# CVEs published 2026-07-29

274 CVEs were published on July 29, 2026: 48 critical, 114 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-62343](https://cve.now/CVE-2026-62343.md): ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided (CVSS 4.7, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-64685](https://cve.now/CVE-2026-64685.md): ImageMagick: Heap Buffer Over-Read in BGR decoder due to mising end-of-file check (CVSS 5.3, ImageMagick)
- [CVE-2026-67595](https://cve.now/CVE-2026-67595.md): VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php (CVSS 9.2, webreinvent vaahcms)
- [CVE-2026-15157](https://cve.now/CVE-2026-15157.md): undici vulnerable to CRLF Injection via blob-like body 'type' property (CVSS 4.2, undici)
- [CVE-2026-14643](https://cve.now/CVE-2026-14643.md): undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives (CVSS 5.9, undici)
- [CVE-2026-16728](https://cve.now/CVE-2026-16728.md): undici vulnerable to downstream response desynchronization via retry interceptor (CVSS 4.8, undici)
- [CVE-2026-67439](https://cve.now/CVE-2026-67439.md): OliveTin: StartActionAndWait Endpoints Bypass \`logs\` Permission and Return Action Output (CVSS 4.3, OliveTin · github.com/OliveTin/OliveTin)
- [CVE-2026-67438](https://cve.now/CVE-2026-67438.md): OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check (CVSS 6.6, OliveTin · github.com/OliveTin/OliveTin)
- [CVE-2026-67437](https://cve.now/CVE-2026-67437.md): OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth) (CVSS 7.5, OliveTin · github.com/OliveTin/OliveTin)
- [CVE-2026-54249](https://cve.now/CVE-2026-54249.md): VercelAIAdapter trusts client-controlled \`providerMetadata\` to construct \`UploadedFile\` — S3/GCS confused deputy via provider metadata injection (CVSS 6.8, pydantic-ai · pydantic-ai-slim)
- [CVE-2026-46678](https://cve.now/CVE-2026-46678.md): Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580) (CVSS 6.8, pydantic-ai · pydantic-ai-slim)
- [CVE-2026-13308](https://cve.now/CVE-2026-13308.md): Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability (CVSS 8.1, Autel MaxiCharger AC Elite Home)
- [CVE-2026-13307](https://cve.now/CVE-2026-13307.md): Autel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability (CVSS 6.8, Autel MaxiCharger AC Elite Home)
- [CVE-2026-13309](https://cve.now/CVE-2026-13309.md): Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability (CVSS 6.8, Autel MaxiCharger AC Elite Home)
- [CVE-2026-13306](https://cve.now/CVE-2026-13306.md): Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability (CVSS 4.3, Autel MaxiCharger AC Elite Home)
- [CVE-2026-13305](https://cve.now/CVE-2026-13305.md): Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability (CVSS 6.4, Autel MaxiCharger AC Elite Home)
- [CVE-2026-65975](https://cve.now/CVE-2026-65975.md): Pydantic AI AG-UI Adapter: A dangling client-submitted tool call can execute when a trailing message is dropped during \`sanitize\_messages\` (CVSS 6.5, pydantic-ai · pydantic-ai-slim)
- [CVE-2026-67436](https://cve.now/CVE-2026-67436.md): Linuxfabrik monitoring-plugins: SSRF and auth-token disclosure via unvalidated @odata.id link in redfish-\* plugins (CVSS 8.3, Linuxfabrik monitoring-plugins)
- [CVE-2026-67435](https://cve.now/CVE-2026-67435.md): linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect (CVSS 6.0, Linuxfabrik monitoring-plugins · linuxfabrik-lib)
- [CVE-2026-67433](https://cve.now/CVE-2026-67433.md): Linuxfabrik monitoring-plugins: Symlink following in logfile legacy database migration (CVSS 5.8, Linuxfabrik monitoring-plugins)
- [CVE-2026-67432](https://cve.now/CVE-2026-67432.md): MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport (CVSS 7.5, modelcontextprotocol ruby-sdk · mcp)
- [CVE-2026-67431](https://cve.now/CVE-2026-67431.md): MCP Ruby SDK: Ruby SSE Session Poisoning (CVSS 8.3, modelcontextprotocol ruby-sdk · mcp)
- [CVE-2026-63119](https://cve.now/CVE-2026-63119.md): MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS) (CVSS 6.2, modelcontextprotocol ruby-sdk · mcp)
- [CVE-2026-5057](https://cve.now/CVE-2026-5057.md): ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability (CVSS 7.5, ATEN Unizon)
- [CVE-2026-67430](https://cve.now/CVE-2026-67430.md): MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood (CVSS 5.3, modelcontextprotocol ruby-sdk · mcp)
- [CVE-2026-5056](https://cve.now/CVE-2026-5056.md): GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, GStreamer)
- [CVE-2026-5492](https://cve.now/CVE-2026-5492.md): DriveLock Directory Traversal Information Disclosure Vulnerability (CVSS 6.5, DriveLock)
- [CVE-2026-5491](https://cve.now/CVE-2026-5491.md): DriveLock Directory Traversal Information Disclosure Vulnerability (CVSS 7.5, DriveLock)
- [CVE-2026-5490](https://cve.now/CVE-2026-5490.md): DriveLock SQL Injection Privilege Escalation Vulnerability (CVSS 8.8, DriveLock)
- [CVE-2026-5489](https://cve.now/CVE-2026-5489.md): DriveLock Directory Traversal Information Disclosure Vulnerability (CVSS 5.3, DriveLock)
- [CVE-2026-5487](https://cve.now/CVE-2026-5487.md): DriveLock Directory Traversal Information Disclosure Vulnerability (CVSS 7.5, DriveLock)
- [CVE-2026-6102](https://cve.now/CVE-2026-6102.md): MSI Center NTIOLib\_X64 Origin Validation Error Local Privilege Escalation Vulnerability (CVSS 7.8, MSI Center)
- [CVE-2026-13268](https://cve.now/CVE-2026-13268.md): G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability (CVSS 7.8, G DATA Total Security)
- [CVE-2026-63118](https://cve.now/CVE-2026-63118.md): MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection (CVSS 6.9, modelcontextprotocol ruby-sdk · mcp)
- [CVE-2026-18266](https://cve.now/CVE-2026-18266.md): Dify AI Workflow oauth\_redirect\_url Open Redirect Vulnerability (CVSS 5.4, LangGenius Dify)
- [CVE-2026-12357](https://cve.now/CVE-2026-12357.md): Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability (CVSS 7.2, Heimdall Data Database Proxy)
- [CVE-2025-14562](https://cve.now/CVE-2025-14562.md): Incorrect Authorization in GitLab (CVSS 3.1, GitLab)
- [CVE-2026-3093](https://cve.now/CVE-2026-3093.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 4.7, GitLab)
- [CVE-2026-4672](https://cve.now/CVE-2026-4672.md): Missing Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-6267](https://cve.now/CVE-2026-6267.md): Insertion of Sensitive Information Into Sent Data in GitLab (CVSS 8.5, GitLab)
- [CVE-2026-6336](https://cve.now/CVE-2026-6336.md): Incorrect Authorization in GitLab (CVSS 5.3, GitLab)
- [CVE-2026-12436](https://cve.now/CVE-2026-12436.md): Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab (CVSS 8.4, GitLab)
- [CVE-2026-13113](https://cve.now/CVE-2026-13113.md): Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab (CVSS 6.5, GitLab)
- [CVE-2026-14341](https://cve.now/CVE-2026-14341.md): Missing Authorization in GitLab (CVSS 4.9, GitLab)
- [CVE-2026-14351](https://cve.now/CVE-2026-14351.md): Exposure of Sensitive Information Through Metadata in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-15077](https://cve.now/CVE-2026-15077.md): Improper Neutralization of Input Used for LLM Prompting in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-15831](https://cve.now/CVE-2026-15831.md): Generation of Incorrect Security Tokens in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-15975](https://cve.now/CVE-2026-15975.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 7.5, GitLab)
- [CVE-2026-16553](https://cve.now/CVE-2026-16553.md): Insufficiently Protected Credentials in GitLab (CVSS 5.4, GitLab)
- [CVE-2026-18022](https://cve.now/CVE-2026-18022.md): pgvector buffer overflow via integer wraparound in IVFFlat index build on 32-bit systems (CVSS 8.8, pgvector)
- [CVE-2026-67429](https://cve.now/CVE-2026-67429.md): Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules) (CVSS 10.0, flytohub flyto-core · flyto-core)
- [CVE-2026-67428](https://cve.now/CVE-2026-67428.md): Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata) (CVSS 8.5, flytohub flyto-core · flyto-core)
- [CVE-2026-67427](https://cve.now/CVE-2026-67427.md): Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted (CVSS 8.6, flytohub flyto-core · flyto-core)
- [CVE-2026-67426](https://cve.now/CVE-2026-67426.md): Flyto2 Core: Unauthenticated flyto-verification /run: callback\_url SSRF and internal runner-secret exfiltration (CVSS 9.3, flytohub flyto-core · flyto-core)
- [CVE-2026-16326](https://cve.now/CVE-2026-16326.md): consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode (CVSS 10.0, HashiCorp Tooling)
- [CVE-2026-67425](https://cve.now/CVE-2026-67425.md): Flyto2 Core: LLM/API keys leak to an attacker-controlled base\_url (CVSS 8.6, flytohub flyto-core · flyto-core)
- [CVE-2026-13346](https://cve.now/CVE-2026-13346.md): pip absolute path traversal during download from malicious package indexes (CVSS 5.6, Python Packaging Authority pip · pip)
- [CVE-2026-16328](https://cve.now/CVE-2026-16328.md): consul-mcp-server vulnerable to server side request forgery leading to token exposure (CVSS 8.6, HashiCorp Tooling)
- [CVE-2026-67424](https://cve.now/CVE-2026-67424.md): Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation (CVSS 8.5, flytohub flyto-core · flyto-core)
- [CVE-2026-62995](https://cve.now/CVE-2026-62995.md): joserfc accepts JWT with padding, leading to JWT malleability (CVSS 2.3, authlib joserfc)
- [CVE-2026-12935](https://cve.now/CVE-2026-12935.md): Unauthenticated Remote Code Execution in TP-Link TL-WR940N RTSP Conntrack Feature (CVSS 8.7, TP-Link Systems TL-WR940N)
- [CVE-2026-2482](https://cve.now/CVE-2026-2482.md): IBM WebSphere Application Server Liberty is affected by a cross-site request forgery (CVSS 3.1, IBM WebSphere Application Server - Liberty)
- [CVE-2026-14529](https://cve.now/CVE-2026-14529.md): IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery (CVSS 9.4, IBM WebSphere Application Server)
- [CVE-2026-67201](https://cve.now/CVE-2026-67201.md): V 0.5.2 SSRF Bypass via Parser Differential in net.urllib and net.http (CVSS 7.7, vlang v)
- [CVE-2026-10684](https://cve.now/CVE-2026-10684.md): Out-of-bounds read in coredump shell when printing stored-dump target code (CVSS 3.0, zephyrproject zephyr)
- [CVE-2026-59898](https://cve.now/CVE-2026-59898.md): Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation (CVSS 6.3, netty · io.netty:netty-codec-http)
- [CVE-2026-59899](https://cve.now/CVE-2026-59899.md): Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service (CVSS 6.9, netty · io.netty:netty-codec-http)
- [CVE-2026-59900](https://cve.now/CVE-2026-59900.md): Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass (CVSS 6.9, netty · io.netty:netty-codec-http2)
- [CVE-2026-40272](https://cve.now/CVE-2026-40272.md): Vulnerability in the QNX libtraceparser Impacts QNX Software Development Platform (CVSS 7.0, BlackBerry QNX Software Development Platform)
- [CVE-2026-59901](https://cve.now/CVE-2026-59901.md): Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang (CVSS 8.7, netty · io.netty:netty-codec-compression +1)
- [CVE-2026-41939](https://cve.now/CVE-2026-41939.md): Care Everywhere Gateway 14.3.10 Hard-coded Credentials RCE via WildFly (CVSS 9.3, Care Everywhere Gateway)
- [CVE-2026-59919](https://cve.now/CVE-2026-59919.md): Netty: HAProxy V1 Protocol CRLF Injection via AF\_UNIX Address (CVSS 5.5, netty · io.netty:netty-codec-haproxy)
- [CVE-2026-18236](https://cve.now/CVE-2026-18236.md): Google-ADK Continuation Forgery (CVSS 9.3, Google-ADK)
- [CVE-2026-59920](https://cve.now/CVE-2026-59920.md): Netty: STOMP CONNECT Frame Header Injection (CVSS 6.5, netty · io.netty:netty-codec-stomp)
- [CVE-2026-13723](https://cve.now/CVE-2026-13723.md): Develar's electron-builder allows arbitrary file overwrite (CVSS 6.5, Develar app-builder)
- [CVE-2026-8497](https://cve.now/CVE-2026-8497.md): Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Andr (CVSS 7.4, Devolutions Password Manager)
- [CVE-2026-54705](https://cve.now/CVE-2026-54705.md): mathlive's Lack of Escaping of HTML allows for XSS (CVSS 6.3, arnog mathlive · mathlive)
- [CVE-2026-14266](https://cve.now/CVE-2026-14266.md): 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.0, 7-Zip)
- [CVE-2026-54680](https://cve.now/CVE-2026-54680.md): Logging operator has Fluentd configuration injection that allows remote code execution (CVSS 9.9, kube-logging logging-operator · github.com/kube-logging/log…)
- [CVE-2026-54693](https://cve.now/CVE-2026-54693.md): ZITADEL Users Can Self-Verify Email/Phone via API (CVSS 8.2, zitadel · github.com/zitadel/zitadel)
- [CVE-2026-64560](https://cve.now/CVE-2026-64560.md): posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVSS 7.8, Linux)
- [CVE-2026-16729](https://cve.now/CVE-2026-16729.md): undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields (CVSS 4.8, undici)
- [CVE-2026-54727](https://cve.now/CVE-2026-54727.md): proot-distro has a Container Isolation Bypass via Crafted Restore Archive (CVSS 8.2, termux proot-distro · proot-distro)
- [CVE-2026-67194](https://cve.now/CVE-2026-67194.md): Courier IMAP \< 6.0.1 Mail Server \< 2.0.2 Stack Overflow DoS via Nested SEARCH Queries (CVSS 7.1, svarshavchik Courier IMAP · svarshavchik Courier Mail Server)
- [CVE-2026-8338](https://cve.now/CVE-2026-8338.md): Authentication and Authorization Bypass in Coverity Connect (CVSS 9.2, Black Duck Coverity Connect)
- [CVE-2026-18255](https://cve.now/CVE-2026-18255.md): Quay: quay: global read-only superuser can view robot account tokens (CVSS 7.2, Red Hat Quay)
- [CVE-2026-18257](https://cve.now/CVE-2026-18257.md): Improper Certificate Validation in S2OPC (CVSS 5.6, Systerel S2OPC)
- [CVE-2026-13697](https://cve.now/CVE-2026-13697.md): undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives (CVSS 7.4, undici)
- [CVE-2026-54574](https://cve.now/CVE-2026-54574.md): \`proot-distro install\` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive (CVSS 8.2, termux proot-distro · proot-distro)
- [CVE-2026-8339](https://cve.now/CVE-2026-8339.md): SQL Injection in Coverity Connect SOAP API (CVSS 8.7, Black Duck Coverity Connect)
- [CVE-2026-64559](https://cve.now/CVE-2026-64559.md): s390/pkey: Check length in PKEY\_VERIFYPROTK ioctl (CVSS 7.8, Linux)
- [CVE-2026-64558](https://cve.now/CVE-2026-64558.md): s390/pkey: Check length in pkey\_pckmo handler implementation (CVSS 7.8, Linux)
- [CVE-2026-20316](https://cve.now/CVE-2026-20316.md): Cisco Secure Firewall Management Center Software Static Credential Vulnerability (CVSS 5.3, KEV, Cisco Secure Firewall Management Center)
- [CVE-2026-52791](https://cve.now/CVE-2026-52791.md): fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O\_TRUNC) (CVSS 2.0, containers fuse-overlayfs)
- [CVE-2026-15144](https://cve.now/CVE-2026-15144.md): @fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation (CVSS 7.3, @fastify/rate-limit)
- [CVE-2026-54735](https://cve.now/CVE-2026-54735.md): prebid-server's request forgery vulnerability allows for possible host environment data extraction (CVSS 10.0, prebid-server · github.com/prebid/prebid-server/v4 +3)
- [CVE-2026-67193](https://cve.now/CVE-2026-67193.md): Xlight FTP Server \< 3.9.5 Information Disclosure via USER Command (CVSS 6.9, Xlight FTP Server)
- [CVE-2026-67192](https://cve.now/CVE-2026-67192.md): Xlight FTP Server \< 3.9.5 Pre-Auth Stack Buffer Overflow via SSH GCM Cipher (CVSS 9.2, Xlight FTP Server)
- [CVE-2026-67191](https://cve.now/CVE-2026-67191.md): Xlight FTP Server \< 3.9.5 Pre-Auth Heap Buffer Overflow via SSH Parser (CVSS 9.3, Xlight FTP Server)
- [CVE-2026-60113](https://cve.now/CVE-2026-60113.md): AIT-DSN \< 2.2.2 Missing Authentication via SLE API Routes (CVSS 9.3, NASA-AMMOS AIT-DSN)
- [CVE-2026-60112](https://cve.now/CVE-2026-60112.md): AIT-GUI \< 2.5.1 Missing Authentication via Sessions.create() (CVSS 9.3, NASA-AMMOS AIT-GUI)
- [CVE-2026-50558](https://cve.now/CVE-2026-50558.md): Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive (CVSS 5.9, brightio penelope · penelope-shell-handler)
- [CVE-2026-16543](https://cve.now/CVE-2026-16543.md): Kong Operator cluster-wide ingress configuration DoS via embedded KIC CA-certificate ID collision (CVSS 7.1, Kong/kong-operator)
- [CVE-2026-15228](https://cve.now/CVE-2026-15228.md): Kong Kubernetes Ingress Controller cluster-wide ingress configuration DoS via CA-certificate ID collision (CVSS 7.1, Kong/kubernetes-ingress-controller)
- [CVE-2026-17550](https://cve.now/CVE-2026-17550.md): DWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCAD (CVSS 5.5, Autodesk AutoCAD · Autodesk DWG TrueView)
- [CVE-2026-16465](https://cve.now/CVE-2026-16465.md): DWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCAD (CVSS 6.1, Autodesk AutoCAD · Autodesk DWG TrueView)
- [CVE-2026-16463](https://cve.now/CVE-2026-16463.md): DXF File Parsing Heap-Based Overflow in Autodesk AutoCAD (CVSS 7.8, Autodesk AutoCAD · Autodesk DWG TrueView)
- [CVE-2026-54081](https://cve.now/CVE-2026-54081.md): veraPDF Parser DoS via PostScript Type 1 Font Programs (CVSS 6.9, veraPDF-parser · org.verapdf:parser)
- [CVE-2026-54080](https://cve.now/CVE-2026-54080.md): veraPDF Parser DoS via PostScript CMap Streams (CVSS 6.9, veraPDF-parser · org.verapdf:parser)
- [CVE-2026-54082](https://cve.now/CVE-2026-54082.md): veraPDF-validatio: Use of Default \`DocumentBuilderFactory\` leads to XXE When Processing Untrusted PDFs (CVSS 6.5, veraPDF-validation · org.verapdf:validation-model +1)
- [CVE-2026-54078](https://cve.now/CVE-2026-54078.md): veraPDF Validation XXE via Rich Text (CVSS 8.7, veraPDF-validation · org.verapdf:validation-model +1)
- [CVE-2026-54079](https://cve.now/CVE-2026-54079.md): veraPDF Validation XXE via XFA (CVSS 8.7, veraPDF-validation · org.verapdf:validation-model +1)
- [CVE-2026-54666](https://cve.now/CVE-2026-54666.md): swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies (CVSS 8.3, acacode swagger-typescript-api · swagger-typescript-api)
- [CVE-2026-54664](https://cve.now/CVE-2026-54664.md): swagger-typescript-api vulnerable to code injection via unescaped enum string values (CVSS 8.3, acacode swagger-typescript-api · swagger-typescript-api)
- [CVE-2026-54661](https://cve.now/CVE-2026-54661.md): swagger-typescript-api vulnerable to code injection via unescaped \`servers\[0\].url\` in axios http-client template (CVSS 8.3, acacode swagger-typescript-api · swagger-typescript-api)
- [CVE-2026-54663](https://cve.now/CVE-2026-54663.md): swagger-typescript-api vulnerable to Server-Side Request Forgery via spec \`$ref\` (CVSS 6.1, acacode swagger-typescript-api · swagger-typescript-api)
- [CVE-2026-54662](https://cve.now/CVE-2026-54662.md): swagger-typescript-api vulnerable to code injection via unescaped \`servers\[0\].url\` in fetch http-client template (CVSS 8.3, acacode swagger-typescript-api · swagger-typescript-api)
- [CVE-2026-59247](https://cve.now/CVE-2026-59247.md): Insufficient verification of Hex package metadata in Gleam (CVSS 7.6, gleam-lang gleam)
- [CVE-2026-54660](https://cve.now/CVE-2026-54660.md): swagger-typescript-api vulnerable to authorization-token exfiltration via spec \`$ref\` (CVSS 7.4, acacode swagger-typescript-api · swagger-typescript-api)
- [CVE-2026-12703](https://cve.now/CVE-2026-12703.md): Bypass of 2FA for Connections via Unattended Access in TeamViewer for macOS (CVSS 8.0, TeamViewer Remote · TeamViewer Tensor +1)
- [CVE-2026-66723](https://cve.now/CVE-2026-66723.md): Missing authentication requirement in Remote Instances proxy API in MWDB Core (CVSS 7.0, CERT.PL MWDB Core)
- [CVE-2026-66724](https://cve.now/CVE-2026-66724.md): Permission Bypass Via Undocumented HTTP Methods In MWDB Core (CVSS 5.3, CERT.PL MWDB Core)
- [CVE-2026-65947](https://cve.now/CVE-2026-65947.md): Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox \< 2.20.2 (CVSS 7.3, balbooa.com Gridbox extension for Joomla)
- [CVE-2026-65888](https://cve.now/CVE-2026-65888.md): Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox \< 2.20.2 (CVSS 10.0, balbooa.com Gridbox extension for Joomla)
- [CVE-2026-65887](https://cve.now/CVE-2026-65887.md): Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox \< 2.20.2 (CVSS 10.0, balbooa.com Gridbox extension for Joomla)
- [CVE-2026-65886](https://cve.now/CVE-2026-65886.md): Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox \< 2.20.2 (CVSS 9.2, balbooa.com Gridbox extension for Joomla)
- [CVE-2026-65890](https://cve.now/CVE-2026-65890.md): Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox \< 2.20.2 (CVSS 9.2, balbooa.com Gridbox extension for Joomla)
- [CVE-2026-66489](https://cve.now/CVE-2026-66489.md): Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox \< 2.20.2 (CVSS 5.3, balbooa.com Gridbox extension for Joomla)
- [CVE-2026-66488](https://cve.now/CVE-2026-66488.md): Joomla Extension - balbooa.com - Payment bypass in Gridbox \< 2.20.2 (CVSS 5.3, balbooa.com Gridbox extension for Joomla)
- [CVE-2026-65889](https://cve.now/CVE-2026-65889.md): Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox \< 2.20.2 (CVSS 9.2, balbooa.com Gridbox extension for Joomla)
- [CVE-2026-66490](https://cve.now/CVE-2026-66490.md): Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox \< 2.20.2 (CVSS 6.1, balbooa.com Gridbox extension for Joomla)
- [CVE-2026-18174](https://cve.now/CVE-2026-18174.md): @fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For (CVSS 5.3, @fastify/forwarded)
- [CVE-2026-9177](https://cve.now/CVE-2026-9177.md): Server-Side Template Injection in SecureTransport's Apache Velocity mail templates (CVSS 9.4, Axway SecureTransport)
- [CVE-2026-55995](https://cve.now/CVE-2026-55995.md): Double-free in the iSNS attribute decoder in open-iscsi (CVSS 8.7, open-iscsi)
- [CVE-2026-67217](https://cve.now/CVE-2026-67217.md): cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation (CVSS 6.9, DaveGamble cJSON)
- [CVE-2026-67216](https://cve.now/CVE-2026-67216.md): cJSON cJSON\_Compare Exponential Complexity Denial of Service (CVSS 8.2, DaveGamble cJSON)
- [CVE-2026-67215](https://cve.now/CVE-2026-67215.md): cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion (CVSS 8.7, DaveGamble cJSON)
- [CVE-2026-67214](https://cve.now/CVE-2026-67214.md): nanoid Infinite Loop via Negative Size in non-secure module (CVSS 8.2, nanoid\_project nanoid · nanoid)
- [CVE-2026-67213](https://cve.now/CVE-2026-67213.md): nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom (CVSS 8.2, nanoid\_project nanoid · nanoid)
- [CVE-2026-66400](https://cve.now/CVE-2026-66400.md): Grav Login Plugin before 3.8.13 Insufficient Session Expiration (CVSS 6.3, getgrav grav)
- [CVE-2026-16751](https://cve.now/CVE-2026-16751.md): Ente Museum Server Authorization Bypass Vulnerability (CVSS 6.5, Ente Museum Server)
- [CVE-2026-44944](https://cve.now/CVE-2026-44944.md): iscsiuio control-socket authentication bypass in open-iscsi (CVSS 8.5, open-iscsi)
- [CVE-2026-44943](https://cve.now/CVE-2026-44943.md): remote limited file-write as root via discovery in open-iscsi (CVSS 6.9, open-iscsi)
- [CVE-2026-33385](https://cve.now/CVE-2026-33385.md): Blind SQL Injection in Quick.CMS (CVSS 5.1, OpenSolution Quick.CMS)
- [CVE-2026-65944](https://cve.now/CVE-2026-65944.md): Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI \< 9.11.0 (CVSS 8.8, rolandd.com RO CSVI extension for Joomla)
- [CVE-2026-65943](https://cve.now/CVE-2026-65943.md): Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI \< 9.11.0 (CVSS 7.5, rolandd.com RO CSVI extension for Joomla)
- [CVE-2026-65946](https://cve.now/CVE-2026-65946.md): Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI \< 9.11.0 (CVSS 6.1, rolandd.com RO CSVI extension for Joomla)
- [CVE-2026-50641](https://cve.now/CVE-2026-50641.md): Plaintext password storage in Streamsoft Business Intelligence (CVSS 7.1, Streamsoft Business Intelligence)
- [CVE-2026-65891](https://cve.now/CVE-2026-65891.md): Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) \< 2.9.99.10 (CVSS 6.5, joomlacontenteditor.net Joomla Content Editor (JCE) extensi…)
- [CVE-2026-12927](https://cve.now/CVE-2026-12927.md): CWE-787 Out-of-bounds write vulnerability exists that could cause loss of data or potentially risk arbitrary code execution when a malicious (CVSS 8.4, Schneider Electric IGSS Definition)
- [CVE-2026-0667](https://cve.now/CVE-2026-0667.md): CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and (CVSS 9.3, Schneider Electric SCADAPack · Schneider Electric RemoteCon…)
- [CVE-2026-65884](https://cve.now/CVE-2026-65884.md): Joomla Extension - balbooa.com - Privilege Escalation in Gridbox \< 2.20.2 (CVSS 10.0, balbooa.com Gridbox extension for Joomla)
- [CVE-2026-65885](https://cve.now/CVE-2026-65885.md): Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox \< 2.20.2 (CVSS 9.4, balbooa.com Gridbox extension for Joomla)
- [CVE-2026-14354](https://cve.now/CVE-2026-14354.md): CWE-522 Insufficiently Protected Credentials vulnerability exists that could cause authentication bypass and unauthorized credential modific (CVSS 8.7, Schneider Electric EcoStruxure™ Cybersecurity Admin Expert)
- [CVE-2026-14270](https://cve.now/CVE-2026-14270.md): Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) \<= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco\_save\_settings (CVSS 8.8, ThemeComplete Extra Checkout Options - addon for Extra Prod…)
- [CVE-2026-12895](https://cve.now/CVE-2026-12895.md): SQL Injection in Frappe's ERPNext (CVSS 7.1, Frappe ERPNext)
- [CVE-2026-18220](https://cve.now/CVE-2026-18220.md): Binutils: binutils: out-of-bounds write in bfd dlx elf backend relocation processing (CVSS 7.8, Red Hat Enterprise Linux · Red Hat Hardened Images +1)
- [CVE-2026-50642](https://cve.now/CVE-2026-50642.md): Terminal Escape Injection in diff‑so‑fancy (CVSS 4.8, diff-so-fancy)
- [CVE-2026-56390](https://cve.now/CVE-2026-56390.md): Arbitrary Output Location Change in GNU Bison (CVSS 4.6, GNU Bison)
- [CVE-2026-56389](https://cve.now/CVE-2026-56389.md): Arbitrary Command Execution in GNU Bison (CVSS 6.8, GNU Bison)
- [CVE-2026-65883](https://cve.now/CVE-2026-65883.md): Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 (CVSS 10.0, aimy-extensions.com Aimy Captcha-Less Form Guard plugin for…)
- [CVE-2026-14488](https://cve.now/CVE-2026-14488.md): Meta Box AIO \<= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb\_frontend\_field\_object\_id' Parameter (CVSS 9.1, Meta Box AIO)
- [CVE-2026-8791](https://cve.now/CVE-2026-8791.md): Booking System Trafft \<= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, ameliabooking Booking System Trafft)
- [CVE-2026-6089](https://cve.now/CVE-2026-6089.md): WP CTA \<= 2.1.2 - Authenticated (Administrator+) Server-Side Request Forgery (CVSS 4.9, blendmedia WP CTA – Call Now Button, Sticky Button & Call t…)
- [CVE-2026-5060](https://cve.now/CVE-2026-5060.md): MasterStudy LMS WordPress Plugin – for Online Courses and Education \<= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion (CVSS 6.5, stylemix MasterStudy LMS WordPress Plugin – for Online Cour…)
- [CVE-2026-16655](https://cve.now/CVE-2026-16655.md): Fluent Forms \<= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested \`password\` Member (CVSS 7.2, wpmanageninja Fluent Forms – Customizable Contact Forms, Su…)
- [CVE-2026-7436](https://cve.now/CVE-2026-7436.md): WPC Badge Management for WooCommerce \<= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute (CVSS 6.4, wpclever WPC Badge Management for WooCommerce)
- [CVE-2026-14900](https://cve.now/CVE-2026-14900.md): Cost Calculator Builder PRO \<= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter (CVSS 9.8, StylemixThemes Cost Calculator Builder PRO)
- [CVE-2026-4604](https://cve.now/CVE-2026-4604.md): Klubraum Membership Request \<= 1.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update (CVSS 5.3, Klubraum Membership Request)
- [CVE-2026-16597](https://cve.now/CVE-2026-16597.md): GTM4WP \<= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields (CVSS 7.2, duracelltomi GTM4WP – A Google Tag Manager (GTM) plugin for…)
- [CVE-2026-50622](https://cve.now/CVE-2026-50622.md): Apache Atlas: Missing Authorization on Admin Endpoints (CVSS 8.8, Apache Software Foundation Apache Atlas)
- [CVE-2026-23904](https://cve.now/CVE-2026-23904.md): Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy (CVSS 7.3, Apache Software Foundation Apache Kyuubi)
- [CVE-2026-65100](https://cve.now/CVE-2026-65100.md): Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode (CVSS 4.8, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58189](https://cve.now/CVE-2026-58189.md): Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58188](https://cve.now/CVE-2026-58188.md): Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins (CVSS 8.2, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58187](https://cve.now/CVE-2026-58187.md): Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service (CVSS 3.7, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58186](https://cve.now/CVE-2026-58186.md): Apache Traffic Server: webp\_transform plugin decodes unsafely and mislabels degraded responses (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58185](https://cve.now/CVE-2026-58185.md): Apache Traffic Server: Use-after-free in the intercept plugin (CVSS 5.9, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58184](https://cve.now/CVE-2026-58184.md): Apache Traffic Server: header\_rewrite plugin cookie handling can corrupt memory (CVSS 8.2, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58183](https://cve.now/CVE-2026-58183.md): Apache Traffic Server: prefetch plugin can crash on attacker-influenced input (CVSS 5.9, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58182](https://cve.now/CVE-2026-58182.md): Apache Traffic Server: ts\_lua plugin has initialization and resource-handling errors (CVSS 8.6, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58181](https://cve.now/CVE-2026-58181.md): Apache Traffic Server: uri\_signing and url\_sig plugins can exhaust the stack or crash (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58180](https://cve.now/CVE-2026-58180.md): Apache Traffic Server: txn\_box plugin overflows the stack from attacker input (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58179](https://cve.now/CVE-2026-58179.md): Apache Traffic Server: regex\_remap plugin overflows the stack from attacker input (CVSS 8.1, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58178](https://cve.now/CVE-2026-58178.md): Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58177](https://cve.now/CVE-2026-58177.md): Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework (CVSS 8.1, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58175](https://cve.now/CVE-2026-58175.md): Apache Traffic Server: HostDB SRV handling leaks memory (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58164](https://cve.now/CVE-2026-58164.md): Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58163](https://cve.now/CVE-2026-58163.md): Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58162](https://cve.now/CVE-2026-58162.md): Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates (CVSS 10.0, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58161](https://cve.now/CVE-2026-58161.md): Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-59243](https://cve.now/CVE-2026-59243.md): Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (\`verify\_signature\` defaults to \`False\`) (CVSS 9.8, Apache Software Foundation Apache Airflow FAB provider)
- [CVE-2026-18201](https://cve.now/CVE-2026-18201.md): Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations (CVSS 5.5, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-18207](https://cve.now/CVE-2026-18207.md): Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching (CVSS 6.5, Red Hat Build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-58160](https://cve.now/CVE-2026-58160.md): Apache Traffic Server: Out-of-bounds reads while parsing DNS responses (CVSS 6.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2025-10656](https://cve.now/CVE-2025-10656.md): Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light \<= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account Creation (CVSS 9.8, holest Spreadsheet Price Changer for WooCommerce and WP E-c…)
- [CVE-2026-58159](https://cve.now/CVE-2026-58159.md): Apache Traffic Server: Listener and ACL handling allow access-control bypass (CVSS 8.2, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58158](https://cve.now/CVE-2026-58158.md): Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow (CVSS 5.9, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58157](https://cve.now/CVE-2026-58157.md): Apache Traffic Server: Improper server-session reuse can expose data across client connections (CVSS 8.7, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58156](https://cve.now/CVE-2026-58156.md): Apache Traffic Server: URL and port parsing errors allow access-control bypass (CVSS 4.9, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58155](https://cve.now/CVE-2026-58155.md): Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling (CVSS 9.3, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58154](https://cve.now/CVE-2026-58154.md): Apache Traffic Server: Memory-safety errors in MIME and header parsing (CVSS 8.9, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-65325](https://cve.now/CVE-2026-65325.md): Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification (CVSS 4.8, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-65324](https://cve.now/CVE-2026-65324.md): Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58153](https://cve.now/CVE-2026-58153.md): Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely (CVSS 8.3, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58152](https://cve.now/CVE-2026-58152.md): Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory (CVSS 5.9, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-58151](https://cve.now/CVE-2026-58151.md): Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-64557](https://cve.now/CVE-2026-64557.md): Bluetooth: L2CAP: Fix use-after-free in l2cap\_sock\_new\_connection\_cb() (CVSS 8.8, Linux)
- [CVE-2026-64556](https://cve.now/CVE-2026-64556.md): perf/core: Detach event groups during remove\_on\_exec (CVSS 7.8, Linux)
- [CVE-2026-11973](https://cve.now/CVE-2026-11973.md): WP-Lister Lite for eBay \<= 3.8.8 - Authenticated (Shop Manager+) SQL Injection via 'orderby' Parameter (CVSS 4.9, wp-lab WP-Lister Lite for eBay)
- [CVE-2026-9720](https://cve.now/CVE-2026-9720.md): Facturación Electrónica Costa Rica \<= 2.0.2 - Cross-Site Request Forgery to Plugin Settings Update (CVSS 4.3, facturadorvirtual Facturación Electrónica Costa Rica)
- [CVE-2026-13425](https://cve.now/CVE-2026-13425.md): Database for CF7 \<= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Values (CVSS 7.2, code4life Database for CF7)
- [CVE-2026-58150](https://cve.now/CVE-2026-58150.md): Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling (CVSS 10.0, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-57834](https://cve.now/CVE-2026-57834.md): Apache Traffic Server: Malformed chunked message body allows request smuggling (CVSS 10.0, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-33930](https://cve.now/CVE-2026-33930.md): Apache Traffic Server: Buffer overflow via Host field that has a long string value (CVSS 5.9, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-24033](https://cve.now/CVE-2026-24033.md): Apache Traffic Server: Request smuggling via chunked extension quoted-string parsing (CVSS 7.2, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-33267](https://cve.now/CVE-2026-33267.md): Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata (CVSS 10.0, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-22068](https://cve.now/CVE-2026-22068.md): Apache Traffic Server: Regex mappings match with malicious domain names (CVSS 8.2, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-41920](https://cve.now/CVE-2026-41920.md): Apache Traffic Server: SNI to Host header matching policy is not properly enforced (CVSS 9.3, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-35226](https://cve.now/CVE-2026-35226.md): Out-of-bounds Write in CODESYS PROFINET Controller (CVSS 7.1, CODESYS PROFINET)
- [CVE-2026-18197](https://cve.now/CVE-2026-18197.md): Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allows Cross-Site Scripti (CVSS 6.4, Link Library)
- [CVE-2026-18192](https://cve.now/CVE-2026-18192.md): Vacron｜IP Camera - Arbitrary File Read (CVSS 7.1, Vacron VIN-DS783E-E6)
- [CVE-2026-18191](https://cve.now/CVE-2026-18191.md): Vacron｜IP Camera - Hidden Functionality (CVSS 9.3, Vacron VIN-DS783E-E6)
- [CVE-2026-63242](https://cve.now/CVE-2026-63242.md): Business logic vulnerability (CVSS 4.3, Three Learning Koollab LMS)
- [CVE-2026-63241](https://cve.now/CVE-2026-63241.md): Insecure direct object reference vulnerability (CVSS 3.1, Three Learning Koollab LMS)
- [CVE-2026-63240](https://cve.now/CVE-2026-63240.md): Information disclosure vulnerability (CVSS 4.3, Three Learning Koollab LMS)
- [CVE-2026-63239](https://cve.now/CVE-2026-63239.md): Hard-coded AWS IAM credentials vulnerability (CVSS 5.4, Three Learning Koollab LMS)
- [CVE-2026-63238](https://cve.now/CVE-2026-63238.md): Authentication bypass vulnerability (CVSS 6.5, Three Learning Koollab LMS)
- [CVE-2026-63237](https://cve.now/CVE-2026-63237.md): TOTP two-factor authentication bypass vulnerability (CVSS 4.8, Three Learning Koollab LMS)
- [CVE-2026-63236](https://cve.now/CVE-2026-63236.md): Improper access control vulnerability (CVSS 3.7, Three Learning Koollab LMS)
- [CVE-2026-63235](https://cve.now/CVE-2026-63235.md): Improper access control vulnerability (CVSS 3.7, Three Learning Koollab LMS)
- [CVE-2026-63234](https://cve.now/CVE-2026-63234.md): SQL injection and unsafe deserialisation vulnerability (CVSS 9.9, Three Learning Koollab LMS)
- [CVE-2026-63233](https://cve.now/CVE-2026-63233.md): SQL injection and unsafe deserialisation vulnerability (CVSS 9.9, Three Learning Koollab LMS)
- [CVE-2026-63232](https://cve.now/CVE-2026-63232.md): SQL injection and unsafe deserialisation vulnerability (CVSS 9.9, Three Learning Koollab LMS)
- [CVE-2026-63231](https://cve.now/CVE-2026-63231.md): Post-authentication SQL injection vulnerability (CVSS 8.1, Three Learning Koollab LMS)
- [CVE-2026-63230](https://cve.now/CVE-2026-63230.md): Pre-authentication error-based SQL injection vulnerability (CVSS 9.1, Three Learning Koollab LMS)
- [CVE-2026-63229](https://cve.now/CVE-2026-63229.md): Pre-authentication blind SQL injection vulnerability (CVSS 9.1, Three Learning Koollab LMS)
- [CVE-2026-63228](https://cve.now/CVE-2026-63228.md): Unrestricted image upload vulnerability (CVSS 2.6, Three Learning Koollab LMS)
- [CVE-2026-63227](https://cve.now/CVE-2026-63227.md): Unrestricted SCORM file upload vulnerability (CVSS 9.9, An unrestricted SCORM file upload vulnerability in Koollab…)
- [CVE-2026-14300](https://cve.now/CVE-2026-14300.md): miniOrange Social Login and Register \< 7.8.0 - Unauthenticated Account Takeover (CVSS 8.1, miniOrange Social Login and Register)
- [CVE-2026-14234](https://cve.now/CVE-2026-14234.md): WOLF - WordPress Posts Bulk Editor and Manager \< 1.1.0 - Stored XSS via CSRF (CVSS 7.1, WOLF)
- [CVE-2026-14224](https://cve.now/CVE-2026-14224.md): Easy Appointments \< 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR (CVSS 5.4, Easy Appointments)
- [CVE-2026-13692](https://cve.now/CVE-2026-13692.md): PayU CommercePro \< 3.9.0 - Unauthenticated Order Tampering (CVSS 5.3, PayU CommercePro Plugin)
- [CVE-2026-13690](https://cve.now/CVE-2026-13690.md): UsersWP \< 1.2.67 - Two-Factor Authentication Bypass (CVSS 7.4, UsersWP)
- [CVE-2026-13605](https://cve.now/CVE-2026-13605.md): Photo Swipe \<= 4.1.1.1 - Author+ Stored XSS via title Attribute (CVSS 6.8, PhotoSwipe)
- [CVE-2026-13423](https://cve.now/CVE-2026-13423.md): Streamit \<= 4.5.0 - Unauthenticated Remote Code Execution via Arbitrary Function Call (CVSS 9.8, Streamit)
- [CVE-2026-11974](https://cve.now/CVE-2026-11974.md): Media folder Addon \< 4.1.7 - Unauthenticated Arbitrary File Download (CVSS 8.6, wp-media-folder-addon)
- [CVE-2026-11351](https://cve.now/CVE-2026-11351.md): ShinyStat Analytics \< 1.0.17 - Unauthenticated Non-Published Product Information Disclosure (CVSS 5.3, ShinyStat Analytics)
- [CVE-2026-18072](https://cve.now/CVE-2026-18072.md): Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '\_wplogin' Parameter (CVSS 9.8, nico23 Advanced Responsive Video Embedder for Rumble, Odyse…)
- [CVE-2026-5626](https://cve.now/CVE-2026-5626.md): Survey Form Block \<= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export (CVSS 4.3, bplugins Survey Form Block – collect answers and insights f…)
- [CVE-2026-15344](https://cve.now/CVE-2026-15344.md): WP Photo Album Plus \<= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter (CVSS 4.9, opajaap WP Photo Album Plus)
- [CVE-2026-12476](https://cve.now/CVE-2026-12476.md): Easy Digital Downloads \<= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter (CVSS 7.2, smub Easy Digital Downloads – eCommerce Payments and Subscr…)
- [CVE-2026-17161](https://cve.now/CVE-2026-17161.md): WowStore \<= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filterMobileText' Block Attribute (CVSS 6.4, wpxpo WowStore – Store Builder & Product Blocks for WooComm…)
- [CVE-2026-17162](https://cve.now/CVE-2026-17162.md): WowStore \<= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'currentPostId' Block Attribute (CVSS 6.4, wpxpo WowStore – Store Builder & Product Blocks for WooComm…)
- [CVE-2026-17166](https://cve.now/CVE-2026-17166.md): Event Booking Manager for WooCommerce \<= 5.3.7 - Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification via mep\_save\_payment\_settings\_modal AJAX Action (CVSS 4.3, magepeopleteam Event Booking Manager for WooCommerce – Sell…)
- [CVE-2026-12144](https://cve.now/CVE-2026-12144.md): Wholesale for WooCommerce \<= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user\_role\_set' Parameter (CVSS 8.8, saadiqbal Wholesale for WooCommerce)
- [CVE-2026-12939](https://cve.now/CVE-2026-12939.md): Newsletters \<= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute (CVSS 6.4, contrid Newsletters)
- [CVE-2026-12938](https://cve.now/CVE-2026-12938.md): Newsletters \<= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute (CVSS 6.4, contrid Newsletters)
- [CVE-2026-15735](https://cve.now/CVE-2026-15735.md): Contact Form to Any API \<= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cf7anyapi\_form\_field' Post Meta (CVSS 6.4, itpathsolutions Contact Form to Any API)
- [CVE-2025-60931](https://cve.now/CVE-2025-60931.md): An Insecure Direct Object Reference (IDOR) in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized (CVSS 7.5)
- [CVE-2025-65337](https://cve.now/CVE-2025-65337.md): Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting (XSS) in pageEditMember.php via the address field. (CVSS 6.1)
- [CVE-2025-65340](https://cve.now/CVE-2025-65340.md): kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php. (CVSS 9.8)
- [CVE-2025-67403](https://cve.now/CVE-2025-67403.md): Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update\_class.php via the parameter class\_name. (CVSS 9.8)
- [CVE-2025-67404](https://cve.now/CVE-2025-67404.md): Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save\_stud.php via the parameters fname, lname, and st (CVSS 9.8)
- [CVE-2025-67405](https://cve.now/CVE-2025-67405.md): Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update\_password.php via the parameter new\_password. (CVSS 7.3)
- [CVE-2025-67406](https://cve.now/CVE-2025-67406.md): https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection. (CVSS 7.3)
- [CVE-2025-67407](https://cve.now/CVE-2025-67407.md): Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update\_student.php via parameters fname and student\_c (CVSS 7.3)
- [CVE-2025-67408](https://cve.now/CVE-2025-67408.md): Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save\_user.php via the parameter status. (CVSS 7.3)
- [CVE-2025-69942](https://cve.now/CVE-2025-69942.md): kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1. (CVSS 9.8)
- [CVE-2025-69943](https://cve.now/CVE-2025-69943.md): kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get\_doctor.php via the parameters doctor and specilizationid. (CVSS 9.8)
- [CVE-2025-69944](https://cve.now/CVE-2025-69944.md): kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in the view-medhistory.php endpoint via the viewid parameter. (CVSS 7.3)
- [CVE-2025-69945](https://cve.now/CVE-2025-69945.md): kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1. (CVSS 7.3)
- [CVE-2025-69949](https://cve.now/CVE-2025-69949.md): kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check\_availability.php via the parameters emailid and email. (CVSS 7.3)
- [CVE-2026-50782](https://cve.now/CVE-2026-50782.md): Jinher OA C6 contains an XML External Entity (XXE) injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/sp\_manager\_getUserlist.aspx/G (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-07-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.