https://cve.now/CVE-2026-15280.md): IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability (CVSS 7.5, IBM WebSphere Application Server - Liberty)
- [CVE-2026-15325](https://cve.now/CVE-2026-15325.md): IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities (CVSS 8.7, IBM WebSphere Application Server)
- [CVE-2026-16581](https://cve.now/CVE-2026-16581.md): Inclusion of sensitive information in source code in igloohome Smart Lock Mobile Application (CVSS 5.3, igloohome Smart Lock Mobile Application)
- [CVE-2026-15328](https://cve.now/CVE-2026-15328.md): IBM WebSphere Application Server and WebSphere Application Server Liberty is inconsistent Interpretation of HTTP Requests (CVSS 7.4, IBM WebSphere Application Server)
- [CVE-2026-6881](https://cve.now/CVE-2026-6881.md): Authenticated SQL Injection Enables Unauthorized Access to Sensitive Information in Ellucian Advance Web and Legacy Advance (CVSS 9.4, Ellucian Advance Web · Ellucian Legacy Advance)
- [CVE-2026-16107](https://cve.now/CVE-2026-16107.md): TS4500 CLI tool addresses security vulnerability (CVSS 5.9, IBM TS4500 CLI tool)
- [CVE-2026-16347](https://cve.now/CVE-2026-16347.md): Improper restriction of excessive authentication attempts in MikroTik RouterOS and Cloud Hosted Router (CVSS 8.8, MikroTik RouterOS · MikroTik Cloud Hosted Router)
- [CVE-2026-16184](https://cve.now/CVE-2026-16184.md): IBM WebSphere Application Server is affected by an authentication bypass (CVSS 7.0, IBM WebSphere Application Server)
- [CVE-2026-16192](https://cve.now/CVE-2026-16192.md): IBM WebSphere Application Server Liberty is affected by a denial of service (CVSS 7.1, IBM WebSphere Application Server - Liberty)
- [CVE-2026-1918](https://cve.now/CVE-2026-1918.md): IBM Sterling B2B Integrator and IBM Sterling File Gateway store sensitive information in a log file (CVSS 4.9, IBM Sterling B2B Integrator · IBM Sterling File Gateway)
- [CVE-2026-3157](https://cve.now/CVE-2026-3157.md): Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosure in mailbox UI (CVSS 4.3, IBM Sterling B2B Integrator · IBM Sterling File Gateway)
- [CVE-2026-3158](https://cve.now/CVE-2026-3158.md): Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosure (CVSS 4.3, IBM Sterling B2B Integrator · IBM Sterling File Gateway)
- [CVE-2026-55554](https://cve.now/CVE-2026-55554.md): Dompdf: Chroot Validation Bypass (CVSS 2.3, dompdf · dompdf/dompdf)
- [CVE-2026-55555](https://cve.now/CVE-2026-55555.md): Dompdf: File existence oracle via font-face stylesheet declaration (CVSS 2.3, dompdf · dompdf/dompdf)
- [CVE-2026-57511](https://cve.now/CVE-2026-57511.md): SuperPlane \< 0.30.0 SMTP Header Injection via Webhook Event Title (CVSS 6.3, superplanehq superplane)
- [CVE-2026-57510](https://cve.now/CVE-2026-57510.md): SuperPlane \< 0.27.0 Broken Object Level Authorization via CanvasService gRPC (CVSS 8.7, superplanehq superplane)
- [CVE-2026-48060](https://cve.now/CVE-2026-48060.md): Litestar: HTML Injection Through CSRF Token (CVSS 8.1, litestar-org litestar · litestar)
- [CVE-2026-11391](https://cve.now/CVE-2026-11391.md): Tanium addressed a SQL injection vulnerability in Patch. (CVSS 6.3, Tanium Patch)
- [CVE-2026-49258](https://cve.now/CVE-2026-49258.md): Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete) (CVSS 8.8, juev nebula-mesh · github.com/juev/nebula-mesh)
- [CVE-2026-48058](https://cve.now/CVE-2026-48058.md): nebula-mesh: Session and OIDC state cookies lack the Secure attribute (CVSS 4.6, juev nebula-mesh · github.com/juev/nebula-mesh)
- [CVE-2026-4912](https://cve.now/CVE-2026-4912.md): Media Cleaner: Clean your WordPress! \<= 7.0.3 - Authenticated (Administrator+) Server-Side Request Forgery (CVSS 4.1, tigroumeow Media Cleaner: Clean your WordPress!)
- [CVE-2026-5114](https://cve.now/CVE-2026-5114.md): SpeedyCache \<= 1.3.8 - Authenticated (Administrator+) Arbitrary File Read (CVSS 4.9, softaculous SpeedyCache – Cache, Optimization, Performance)
- [CVE-2026-15304](https://cve.now/CVE-2026-15304.md): Plugin Organizer \<= 10.2.4 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, foomagoo Plugin Organizer)
- [CVE-2026-15992](https://cve.now/CVE-2026-15992.md): WP Password Policy \<= 3.7.1 - Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, teydeastudio WP Password Policy)
- [CVE-2026-18107](https://cve.now/CVE-2026-18107.md): Criu: criu: container escape via rseq critical section hijack during checkpoint/restore (CVSS 7.8, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-16771](https://cve.now/CVE-2026-16771.md): CVE-2026-16771 (CVSS 8.8, AT&T Arris BGW210‑700)
- [CVE-2026-47768](https://cve.now/CVE-2026-47768.md): nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs) (CVSS 5.5, juev nebula-mesh · github.com/juev/nebula-mesh)
- [CVE-2026-66745](https://cve.now/CVE-2026-66745.md): Artica Proxy 4.50 Session Fixation via fw.login.php (CVSS 7.5, ArticaTech Artica Proxy)
- [CVE-2026-4932](https://cve.now/CVE-2026-4932.md): This Power System update is being released to address Insufficient Entropy (CVSS 4.2, IBM PowerVM Hypervisor)
- [CVE-2026-7362](https://cve.now/CVE-2026-7362.md): Improper Access Control Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVSS 4.3, IBM Sterling B2B Integrator · IBM Sterling File Gateway)
- [CVE-2026-59932](https://cve.now/CVE-2026-59932.md): PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion (CVSS 7.5, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet)
- [CVE-2026-48394](https://cve.now/CVE-2026-48394.md): Bridge | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Bridge)
- [CVE-2026-48391](https://cve.now/CVE-2026-48391.md): Bridge | Untrusted Search Path (CWE-426) (CVSS 8.2, Adobe Bridge)
- [CVE-2026-48374](https://cve.now/CVE-2026-48374.md): Bridge | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (CVSS 7.8, Adobe Bridge)
- [CVE-2026-48392](https://cve.now/CVE-2026-48392.md): Bridge | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Bridge)
- [CVE-2026-48390](https://cve.now/CVE-2026-48390.md): Bridge | Incorrect Authorization (CWE-863) (CVSS 8.2, Adobe Bridge)
- [CVE-2026-7769](https://cve.now/CVE-2026-7769.md): SQL injection Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVSS 8.1, IBM Sterling B2B Integrator · IBM Sterling File Gateway)
- [CVE-2026-48395](https://cve.now/CVE-2026-48395.md): Bridge | Untrusted Search Path (CWE-426) (CVSS 8.6, Adobe Bridge)
- [CVE-2026-48393](https://cve.now/CVE-2026-48393.md): Bridge | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Bridge)
- [CVE-2026-48396](https://cve.now/CVE-2026-48396.md): Bridge | Incorrect Authorization (CWE-863) (CVSS 8.6, Adobe Bridge)
- [CVE-2026-47726](https://cve.now/CVE-2026-47726.md): nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator (CVSS 7.1, juev nebula-mesh · github.com/juev/nebula-mesh)
- [CVE-2026-16498](https://cve.now/CVE-2026-16498.md): terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode (CVSS 10.0, HashiCorp Tooling)
- [CVE-2026-16496](https://cve.now/CVE-2026-16496.md): terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user (CVSS 8.9, HashiCorp Tooling)
- [CVE-2026-47725](https://cve.now/CVE-2026-47725.md): nebula-mesh: Web UI lacks CSRF tokens on /ui/\* mutating endpoints (CVSS 6.9, juev nebula-mesh · github.com/juev/nebula-mesh)
- [CVE-2026-50738](https://cve.now/CVE-2026-50738.md): A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be dereferenced after the underlying sl (CVSS 7.7, EnterpriseDB pglogical)
- [CVE-2026-50737](https://cve.now/CVE-2026-50737.md): When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table's default expressions (CVSS 9.0, EnterpriseDB pglogical)
- [CVE-2026-50736](https://cve.now/CVE-2026-50736.md): The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message (CVSS 9.0, EnterpriseDB pglogical)
- [CVE-2026-50735](https://cve.now/CVE-2026-50735.md): pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copyin (CVSS 6.1, EnterpriseDB pglogical)
- [CVE-2026-14869](https://cve.now/CVE-2026-14869.md): terraform-mcp-server vulnerable to server side request forgery leading to token exposure (CVSS 8.6, HashiCorp Tooling)
- [CVE-2026-48372](https://cve.now/CVE-2026-48372.md): Format Plugins | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Format Plugins)
- [CVE-2026-48388](https://cve.now/CVE-2026-48388.md): Photoshop Installer | CWE-427: Uncontrolled Search Path Element (CVSS 8.6, Adobe Photoshop Installer)
- [CVE-2026-48025](https://cve.now/CVE-2026-48025.md): nebula-mesh: Decrypted CA private key persists in heap after signing (CVSS 6.9, juev nebula-mesh · github.com/forgekeep/nebula-mesh +1)
- [CVE-2026-59933](https://cve.now/CVE-2026-59933.md): PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion (CVSS 7.5, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet)
- [CVE-2026-59931](https://cve.now/CVE-2026-59931.md): PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist (CVSS 7.7, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet)
- [CVE-2026-54635](https://cve.now/CVE-2026-54635.md): pytonapi has a Webhook Custom Path Authentication Bypass (CVSS 7.5, nessshon tonapi · pytonapi)
- [CVE-2026-16313](https://cve.now/CVE-2026-16313.md): Sg3\_utils: sg3\_utils: arbitrary command execution via udev property injection in sg\_inq --export (CVSS 7.6, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-54609](https://cve.now/CVE-2026-54609.md): QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT\_REQUEST forwarding (CVSS 8.6, Quiet-Terminal-Interactive QTINeon · com.quietterminal:q… +1)
- [CVE-2026-67185](https://cve.now/CVE-2026-67185.md): TinyWeb 0.0.8 Path Traversal via URL Path Component (CVSS 8.7, GeneralSandman TinyWeb)
- [CVE-2026-54603](https://cve.now/CVE-2026-54603.md): OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host (CVSS 8.6, ruby-oauth oauth2 · oauth2)
- [CVE-2026-67184](https://cve.now/CVE-2026-67184.md): TinyWeb 0.0.8 Null Pointer Dereference DoS via Malformed HTTP Request (CVSS 8.7, GeneralSandman TinyWeb)
- [CVE-2026-54605](https://cve.now/CVE-2026-54605.md): OAuth: Cross-origin token-request redirects can expose signed request metadata (CVSS 7.2, ruby-oauth oauth · oauth)
- [CVE-2026-67183](https://cve.now/CVE-2026-67183.md): TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling (CVSS 8.7, GeneralSandman TinyWeb)
- [CVE-2026-54620](https://cve.now/CVE-2026-54620.md): sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks (CVSS 2.0, sparklemotion sqlite3-ruby · sqlite3-ruby +1)
- [CVE-2026-18084](https://cve.now/CVE-2026-18084.md): Cross-Site Scripting (XSS) in Management Console of BlackBerry UEM (CVSS 8.6, BlackBerry UEM)
- [CVE-2026-18085](https://cve.now/CVE-2026-18085.md): Improper Input Validation Leads to Arbitrary File Download and Potential Denial of Service in BlackBerry UEM (CVSS 5.9, BlackBerry UEM)
- [CVE-2026-54619](https://cve.now/CVE-2026-54619.md): sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity (CVSS 2.0, sparklemotion sqlite3-ruby · sqlite3-ruby +1)
- [CVE-2026-67182](https://cve.now/CVE-2026-67182.md): Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Header Injection (CVSS 6.9, tomaka rouille)
- [CVE-2026-54332](https://cve.now/CVE-2026-54332.md): GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -\> up to 16 GiB make) -\> unauthenticated remote DoS (CVSS 6.9, gopacket · github.com/gopacket/gopacket)
- [CVE-2026-54345](https://cve.now/CVE-2026-54345.md): GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS) (CVSS 6.9, gopacket · github.com/gopacket/gopacket)
- [CVE-2026-67181](https://cve.now/CVE-2026-67181.md): Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding Header (CVSS 6.3, tomaka rouille)
- [CVE-2026-66746](https://cve.now/CVE-2026-66746.md): Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection (CVSS 5.3, tomaka rouille)
- [CVE-2026-66754](https://cve.now/CVE-2026-66754.md): Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove\_prefix percent-encoding (CVSS 8.2, tomaka rouille)
- [CVE-2026-7775](https://cve.now/CVE-2026-7775.md): Cross-site Scripting Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVSS 5.5, IBM Sterling B2B Integrator · IBM Sterling File Gateway)
- [CVE-2026-7868](https://cve.now/CVE-2026-7868.md): This Power System update is being released to address incorrect authorization (CVSS 6.5, IBM OPENBMC)
- [CVE-2026-8058](https://cve.now/CVE-2026-8058.md): This Power System update is being released to address a sensitive information disclosure (CVSS 4.5, IBM OPENBMC)
- [CVE-2026-47483](https://cve.now/CVE-2026-47483.md): NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause uncontrolled re (CVSS 8.2, NVIDIA DCGM)
- [CVE-2026-66753](https://cve.now/CVE-2026-66753.md): tiny-http 0.12.0 HTTP Response Splitting via Header Injection (CVSS 6.3, tiny-http)
- [CVE-2026-61609](https://cve.now/CVE-2026-61609.md): Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS) (CVSS 7.5, pterodactyl panel · pterodactyl/panel)
- [CVE-2026-66752](https://cve.now/CVE-2026-66752.md): tiny-http 0.12.0 HTTP Request Smuggling via Transfer-Encoding Handling (CVSS 6.3, tiny-http)
- [CVE-2026-54593](https://cve.now/CVE-2026-54593.md): Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted \`file.create\` permissions (CVSS 8.1, pterodactyl panel · pterodactyl/panel +1)
- [CVE-2026-43910](https://cve.now/CVE-2026-43910.md): Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor (CVSS 8.2, appium java-client · io.appium:java-client)
- [CVE-2026-66751](https://cve.now/CVE-2026-66751.md): Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room (CVSS 5.3, sdelements lets-chat)
- [CVE-2026-45293](https://cve.now/CVE-2026-45293.md): WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability (CVSS 8.6, WordPress-Coding-Standards · wp-coding-standards/wpcs)
- [CVE-2026-66750](https://cve.now/CVE-2026-66750.md): Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route (CVSS 5.3, sdelements lets-chat)
- [CVE-2026-47427](https://cve.now/CVE-2026-47427.md): GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler (CVSS 7.5, github-mcp-server · github.com/github/github-mcp-server)
- [CVE-2026-66749](https://cve.now/CVE-2026-66749.md): Let's Chat 0.4.0 - 0.4.8 Denial of Service via Null Dereference in Room Lookup (CVSS 7.1, sdelements lets-chat)
- [CVE-2026-66748](https://cve.now/CVE-2026-66748.md): Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select\_eval Custom Field (CVSS 8.7, owen2345 camaleon-cms)
- [CVE-2026-62828](https://cve.now/CVE-2026-62828.md): Microsoft Edge for Android (Chromium-based) Tampering Vulnerability (CVSS 5.4, Microsoft Edge for Android)
- [CVE-2026-54545](https://cve.now/CVE-2026-54545.md): @wakaru/cli arbitrary file write during bundle unpack (CVSS 7.1, pionxzh wakaru · @wakaru/cli)
- [CVE-2026-67178](https://cve.now/CVE-2026-67178.md): Open Redirect in MISP Installer-Generated Apache Configuration (CVSS 7.8, misp)
- [CVE-2026-66299](https://cve.now/CVE-2026-66299.md): Apache Tomcat: DoS via WebSocket chat example (CVSS 7.5, Apache Software Foundation Apache Tomcat)
- [CVE-2026-63727](https://cve.now/CVE-2026-63727.md): Anchore Enterprise Privilege Escalation via User Management API (CVSS 8.7, Anchore Enterprise)
- [CVE-2026-8164](https://cve.now/CVE-2026-8164.md): Search Order Hijacking in ArkSigner's ArkSigner Desktop Client (CVSS 7.3, ArkSigner Software and Hardware Industry and Trade ArkSigne…)
- [CVE-2026-7521](https://cve.now/CVE-2026-7521.md): SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory (CVSS 5.5, Mattermost)
- [CVE-2026-67174](https://cve.now/CVE-2026-67174.md): DOM-Based Cross-Site Scripting via Unsafe String and SVG Icon Rendering in Pivotick (CVSS 9.2, pivotick)
- [CVE-2026-6879](https://cve.now/CVE-2026-6879.md): Quadratic Behavior in xml.etree.ElementPath Index Predicates (CVSS 2.0, Python Software Foundation CPython)
- [CVE-2026-66713](https://cve.now/CVE-2026-66713.md): Apache Axis2/Java: deserialization of untrusted Data (CVSS 9.8, Apache Software Foundation Apache Axis2/Java)
- [CVE-2026-59878](https://cve.now/CVE-2026-59878.md): Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS (CVSS 7.5, Apache Software Foundation Apache ActiveMQ AMQP · Apache So…)
- [CVE-2026-61487](https://cve.now/CVE-2026-61487.md): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations (CVSS 6.5, Apache Software Foundation Apache ActiveMQ Broker · Apac… +1)
- [CVE-2026-67173](https://cve.now/CVE-2026-67173.md): Pivotick Unvalidated Node Image URLs Allow Unintended Client-Side Requests (CVSS 5.1, pivotick)
- [CVE-2026-66922](https://cve.now/CVE-2026-66922.md): Pivotick Prototype-Key Collision in Tree Layout and Cycle Detection Allows Graph Manipulation and Denial of Service (CVSS 5.1, pivotick)
- [CVE-2026-66921](https://cve.now/CVE-2026-66921.md): Pivotick - Stored DOM-Based Cross-Site Scripting via Unescaped Markdown Node References (CVSS 6.3, pivotick)
- [CVE-2026-66920](https://cve.now/CVE-2026-66920.md): Pivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph Data (CVSS 8.2, Pivotick)
- [CVE-2026-66919](https://cve.now/CVE-2026-66919.md): Stored DOM-Based Cross-Site Scripting in Node Modal Headers (CVSS 6.9, Pivotick)
- [CVE-2026-18038](https://cve.now/CVE-2026-18038.md): nextlevelbuilder GoClaw jq Handler tools\_invoke.go ExecTool.Execute information disclosure (CVSS 5.3, nextlevelbuilder GoClaw)
- [CVE-2026-18047](https://cve.now/CVE-2026-18047.md): Dogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint authentication bypass via trailing slash (CVSS 6.5, Red Hat Certificate System · Red Hat Enterprise Linux)
- [CVE-2026-66918](https://cve.now/CVE-2026-66918.md): DOM-Based Cross-Site Scripting via Unsanitized SVG Node Icons (CVSS 8.2, pivotick)
- [CVE-2026-65881](https://cve.now/CVE-2026-65881.md): Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle \< 3.1.1 (CVSS 7.5, joomdle.com Joomdle component for Joomla)
- [CVE-2026-15393](https://cve.now/CVE-2026-15393.md): Cozy Blocks \<= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute (CVSS 6.4, cozythemes Cozy Blocks – Page Builder for Gutenberg Editor…)
- [CVE-2026-15016](https://cve.now/CVE-2026-15016.md): Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions \<= 3.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, strangerstudios Paid Memberships Pro – Content Restriction,…)
- [CVE-2026-65882](https://cve.now/CVE-2026-65882.md): Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle \< 3.1.1 (CVSS 6.1, joomdle.com Joomdle component for Joomla)
- [CVE-2026-62434](https://cve.now/CVE-2026-62434.md): PoD: Don't try to reclaim special pages (CVSS 5.3, Xen)
- [CVE-2026-62433](https://cve.now/CVE-2026-62433.md): correct buffer checks for DM\_OP hypercalls (CVSS 7.3, Xen)
- [CVE-2026-62432](https://cve.now/CVE-2026-62432.md): evtchn: Race between FIFO expand and reset (CVSS 7.3, Xen)
- [CVE-2026-62431](https://cve.now/CVE-2026-62431.md): Viridian STIMER division by zero (CVSS 7.5, Xen)
- [CVE-2026-62430](https://cve.now/CVE-2026-62430.md): x86: Out-of-bounds read in vRTC emulation (CVSS 7.5, Xen)
- [CVE-2026-62429](https://cve.now/CVE-2026-62429.md): vNUMA domain cleanup may race other operations (CVSS 6.5, Xen)
- [CVE-2026-62436](https://cve.now/CVE-2026-62436.md): grant-table: version change racing with other operations (CVSS 6.5, Xen)
- [CVE-2026-62435](https://cve.now/CVE-2026-62435.md): grant-table: version change racing with other operations (CVSS 6.5, Xen)
- [CVE-2026-62428](https://cve.now/CVE-2026-62428.md): grant-table: type confusion in grant-copy (CVSS 7.8, Xen)
- [CVE-2026-62427](https://cve.now/CVE-2026-62427.md): sysctl and platform-op locks open to abuse (CVSS 8.8, Xen)
- [CVE-2026-62426](https://cve.now/CVE-2026-62426.md): sysctl and platform-op locks open to abuse (CVSS 8.8, Xen)
- [CVE-2026-62425](https://cve.now/CVE-2026-62425.md): buffer overruns in libfsimage iso9660 handling (CVSS 5.5, Xen)
- [CVE-2026-62424](https://cve.now/CVE-2026-62424.md): buffer overruns in libfsimage iso9660 handling (CVSS 5.5, Xen)
- [CVE-2026-62423](https://cve.now/CVE-2026-62423.md): buffer overruns in libfsimage iso9660 handling (CVSS 5.5, Xen)
- [CVE-2026-42495](https://cve.now/CVE-2026-42495.md): buffer overruns in libfsimage iso9660 handling (CVSS 5.5, Xen)
- [CVE-2026-42494](https://cve.now/CVE-2026-42494.md): buffer overruns in libfsimage iso9660 handling (CVSS 6.1, Xen)
- [CVE-2026-42492](https://cve.now/CVE-2026-42492.md): vIRQ event channel binding may break Xenstore (CVSS 7.5, Xen)
- [CVE-2026-42493](https://cve.now/CVE-2026-42493.md): x86 shadow paging is deprecated (CVSS 7.5, Xen)
- [CVE-2026-7187](https://cve.now/CVE-2026-7187.md): Improper Authentication in Universal Sotware's UKBS (CVSS 8.8, Universal Software UKBS)
- [CVE-2026-66913](https://cve.now/CVE-2026-66913.md): Zip Bomb in Lookyloo Capture Upload Allows Denial of Service (CVSS 6.9, lookyloo)
- [CVE-2026-49332](https://cve.now/CVE-2026-49332.md): Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams (CVSS 8.5, Red Hat OpenShift Container Platform)
- [CVE-2026-41874](https://cve.now/CVE-2026-41874.md): Hard-coded admin credentials in Quick.Cart (CVSS 6.8, OpenSolution Quick.Cart)
- [CVE-2026-4648](https://cve.now/CVE-2026-4648.md): Insufficient Encryption Level in CasfID Servicios Tecnológicos NFC Wristbands (CVSS 6.8, CasfID Servicios Tecnológicos NFC Wristbands)
- [CVE-2026-13110](https://cve.now/CVE-2026-13110.md): StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart \<= 2.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via bogo\_category\_msg\_create AJAX Action (CVSS 5.3, wedevs StoreGrowth – Upsell, BOGO, Quick View, Direct Check…)
- [CVE-2026-15411](https://cve.now/CVE-2026-15411.md): StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart \<= 2.1.0 - Missing Authorization to Unauthenticated Options Update via create\_popup AJAX Action (CVSS 5.3, wedevs StoreGrowth – Upsell, BOGO, Quick View, Direct Check…)
- [CVE-2026-15444](https://cve.now/CVE-2026-15444.md): Tutor LMS \<= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon\_code' Parameter (CVSS 4.9, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2026-13440](https://cve.now/CVE-2026-13440.md): StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart \<= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'message\_popup' Parameter (CVSS 7.2, wedevs StoreGrowth – Upsell, BOGO, Quick View, Direct Check…)
- [CVE-2026-16773](https://cve.now/CVE-2026-16773.md): WPBot \<= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot\_send\_email\_transcript' AJAX Action (CVSS 5.3, quantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…)
- [CVE-2026-16774](https://cve.now/CVE-2026-16774.md): WPBot \<= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs\_send\_email AJAX Action (CVSS 5.3, quantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…)
- [CVE-2026-15025](https://cve.now/CVE-2026-15025.md): Uncanny Automator \<= 7.3.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Integration Metadata Disclosure via Multiple AJAX Endpoints (CVSS 7.5, uncannyowl Uncanny Automator – Easy Automation, Integration…)
- [CVE-2026-21047](https://cve.now/CVE-2026-21047.md): Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote attackers to potentially execute arbitrary code. (CVSS 8.3, Samsung Mobile Devices)
- [CVE-2026-63303](https://cve.now/CVE-2026-63303.md): Path Traversal in Quick.CMS (CVSS 5.1, OpenSolution Quick.CMS)
- [CVE-2026-63302](https://cve.now/CVE-2026-63302.md): Local File Inclusion in Quick.CMS (CVSS 5.1, OpenSolution Quick.CMS)
- [CVE-2026-63301](https://cve.now/CVE-2026-63301.md): Denial of Service in Quick.CMS (CVSS 7.0, OpenSolution Quick.CMS)
- [CVE-2026-18028](https://cve.now/CVE-2026-18028.md): Missing authorization check in event quick setup view (CVSS 2.3, pretix)
- [CVE-2026-18029](https://cve.now/CVE-2026-18029.md): Insufficient validation of payment status in pretix-girosolution (CVSS 6.3, pretix-girosolution)
- [CVE-2026-65880](https://cve.now/CVE-2026-65880.md): Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms \< 2.4.3 (CVSS 10.0, balbooa.com Balbooa Forms component for Joomla)
- [CVE-2026-17072](https://cve.now/CVE-2026-17072.md): Gstreamer1-plugins-good: gst-plugins-good: 4-byte heap over-read in gst\_matroska\_parse\_flac\_stream\_headers when parsing flac codec data in matroska containers (CVSS 3.3, Red Hat Enterprise Linux)
- [CVE-2026-65624](https://cve.now/CVE-2026-65624.md): Cowboy HTTP/1.1 max\_headers Bypass via Duplicate Header Names Enables Memory Exhaustion (CVSS 6.9, ninenines cowboy)
- [CVE-2026-59248](https://cve.now/CVE-2026-59248.md): Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS (CVSS 8.7, ninenines cowlib)
- [CVE-2026-58246](https://cve.now/CVE-2026-58246.md): Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform (CVSS 4.3, SAP\_SE SAP NetWeaver Application Server for ABAP)
- [CVE-2026-14785](https://cve.now/CVE-2026-14785.md): Web Directory Free \<= 1.7.13 - Unauthenticated SQL Injection (CVSS 7.5, mihail-chepovskiy Web Directory Free)
- [CVE-2026-11598](https://cve.now/CVE-2026-11598.md): Shortcodify \<= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute (CVSS 5.0, lrnz Shortcodify)
- [CVE-2026-14328](https://cve.now/CVE-2026-14328.md): Eazy Plugin Manager \<= 4.4.1 - Authenticated (Subscriber+) Privilege Escalation via pos\_get\_option AJAX Action and admin/login REST Endpoint (CVSS 8.8, eazyplugins Eazy Plugin Manager – Powerful Plugin Managemen…)
- [CVE-2026-10207](https://cve.now/CVE-2026-10207.md): PickPlugins Question Answer \<= 1.2.73 - Unauthenticated SQL Injection via 'id' Parameter (CVSS 7.5, PickPlugins Question Answer)
- [CVE-2026-16462](https://cve.now/CVE-2026-16462.md): SQL injection via unauthenticated GetGridData endpoint (CVSS 9.3, Weidmueller Interface PROCON-WEB SCADA)
- [CVE-2026-11841](https://cve.now/CVE-2026-11841.md): CVE-2026-11841 (CVSS 9.4, SICK AG InspectorP61x · SICK AG InspectorP62x +4)
- [CVE-2026-14171](https://cve.now/CVE-2026-14171.md): ads-tec Industrial IT: Post-login open redirect in the web interface (CVSS 6.1, ads-tec Industrial IT DVG-IRF1401 · ads-tec Industrial I… +4)
- [CVE-2026-14169](https://cve.now/CVE-2026-14169.md): ads-tec Industrial IT: Account lockout via non-atomic user creation (CVSS 8.1, ads-tec Industrial IT DVG-IRF1401 · ads-tec Industrial I… +4)
- [CVE-2026-14168](https://cve.now/CVE-2026-14168.md): ads-tec Industrial IT: Vertical privilege escalation via configuration table write (CVSS 8.8, ads-tec Industrial IT DVG-IRF1401 · ads-tec Industrial I… +4)
- [CVE-2026-14167](https://cve.now/CVE-2026-14167.md): ads-tec Industrial IT: Privilege escalation during configuration import (CVSS 8.7, ads-tec Industrial IT DVG-IRF1401 · ads-tec Industrial I… +4)
- [CVE-2026-9680](https://cve.now/CVE-2026-9680.md): MCP Server Exposure via Insecure Default Binding on alibabacloud-rds-openapi-mcp-server (CVSS 5.8, Alibaba Cloud RDS OpenAPI MCP Server)
- [CVE-2026-61376](https://cve.now/CVE-2026-61376.md): ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings. (CVSS 7.2, ELECOM CO. WAB-M1775-PS · ELECOM CO. WAB-S1775 +3)
- [CVE-2026-59764](https://cve.now/CVE-2026-59764.md): ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. (CVSS 7.2, ELECOM CO. WRC-X3000GS3-B · ELECOM CO. WRC-X3000GS3A-B)
- [CVE-2026-44387](https://cve.now/CVE-2026-44387.md): ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. (CVSS 5.2, ELECOM CO. WAB-M1775-PS · ELECOM CO. WAB-S1775 +3)
- [CVE-2026-12800](https://cve.now/CVE-2026-12800.md): Premium Packages \<= 6.2.0 - Unauthenticated SQL Injection (CVSS 7.5, codename065 Premium Packages – Sell Digital Products Secure…)
- [CVE-2026-13161](https://cve.now/CVE-2026-13161.md): TrueBooker \<= 1.2.2 - Unauthenticated SQL Injection (CVSS 7.5, themetechmount TrueBooker – Appointment Booking and Schedul…)
- [CVE-2026-15267](https://cve.now/CVE-2026-15267.md): Taskbuilder \<= 5.0.9 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, Taskbuilder – Project Management & Task Management Tool Wit…)
- [CVE-2026-14516](https://cve.now/CVE-2026-14516.md): Online Scheduling and Appointment Booking System \<= 27.5 - Unauthenticated SQL Injection (CVSS 7.5, ladela Online Scheduling and Appointment Booking System – B…)
- [CVE-2026-8167](https://cve.now/CVE-2026-8167.md): Reflected XSS in theWP's News Theme V8 (CVSS 6.1, THEWP Digital Solutions News Theme)
- [CVE-2026-55977](https://cve.now/CVE-2026-55977.md): Bypass of application rate-limiting mechanism (CVSS 3.3, ESharePro)
- [CVE-2024-14041](https://cve.now/CVE-2024-14041.md): ML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash) (CVSS 8.2, Legion of the Bouncy Castle BC-JAVA)
- [CVE-2026-12741](https://cve.now/CVE-2026-12741.md): WP Fast Total Search \<= 1.80.280 - Unauthenticated SQL Injection (CVSS 7.5, epsiloncool WP Fast Total Search – The Power of Indexed Sea…)
- [CVE-2026-11756](https://cve.now/CVE-2026-11756.md): Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x (CVSS 10.0, Dassault Systèmes Station Launcher App in 3DEXPERIENCE plat…)
- [CVE-2026-15730](https://cve.now/CVE-2026-15730.md): GamiPress \<= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading\_size' Shortcode Attribute (CVSS 6.4, rubengc GamiPress – Gamification plugin to reward points, a…)
- [CVE-2026-15673](https://cve.now/CVE-2026-15673.md): SMS Alert \<= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout\_payment\_plans' and 'order\_status' Settings (CVSS 4.4, cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order No…)
- [CVE-2026-15670](https://cve.now/CVE-2026-15670.md): SMS Alert \<= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter (CVSS 4.9, cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order No…)
- [CVE-2026-15671](https://cve.now/CVE-2026-15671.md): SMS Alert \<= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter (CVSS 4.9, cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order No…)
- [CVE-2026-15014](https://cve.now/CVE-2026-15014.md): SMS Alert \<= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing\_phone' Parameter (CVSS 9.8, cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order No…)
- [CVE-2026-14926](https://cve.now/CVE-2026-14926.md): FluentCart \< 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR (CVSS 4.2, FluentCart A New Era of eCommerce)
- [CVE-2026-14924](https://cve.now/CVE-2026-14924.md): Tablesome \< 1.1.31 - Unauthenticated Post Creation and Modification (CVSS 7.5, Tablesome Table)
- [CVE-2026-14870](https://cve.now/CVE-2026-14870.md): Database for Contact Form 7, WPforms, Elementor forms \< 1.5.3 - Reflected XSS via form\_id (CVSS 7.1, Database for Contact Form 7, WPforms, Elementor forms)
- [CVE-2026-14821](https://cve.now/CVE-2026-14821.md): Quiz And Survey Master \< 11.1.5 - Contributor+ Arbitrary Template Deletion (CVSS 2.7, Quiz and Survey Master)
- [CVE-2026-14819](https://cve.now/CVE-2026-14819.md): Event Tickets \< 5.28.4 - Editor+ Stored XSS via Ticket Move (CVSS 3.5, Event Tickets and Registration)
- [CVE-2026-14545](https://cve.now/CVE-2026-14545.md): TrueBooker Appointment Booking \< 1.2.4 - Unauthenticated Account Takeover via Password Reset (CVSS 9.8, TrueBooker)
- [CVE-2026-16585](https://cve.now/CVE-2026-16585.md): Better Messages \<= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter (CVSS 7.2, wordplus Better Messages – Chat Rooms, Group Chat, Private…)
- [CVE-2026-16811](https://cve.now/CVE-2026-16811.md): ShopLentor \<= 3.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter (CVSS 4.9, devitemsllc ShopLentor – All-in-One WooCommerce Growth & St…)
- [CVE-2026-16587](https://cve.now/CVE-2026-16587.md): Advanced Form Integration \<= 2.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite via auth\_redirect() Function (CVSS 4.3, nasirahmed Advanced Form Integration — Connect Forms to 200…)
- [CVE-2026-15136](https://cve.now/CVE-2026-15136.md): Cookie Banner for GDPR / CCPA – WPLP Cookie Consent \<= 4.3.7 - Cross-Site Request Forgery via Bulk Action to Delete/Resolve Entries (CVSS 4.3, wplegalpages WPLP Cookie Consent – Cookie Banner & Consent…)
- [CVE-2026-16797](https://cve.now/CVE-2026-16797.md): ShopLentor \<= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter (CVSS 4.3, devitemsllc ShopLentor – All-in-One WooCommerce Growth & St…)
- [CVE-2026-14490](https://cve.now/CVE-2026-14490.md): Demi \<= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi\_restore\_step AJAX action (CVSS 7.5, deveasel Demi – One Click Demo Import, Backup & Site Migrat…)
- [CVE-2026-15012](https://cve.now/CVE-2026-15012.md): Demi \<= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copy (CVSS 5.3, deveasel Demi – One Click Demo Import, Backup & Site Migrat…)
- [CVE-2026-6251](https://cve.now/CVE-2026-6251.md): Chaty Pro \<= 3.5.5 - Authenticated (Subscriber+) SQL Injection via 'widget\_id' Parameter (CVSS 6.5, Chaty Pro)
- [CVE-2026-12124](https://cve.now/CVE-2026-12124.md): PDFDraft \<= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter (CVSS 5.3, wpeverest PDFDraft – Drag & Drop PDF Builder, PDF Viewer, E…)
- [CVE-2026-17528](https://cve.now/CVE-2026-17528.md): Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the \<select\> element. (CVSS 5.3, nice-select2)
- [CVE-2026-17524](https://cve.now/CVE-2026-17524.md): Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the (CVSS 8.7, zip-lib)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-07-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.