CVEs published July 29, 2026
274 CVEs were published on July 29, 2026: 48 critical, 114 high. 1 is now in CISA KEV.
- Published
- 274
- Critical
- 48
- High
- 114
- Medium
- 102
- Low
- 10
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 120
Most affected products
- Apache Software Foundation Apache Traffic Server
- 38
- Three Learning Koollab LMS
- 15
- GitLab
- 13
- balbooa.com Gridbox extension for Joomla
- 11
- acacode swagger-typescript-api · swagger-typescript-api
- 6
- flytohub flyto-core · flyto-core
- 6
- Autel MaxiCharger AC Elite Home
- 5
- DriveLock
- 5
- Linux
- 5
- modelcontextprotocol ruby-sdk · mcp
- 5
Critical 48
- CVE-2026-67595VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.phpwebreinvent vaahcms
- CVE-2026-67429Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)flytohub flyto-core · flyto-core
- CVE-2026-67426Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltrationflytohub flyto-core · flyto-core
- CVE-2026-16326consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless modeHashiCorp Tooling
- CVE-2026-14529IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgeryIBM WebSphere Application Server
- CVE-2026-41939Care Everywhere Gateway 14.3.10 Hard-coded Credentials RCE via WildFlyCare Everywhere Gateway
- CVE-2026-18236Google-ADK Continuation ForgeryGoogle-ADK
- CVE-2026-54680Logging operator has Fluentd configuration injection that allows remote code executionkube-logging logging-operator · github.com/kube-logging/log…
- CVE-2026-8338Authentication and Authorization Bypass in Coverity ConnectBlack Duck Coverity Connect
- CVE-2026-54735prebid-server's request forgery vulnerability allows for possible host environment data extractionprebid-server · github.com/prebid/prebid-server/v4 +3
- CVE-2026-67192Xlight FTP Server < 3.9.5 Pre-Auth Stack Buffer Overflow via SSH GCM CipherXlight FTP Server
- CVE-2026-67191Xlight FTP Server < 3.9.5 Pre-Auth Heap Buffer Overflow via SSH ParserXlight FTP Server
- CVE-2026-60113AIT-DSN < 2.2.2 Missing Authentication via SLE API RoutesNASA-AMMOS AIT-DSN
- CVE-2026-60112AIT-GUI < 2.5.1 Missing Authentication via Sessions.create()NASA-AMMOS AIT-GUI
- CVE-2026-65888Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2balbooa.com Gridbox extension for Joomla
- CVE-2026-65887Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2balbooa.com Gridbox extension for Joomla
- CVE-2026-65886Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2balbooa.com Gridbox extension for Joomla
- CVE-2026-65890Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2balbooa.com Gridbox extension for Joomla
- CVE-2026-65889Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.2balbooa.com Gridbox extension for Joomla
- CVE-2026-9177Server-Side Template Injection in SecureTransport's Apache Velocity mail templatesAxway SecureTransport
- CVE-2026-0667CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service andSchneider Electric SCADAPack · Schneider Electric RemoteCon…
- CVE-2026-65884Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2balbooa.com Gridbox extension for Joomla
- CVE-2026-65885Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2balbooa.com Gridbox extension for Joomla
- CVE-2026-65883Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0aimy-extensions.com Aimy Captcha-Less Form Guard plugin for…
- CVE-2026-14488Meta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id' ParameterMeta Box AIO
- CVE-2026-14900Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' ParameterStylemixThemes Cost Calculator Builder PRO
- CVE-2026-58162Apache Traffic Server: Certifier plugin trusts client SNI when generating certificatesApache Software Foundation Apache Traffic Server
- CVE-2026-59243Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)Apache Software Foundation Apache Airflow FAB provider
- CVE-2025-10656Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account Creationholest Spreadsheet Price Changer for WooCommerce and WP E-c…
- CVE-2026-58155Apache Traffic Server: Header-name length truncation enables header aliasing and request smugglingApache Software Foundation Apache Traffic Server
- CVE-2026-58150Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smugglingApache Software Foundation Apache Traffic Server
- CVE-2026-57834Apache Traffic Server: Malformed chunked message body allows request smugglingApache Software Foundation Apache Traffic Server
- CVE-2026-33267Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadataApache Software Foundation Apache Traffic Server
- CVE-2026-41920Apache Traffic Server: SNI to Host header matching policy is not properly enforcedApache Software Foundation Apache Traffic Server
- CVE-2026-18191Vacron｜IP Camera - Hidden FunctionalityVacron VIN-DS783E-E6
- CVE-2026-63234SQL injection and unsafe deserialisation vulnerabilityThree Learning Koollab LMS
- CVE-2026-63233SQL injection and unsafe deserialisation vulnerabilityThree Learning Koollab LMS
- CVE-2026-63232SQL injection and unsafe deserialisation vulnerabilityThree Learning Koollab LMS
- CVE-2026-63230Pre-authentication error-based SQL injection vulnerabilityThree Learning Koollab LMS
- CVE-2026-63229Pre-authentication blind SQL injection vulnerabilityThree Learning Koollab LMS
- CVE-2026-63227Unrestricted SCORM file upload vulnerabilityAn unrestricted SCORM file upload vulnerability in Koollab…
- CVE-2026-13423Streamit <= 4.5.0 - Unauthenticated Remote Code Execution via Arbitrary Function CallStreamit
- CVE-2026-18072Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameternico23 Advanced Responsive Video Embedder for Rumble, Odyse…
- CVE-2025-65340kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php.
- CVE-2025-67403Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_class.php via the parameter class_name.
- CVE-2025-67404Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save_stud.php via the parameters fname, lname, and st
- CVE-2025-69942kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1.
- CVE-2025-69943kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get_doctor.php via the parameters doctor and specilizationid.
High 114
- CVE-2026-67437OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)OliveTin · github.com/OliveTin/OliveTin
- CVE-2026-13308Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution VulnerabilityAutel MaxiCharger AC Elite Home
- CVE-2026-67436Linuxfabrik monitoring-plugins: SSRF and auth-token disclosure via unvalidated @odata.id link in redfish-* pluginsLinuxfabrik monitoring-plugins
- CVE-2026-67432MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransportmodelcontextprotocol ruby-sdk · mcp
- CVE-2026-67431MCP Ruby SDK: Ruby SSE Session Poisoningmodelcontextprotocol ruby-sdk · mcp
- CVE-2026-5057ATEN Unizon RpcProvider Missing Authentication Denial-of-Service VulnerabilityATEN Unizon
- CVE-2026-5056GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution VulnerabilityGStreamer
- CVE-2026-5491DriveLock Directory Traversal Information Disclosure VulnerabilityDriveLock
- CVE-2026-5490DriveLock SQL Injection Privilege Escalation VulnerabilityDriveLock
- CVE-2026-5487DriveLock Directory Traversal Information Disclosure VulnerabilityDriveLock
- CVE-2026-6102MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation VulnerabilityMSI Center
- CVE-2026-13268G DATA Total Security Backup Service Link Following Local Privilege Escalation VulnerabilityG DATA Total Security
- CVE-2026-12357Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution VulnerabilityHeimdall Data Database Proxy
- CVE-2026-6267Insertion of Sensitive Information Into Sent Data in GitLabGitLab
- CVE-2026-12436Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLabGitLab
- CVE-2026-15975Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-18022pgvector buffer overflow via integer wraparound in IVFFlat index build on 32-bit systemspgvector
- CVE-2026-67428Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)flytohub flyto-core · flyto-core
- CVE-2026-67427Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylistedflytohub flyto-core · flyto-core
- CVE-2026-67425Flyto2 Core: LLM/API keys leak to an attacker-controlled base_urlflytohub flyto-core · flyto-core
- CVE-2026-16328consul-mcp-server vulnerable to server side request forgery leading to token exposureHashiCorp Tooling
- CVE-2026-67424Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidationflytohub flyto-core · flyto-core
- CVE-2026-12935Unauthenticated Remote Code Execution in TP-Link TL-WR940N RTSP Conntrack FeatureTP-Link Systems TL-WR940N
- CVE-2026-67201V 0.5.2 SSRF Bypass via Parser Differential in net.urllib and net.httpvlang v
- CVE-2026-40272Vulnerability in the QNX libtraceparser Impacts QNX Software Development PlatformBlackBerry QNX Software Development Platform
- CVE-2026-59901Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hangnetty · io.netty:netty-codec-compression +1
- CVE-2026-8497Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on AndrDevolutions Password Manager
- CVE-2026-142667-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability7-Zip
- CVE-2026-54693ZITADEL Users Can Self-Verify Email/Phone via APIzitadel · github.com/zitadel/zitadel
- CVE-2026-64560posix-cpu-timers: Prevent UAF caused by non-leader exec() raceLinux
- CVE-2026-54727proot-distro has a Container Isolation Bypass via Crafted Restore Archivetermux proot-distro · proot-distro
- CVE-2026-67194Courier IMAP < 6.0.1 Mail Server < 2.0.2 Stack Overflow DoS via Nested SEARCH Queriessvarshavchik Courier IMAP · svarshavchik Courier Mail Server
- CVE-2026-18255Quay: quay: global read-only superuser can view robot account tokensRed Hat Quay
- CVE-2026-13697undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directivesundici
- CVE-2026-54574`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archivetermux proot-distro · proot-distro
- CVE-2026-8339SQL Injection in Coverity Connect SOAP APIBlack Duck Coverity Connect
- CVE-2026-64559s390/pkey: Check length in PKEY_VERIFYPROTK ioctlLinux
- CVE-2026-64558s390/pkey: Check length in pkey_pckmo handler implementationLinux
- CVE-2026-15144@fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation@fastify/rate-limit
- CVE-2026-16543Kong Operator cluster-wide ingress configuration DoS via embedded KIC CA-certificate ID collisionKong/kong-operator
- CVE-2026-15228Kong Kubernetes Ingress Controller cluster-wide ingress configuration DoS via CA-certificate ID collisionKong/kubernetes-ingress-controller
- CVE-2026-16463DXF File Parsing Heap-Based Overflow in Autodesk AutoCADAutodesk AutoCAD · Autodesk DWG TrueView
- CVE-2026-54078veraPDF Validation XXE via Rich TextveraPDF-validation · org.verapdf:validation-model +1
- CVE-2026-54079veraPDF Validation XXE via XFAveraPDF-validation · org.verapdf:validation-model +1
- CVE-2026-54666swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodiesacacode swagger-typescript-api · swagger-typescript-api
- CVE-2026-54664swagger-typescript-api vulnerable to code injection via unescaped enum string valuesacacode swagger-typescript-api · swagger-typescript-api
- CVE-2026-54661swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client templateacacode swagger-typescript-api · swagger-typescript-api
- CVE-2026-54662swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client templateacacode swagger-typescript-api · swagger-typescript-api
- CVE-2026-59247Insufficient verification of Hex package metadata in Gleamgleam-lang gleam
- CVE-2026-54660swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`acacode swagger-typescript-api · swagger-typescript-api
- CVE-2026-12703Bypass of 2FA for Connections via Unattended Access in TeamViewer for macOSTeamViewer Remote · TeamViewer Tensor +1
- CVE-2026-66723Missing authentication requirement in Remote Instances proxy API in MWDB CoreCERT.PL MWDB Core
- CVE-2026-65947Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2balbooa.com Gridbox extension for Joomla
- CVE-2026-55995Double-free in the iSNS attribute decoder in open-iscsiopen-iscsi
- CVE-2026-67216cJSON cJSON_Compare Exponential Complexity Denial of ServiceDaveGamble cJSON
- CVE-2026-67215cJSON JSON Patch copy/add Uncontrolled Recursion Stack ExhaustionDaveGamble cJSON
- CVE-2026-67214nanoid Infinite Loop via Negative Size in non-secure modulenanoid_project nanoid · nanoid
- CVE-2026-67213nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandomnanoid_project nanoid · nanoid
- CVE-2026-44944iscsiuio control-socket authentication bypass in open-iscsiopen-iscsi
- CVE-2026-65944Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.0rolandd.com RO CSVI extension for Joomla
- CVE-2026-65943Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0rolandd.com RO CSVI extension for Joomla
- CVE-2026-50641Plaintext password storage in Streamsoft Business IntelligenceStreamsoft Business Intelligence
- CVE-2026-12927CWE-787 Out-of-bounds write vulnerability exists that could cause loss of data or potentially risk arbitrary code execution when a maliciousSchneider Electric IGSS Definition
- CVE-2026-14354CWE-522 Insufficiently Protected Credentials vulnerability exists that could cause authentication bypass and unauthorized credential modificSchneider Electric EcoStruxure™ Cybersecurity Admin Expert
- CVE-2026-14270Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settingsThemeComplete Extra Checkout Options - addon for Extra Prod…
- CVE-2026-12895SQL Injection in Frappe's ERPNextFrappe ERPNext
- CVE-2026-18220Binutils: binutils: out-of-bounds write in bfd dlx elf backend relocation processingRed Hat Enterprise Linux · Red Hat Hardened Images +1
- CVE-2026-16655Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Memberwpmanageninja Fluent Forms – Customizable Contact Forms, Su…
- CVE-2026-16597GTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fieldsduracelltomi GTM4WP – A Google Tag Manager (GTM) plugin for…
- CVE-2026-50622Apache Atlas: Missing Authorization on Admin EndpointsApache Software Foundation Apache Atlas
- CVE-2026-23904Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxyApache Software Foundation Apache Kyuubi
- CVE-2026-58189Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplificationApache Software Foundation Apache Traffic Server
- CVE-2026-58188Apache Traffic Server: Memory-safety and limit-bypass errors across experimental pluginsApache Software Foundation Apache Traffic Server
- CVE-2026-58186Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responsesApache Software Foundation Apache Traffic Server
- CVE-2026-58184Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memoryApache Software Foundation Apache Traffic Server
- CVE-2026-58182Apache Traffic Server: ts_lua plugin has initialization and resource-handling errorsApache Software Foundation Apache Traffic Server
- CVE-2026-58181Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crashApache Software Foundation Apache Traffic Server
- CVE-2026-58180Apache Traffic Server: txn_box plugin overflows the stack from attacker inputApache Software Foundation Apache Traffic Server
- CVE-2026-58179Apache Traffic Server: regex_remap plugin overflows the stack from attacker inputApache Software Foundation Apache Traffic Server
- CVE-2026-58178Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgeryApache Software Foundation Apache Traffic Server
- CVE-2026-58177Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts frameworkApache Software Foundation Apache Traffic Server
- CVE-2026-58175Apache Traffic Server: HostDB SRV handling leaks memoryApache Software Foundation Apache Traffic Server
- CVE-2026-58164Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-freeApache Software Foundation Apache Traffic Server
- CVE-2026-58163Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the serverApache Software Foundation Apache Traffic Server
- CVE-2026-58161Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the serverApache Software Foundation Apache Traffic Server
- CVE-2026-58159Apache Traffic Server: Listener and ACL handling allow access-control bypassApache Software Foundation Apache Traffic Server
- CVE-2026-58157Apache Traffic Server: Improper server-session reuse can expose data across client connectionsApache Software Foundation Apache Traffic Server
- CVE-2026-58154Apache Traffic Server: Memory-safety errors in MIME and header parsingApache Software Foundation Apache Traffic Server
- CVE-2026-65324Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustionApache Software Foundation Apache Traffic Server
- CVE-2026-58153Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafelyApache Software Foundation Apache Traffic Server
- CVE-2026-58151Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the serverApache Software Foundation Apache Traffic Server
- CVE-2026-64557Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()Linux
- CVE-2026-64556perf/core: Detach event groups during remove_on_execLinux
- CVE-2026-13425Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Valuescode4life Database for CF7
- CVE-2026-24033Apache Traffic Server: Request smuggling via chunked extension quoted-string parsingApache Software Foundation Apache Traffic Server
- CVE-2026-22068Apache Traffic Server: Regex mappings match with malicious domain namesApache Software Foundation Apache Traffic Server
- CVE-2026-35226Out-of-bounds Write in CODESYS PROFINET ControllerCODESYS PROFINET
- CVE-2026-18192Vacron｜IP Camera - Arbitrary File ReadVacron VIN-DS783E-E6
- CVE-2026-63231Post-authentication SQL injection vulnerabilityThree Learning Koollab LMS
- CVE-2026-14300miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account TakeoverminiOrange Social Login and Register
- CVE-2026-14234WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRFWOLF
- CVE-2026-13690UsersWP < 1.2.67 - Two-Factor Authentication BypassUsersWP
- CVE-2026-11974Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Downloadwp-media-folder-addon
- CVE-2026-12476Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parametersmub Easy Digital Downloads – eCommerce Payments and Subscr…
- CVE-2026-12144Wholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parametersaadiqbal Wholesale for WooCommerce
- CVE-2025-60931An Insecure Direct Object Reference (IDOR) in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized
- CVE-2025-67405Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_password.php via the parameter new_password.
- CVE-2025-67406https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection.
- CVE-2025-67407Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_student.php via parameters fname and student_c
- CVE-2025-67408Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save_user.php via the parameter status.
- CVE-2025-69944kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in the view-medhistory.php endpoint via the viewid parameter.
- CVE-2025-69945kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1.
- CVE-2025-69949kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability.php via the parameters emailid and email.
- CVE-2026-50782Jinher OA C6 contains an XML External Entity (XXE) injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/G
Medium, low and unrated 112
- CVE-2026-62343ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is providedImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-64685ImageMagick: Heap Buffer Over-Read in BGR decoder due to mising end-of-file checkImageMagick
- CVE-2026-15157undici vulnerable to CRLF Injection via blob-like body 'type' propertyundici
- CVE-2026-14643undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directivesundici
- CVE-2026-16728undici vulnerable to downstream response desynchronization via retry interceptorundici
- CVE-2026-67439OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action OutputOliveTin · github.com/OliveTin/OliveTin
- CVE-2026-67438OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety CheckOliveTin · github.com/OliveTin/OliveTin
- CVE-2026-54249VercelAIAdapter trusts client-controlled `providerMetadata` to construct `UploadedFile` — S3/GCS confused deputy via provider metadata injectionpydantic-ai · pydantic-ai-slim
- CVE-2026-46678Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)pydantic-ai · pydantic-ai-slim
- CVE-2026-13307Autel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code Execution VulnerabilityAutel MaxiCharger AC Elite Home
- CVE-2026-13309Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution VulnerabilityAutel MaxiCharger AC Elite Home
- CVE-2026-13306Autel MaxiCharger AC Elite Home USB Authentication Bypass VulnerabilityAutel MaxiCharger AC Elite Home
- CVE-2026-13305Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution VulnerabilityAutel MaxiCharger AC Elite Home
- CVE-2026-65975Pydantic AI AG-UI Adapter: A dangling client-submitted tool call can execute when a trailing message is dropped during `sanitize_messages`pydantic-ai · pydantic-ai-slim
- CVE-2026-67435linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirectLinuxfabrik monitoring-plugins · linuxfabrik-lib
- CVE-2026-67433Linuxfabrik monitoring-plugins: Symlink following in logfile legacy database migrationLinuxfabrik monitoring-plugins
- CVE-2026-63119MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)modelcontextprotocol ruby-sdk · mcp
- CVE-2026-67430MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize floodmodelcontextprotocol ruby-sdk · mcp
- CVE-2026-5492DriveLock Directory Traversal Information Disclosure VulnerabilityDriveLock
- CVE-2026-5489DriveLock Directory Traversal Information Disclosure VulnerabilityDriveLock
- CVE-2026-63118MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protectionmodelcontextprotocol ruby-sdk · mcp
- CVE-2026-18266Dify AI Workflow oauth_redirect_url Open Redirect VulnerabilityLangGenius Dify
- CVE-2025-14562Incorrect Authorization in GitLabGitLab
- CVE-2026-3093Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-4672Missing Authorization in GitLabGitLab
- CVE-2026-6336Incorrect Authorization in GitLabGitLab
- CVE-2026-13113Time-of-check Time-of-use (TOCTOU) Race Condition in GitLabGitLab
- CVE-2026-14341Missing Authorization in GitLabGitLab
- CVE-2026-14351Exposure of Sensitive Information Through Metadata in GitLabGitLab
- CVE-2026-15077Improper Neutralization of Input Used for LLM Prompting in GitLabGitLab
- CVE-2026-15831Generation of Incorrect Security Tokens in GitLabGitLab
- CVE-2026-16553Insufficiently Protected Credentials in GitLabGitLab
- CVE-2026-13346pip absolute path traversal during download from malicious package indexesPython Packaging Authority pip · pip
- CVE-2026-62995joserfc accepts JWT with padding, leading to JWT malleabilityauthlib joserfc
- CVE-2026-2482IBM WebSphere Application Server Liberty is affected by a cross-site request forgeryIBM WebSphere Application Server - Liberty
- CVE-2026-10684Out-of-bounds read in coredump shell when printing stored-dump target codezephyrproject zephyr
- CVE-2026-59898Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validationnetty · io.netty:netty-codec-http
- CVE-2026-59899Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Servicenetty · io.netty:netty-codec-http
- CVE-2026-59900Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypassnetty · io.netty:netty-codec-http2
- CVE-2026-59919Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Addressnetty · io.netty:netty-codec-haproxy
- CVE-2026-59920Netty: STOMP CONNECT Frame Header Injectionnetty · io.netty:netty-codec-stomp
- CVE-2026-13723Develar's electron-builder allows arbitrary file overwriteDevelar app-builder
- CVE-2026-54705mathlive's Lack of Escaping of HTML allows for XSSarnog mathlive · mathlive
- CVE-2026-16729undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fieldsundici
- CVE-2026-18257Improper Certificate Validation in S2OPCSysterel S2OPC
- CVE-2026-20316Cisco Secure Firewall Management Center Software Static Credential VulnerabilityCisco Secure Firewall Management Center
- CVE-2026-52791fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC)containers fuse-overlayfs
- CVE-2026-67193Xlight FTP Server < 3.9.5 Information Disclosure via USER CommandXlight FTP Server
- CVE-2026-50558Penelope unsafe tar extraction allows arbitrary local file write via crafted session archivebrightio penelope · penelope-shell-handler
- CVE-2026-17550DWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCADAutodesk AutoCAD · Autodesk DWG TrueView
- CVE-2026-16465DWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCADAutodesk AutoCAD · Autodesk DWG TrueView
- CVE-2026-54081veraPDF Parser DoS via PostScript Type 1 Font ProgramsveraPDF-parser · org.verapdf:parser
- CVE-2026-54080veraPDF Parser DoS via PostScript CMap StreamsveraPDF-parser · org.verapdf:parser
- CVE-2026-54082veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFsveraPDF-validation · org.verapdf:validation-model +1
- CVE-2026-54663swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`acacode swagger-typescript-api · swagger-typescript-api
- CVE-2026-66724Permission Bypass Via Undocumented HTTP Methods In MWDB CoreCERT.PL MWDB Core
- CVE-2026-66489Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2balbooa.com Gridbox extension for Joomla
- CVE-2026-66488Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2balbooa.com Gridbox extension for Joomla
- CVE-2026-66490Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2balbooa.com Gridbox extension for Joomla
- CVE-2026-18174@fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For@fastify/forwarded
- CVE-2026-67217cJSON JSON Patch Non-Atomic Application Destroys Data Before ValidationDaveGamble cJSON
- CVE-2026-66400Grav Login Plugin before 3.8.13 Insufficient Session Expirationgetgrav grav
- CVE-2026-16751Ente Museum Server Authorization Bypass VulnerabilityEnte Museum Server
- CVE-2026-44943remote limited file-write as root via discovery in open-iscsiopen-iscsi
- CVE-2026-33385Blind SQL Injection in Quick.CMSOpenSolution Quick.CMS
- CVE-2026-65946Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.0rolandd.com RO CSVI extension for Joomla
- CVE-2026-65891Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.9.99.10joomlacontenteditor.net Joomla Content Editor (JCE) extensi…
- CVE-2026-50642Terminal Escape Injection in diff‑so‑fancydiff-so-fancy
- CVE-2026-56390Arbitrary Output Location Change in GNU BisonGNU Bison
- CVE-2026-56389Arbitrary Command Execution in GNU BisonGNU Bison
- CVE-2026-8791Booking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scriptingameliabooking Booking System Trafft
- CVE-2026-6089WP CTA <= 2.1.2 - Authenticated (Administrator+) Server-Side Request Forgeryblendmedia WP CTA – Call Now Button, Sticky Button & Call t…
- CVE-2026-5060MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletionstylemix MasterStudy LMS WordPress Plugin – for Online Cour…
- CVE-2026-7436WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attributewpclever WPC Badge Management for WooCommerce
- CVE-2026-4604Klubraum Membership Request <= 1.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings UpdateKlubraum Membership Request
- CVE-2026-65100Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encodeApache Software Foundation Apache Traffic Server
- CVE-2026-58187Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of serviceApache Software Foundation Apache Traffic Server
- CVE-2026-58185Apache Traffic Server: Use-after-free in the intercept pluginApache Software Foundation Apache Traffic Server
- CVE-2026-58183Apache Traffic Server: prefetch plugin can crash on attacker-influenced inputApache Software Foundation Apache Traffic Server
- CVE-2026-18201Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizationsRed Hat build of Keycloak · Red Hat Data Grid +2
- CVE-2026-18207Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matchingRed Hat Build of Keycloak · Red Hat Data Grid +2
- CVE-2026-58160Apache Traffic Server: Out-of-bounds reads while parsing DNS responsesApache Software Foundation Apache Traffic Server
- CVE-2026-58158Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflowApache Software Foundation Apache Traffic Server
- CVE-2026-58156Apache Traffic Server: URL and port parsing errors allow access-control bypassApache Software Foundation Apache Traffic Server
- CVE-2026-65325Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verificationApache Software Foundation Apache Traffic Server
- CVE-2026-58152Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memoryApache Software Foundation Apache Traffic Server
- CVE-2026-11973WP-Lister Lite for eBay <= 3.8.8 - Authenticated (Shop Manager+) SQL Injection via 'orderby' Parameterwp-lab WP-Lister Lite for eBay
- CVE-2026-9720Facturación Electrónica Costa Rica <= 2.0.2 - Cross-Site Request Forgery to Plugin Settings Updatefacturadorvirtual Facturación Electrónica Costa Rica
- CVE-2026-33930Apache Traffic Server: Buffer overflow via Host field that has a long string valueApache Software Foundation Apache Traffic Server
- CVE-2026-18197Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allows Cross-Site ScriptiLink Library
- CVE-2026-63242Business logic vulnerabilityThree Learning Koollab LMS
- CVE-2026-63241Insecure direct object reference vulnerabilityThree Learning Koollab LMS
- CVE-2026-63240Information disclosure vulnerabilityThree Learning Koollab LMS
- CVE-2026-63239Hard-coded AWS IAM credentials vulnerabilityThree Learning Koollab LMS
- CVE-2026-63238Authentication bypass vulnerabilityThree Learning Koollab LMS
- CVE-2026-63237TOTP two-factor authentication bypass vulnerabilityThree Learning Koollab LMS
- CVE-2026-63236Improper access control vulnerabilityThree Learning Koollab LMS
- CVE-2026-63235Improper access control vulnerabilityThree Learning Koollab LMS
- CVE-2026-63228Unrestricted image upload vulnerabilityThree Learning Koollab LMS
- CVE-2026-14224Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOREasy Appointments
- CVE-2026-13692PayU CommercePro < 3.9.0 - Unauthenticated Order TamperingPayU CommercePro Plugin
- CVE-2026-13605Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title AttributePhotoSwipe
- CVE-2026-11351ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information DisclosureShinyStat Analytics
- CVE-2026-5626Survey Form Block <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Exportbplugins Survey Form Block – collect answers and insights f…
- CVE-2026-15344WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameteropajaap WP Photo Album Plus
- CVE-2026-17161WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filterMobileText' Block Attributewpxpo WowStore – Store Builder & Product Blocks for WooComm…
- CVE-2026-17162WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'currentPostId' Block Attributewpxpo WowStore – Store Builder & Product Blocks for WooComm…
- CVE-2026-17166Event Booking Manager for WooCommerce <= 5.3.7 - Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification via mep_save_payment_settings_modal AJAX Actionmagepeopleteam Event Booking Manager for WooCommerce – Sell…
- CVE-2026-12939Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attributecontrid Newsletters
- CVE-2026-12938Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attributecontrid Newsletters
- CVE-2026-15735Contact Form to Any API <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Metaitpathsolutions Contact Form to Any API
- CVE-2025-65337Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting (XSS) in pageEditMember.php via the address field.