CVEs published July 31, 2026
183 CVEs were published on July 31, 2026: 28 critical, 64 high.
- Published
- 183
- Critical
- 28
- High
- 64
- Medium
- 73
- Low
- 18
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 119
Most affected products
- pgadmin.org pgAdmin
- 7
- thumbor
- 6
- Advantech ADAM-3600
- 5
- Comfy-Org ComfyUI
- 5
- Google mcp-toolbox
- 5
- HCL Software HCL iControl
- 5
- JS Help Desk
- 5
- Red Hat build of Keycloak · Red Hat Data Grid +2
- 5
- Red Hat Build of Keycloak · Red Hat Data Grid +2
- 5
- ANDRITZ HIPASE-250 · ANDRITZ 250 SCALA
- 4
Critical 28
- CVE-2026-68771ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle DeserializationComfy-Org ComfyUI
- CVE-2026-68770sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=FalseHugging Face sentence-transformers · sentence-transformers
- CVE-2026-54725vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest APIbank-vaults vault-secrets-webhook · github.com/bank-vaults/…
- CVE-2026-58048Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.WebPros cPanel · WebPros WP Squared
- CVE-2026-52855Wings exposes node configuration secrets through egg configuration-file templatingpterodactyl wings · github.com/pterodactyl/wings
- CVE-2026-17566pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)pgadmin.org pgAdmin
- CVE-2026-17351pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)pgadmin.org pgAdmin
- CVE-2026-17349pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-ownerpgadmin.org pgAdmin
- CVE-2026-16504VPS.org one-click Zulip template deployment instance contains multiple vulnerabilitiesVPS.org Zulip template
- CVE-2026-16503VPS.org one-click Supabase template deployment instance contains multiple vulnerabilitiesVPS.org Supabase template
- CVE-2026-17561Unauthenticated RCE in Innotim Software's Logsign SIEMInnotim Software, Telecommunications and Consulting Trade L…
- CVE-2025-67649Unauthenticated SQL Injection in PHP Jabbers - Car Rental Script scriptPHP Jabbers Car Rental Script
- CVE-2026-14919ShopMonitor.io < 1.2.0 - Unauthenticated Administrator Account Takeover via Password-Reset Email RerouteShopMonitor.io
- CVE-2026-18452Rich Source｜DMS+ (Non-Mobile) - Use of Hard-coded CredentialsRich Source DMS+
- CVE-2026-14483Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' CommandRealtyna Organic IDX plugin + WPL Real Estate
- CVE-2026-63223CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rulesCodeIgniter4 · codeigniter4/framework
- CVE-2026-63221CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditionsCodeIgniter4 · codeigniter4/framework
- CVE-2026-43832A stack-based buffer overflow vulnerability in the Cookie parsing methods could allow an unauthenticated attacker to achieve code execution Advantech ADAM-3600
- CVE-2026-43831A stack-based buffer overflow vulnerability in the log message functionality could allow an unauthenticated attacker to achieve code executiAdvantech ADAM-3600
- CVE-2026-43829A stack-based buffer overflow vulnerability in the password functionality could allow an unauthenticated attacker to achieve code execution Advantech ADAM-3600
- CVE-2025-69946SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters district_id , division_id
- CVE-2025-69948SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1.
- CVE-2026-38708TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2
- CVE-2026-38711TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2
- CVE-2026-38713TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2
- CVE-2026-51785An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request
- CVE-2026-52134An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass authentication via a c
- CVE-2026-67822Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint.
High 64
- CVE-2026-34641Premiere Pro | Out-of-bounds Write (CWE-787)Adobe Premiere
- CVE-2026-9044Command Injection Vulnerability in OpenVPN of TP-Link Archer AXE75TP-Link Systems AXE75
- CVE-2026-65981Coturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeovercoturn
- CVE-2026-62959Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)coturn
- CVE-2026-53599Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlersredaxo core · redaxo/source
- CVE-2026-62999Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)copier-org copier
- CVE-2026-53510Savon::Model evaluates WSDL operation names as Ruby sourcesavonrb savon · savon
- CVE-2026-18394Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltrationAWS Strands Agents Tools
- CVE-2026-53502Thumbor has path traversal via post-validation URL decoding bypass in file_loaderthumbor
- CVE-2026-53505Thumbor proportion filter allows unbounded post-transform resize leading to remote DoSthumbor
- CVE-2026-53504Thumbor has Regex Denial of Service (ReDoS) in `convolution` filterthumbor
- CVE-2026-53503Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoSthumbor
- CVE-2026-53501Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signaturethumbor
- CVE-2026-53500Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dotthumbor
- CVE-2026-18481Stored XSS in Participant URL Field leads to Account Takeover via Session Token TheftAWS Ops Wheel
- CVE-2026-54737@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Mergingphun-ky defaults-deep · @phun-ky/defaults-deep
- CVE-2026-55100hashi-vault-js has a path traversal and query parameter injectionkyndryl-open-source hashi-vault-js · hashi-vault-js
- CVE-2026-54729dssrf: any users using 1.1.1.1 DNS is impacted by SSRFHackingRepo dssrf-js · dssrf
- CVE-2026-52856Wings: Maliciously crafted packet during SFTP connection handshake causes denial of servicepterodactyl wings · github.com/pterodactyl/wings
- CVE-2026-17347pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitutionpgadmin.org pgAdmin
- CVE-2026-17346pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)pgadmin.org pgAdmin
- CVE-2026-67607LightFTP 2.3.1 Race Condition DoS via worker_thread_cleanuphfiref0x LightFTP
- CVE-2026-18141Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http headerRed Hat Ansible Automation Platform 2.6 for RHEL · Red Hat…
- CVE-2026-10685Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handlerzephyrproject zephyr
- CVE-2026-18446fast-uri vulnerable to host confusion via backslash authority introducerfast-uri
- CVE-2026-18358Gnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of servicegnome-remote-desktop · Red Hat Enterprise Linux
- CVE-2026-46593Authenticated SQL Injection in PHP Poll ScriptPHP Jabbers PHP Poll Script
- CVE-2025-67650Authenticated SQL Injection in PHP Jabbers scriptsPHP Jabbers Appointment Scheduler · PHP Jabbers Bus Res… +33
- CVE-2026-62391Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliasesApache Software Foundation Apache Kyuubi
- CVE-2026-16843Some Hikvision Networking Products are vulnerable to authenticated command execution due to insufficient input validation.Hikvision DS-3WAP521-SI · Hikvision DS-3WAP522-SI +8
- CVE-2026-11770389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status checkRed Hat Directory Server 11.5 E4S for RHEL · Red Hat Dir… +5
- CVE-2026-15722389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsingRed Hat Directory Server 11.5 E4S for RHEL · Red Hat Dir… +5
- CVE-2026-10079Stackrox: stackrox: deploy-time policy enforcement and visibility bypass via label injectionRed Hat Advanced Cluster Security
- CVE-2026-65313Use of hard-coded VNC credentials in the engineering-workstation provisioningANDRITZ HIPASE-250 · ANDRITZ 250 SCALA
- CVE-2026-65310Missing authentication and permissive CORS policyANDRITZ HIPASE-250 · ANDRITZ 250 SCALA
- CVE-2026-65309Storage of passwords in a reversible formatANDRITZ HIPASE-250 · ANDRITZ 250 SCALA
- CVE-2026-13609Frontend Admin by DynamiApps < 3.29.9 - Unauthenticated Stored Cross-Site Scripting via Form FieldFrontend Admin by DynamiApps
- CVE-2026-12695miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secretminiOrange 2FA
- CVE-2026-13392ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)ElementsKit Elementor Addons
- CVE-2026-12721Kirki < 6.0.13 - Unauthenticated SQL InjectionKirki
- CVE-2026-12720Kirki < 6.0.13 - Unauthenticated PHP Object InjectionKirki
- CVE-2026-12251Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection FieldUltimate Member
- CVE-2026-15258Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed FilterProduct Feed Manager For WooCommerce
- CVE-2026-15048GeekyBot < 1.2.8 - Unauthenticated Sensitive Information Exposure via Chat HistoryGeeky Bot
- CVE-2026-14930JS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment UploadJS Help Desk
- CVE-2026-14830FlxWoo < 3.1.1 - Unauthenticated Payment BypassFlxWoo
- CVE-2026-14333Demi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Backup DirectoryDemi
- CVE-2026-14319GiveWP < 4.16.3 - Unauthenticated Recurring Donor Information DisclosureGiveWP
- CVE-2026-16236Realtyna Organic IDX plugin + WPL Real Estate <= 5.3.0 - Authenticated (Subscriber+) Arbitrary File UploadRealtyna Organic IDX plugin + WPL Real Estate
- CVE-2026-56673ComfyUI: Path traversal in LoadImage via the /prompt API allows arbitrary file existence probing and image exfiltrationComfy-Org ComfyUI
- CVE-2026-56672ComfyUI: Stored XSS via /userdata/{file} due to Missing Content-Type SanitizationComfy-Org ComfyUI
- CVE-2026-56671ComfyUI: Path traversal in /experiment/models/preview allows arbitrary image file readComfy-Org ComfyUI
- CVE-2026-56670ComfyUI: Stored XSS via SVG file upload on the /view endpointComfy-Org ComfyUI
- CVE-2026-63222CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenamesCodeIgniter4 · codeigniter4/framework
- CVE-2026-55502Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentialscloudreve · github.com/cloudreve/Cloudreve/v4 +2
- CVE-2026-43833A stack-based buffer overflow vulnerability in the upload functionality could allow an authenticated attacker to achieve code execution.Advantech ADAM-3600
- CVE-2026-43830A command injection vulnerability in the firmware upgrade file verification process could allow an attacker to execute arbitrary commands.Advantech ADAM-3600
- CVE-2026-18157Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote code execution via apt argument injectionRedHatInsights yggdrasil-worker-package-manager · Red Hat E…
- CVE-2026-14541Authentication Bypass and Audience Confusion in MCP Toolbox OAuth ProviderGoogle mcp-toolbox
- CVE-2026-14540Server-Side Request Forgery via Unrestricted HTTP Redirection in MCP ToolboxGoogle mcp-toolbox
- CVE-2026-14537Authorization Bypass in MCP Toolbox Legacy HTTP EndpointsGoogle mcp-toolbox
- CVE-2026-38710TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in the system.setclock interface.
- CVE-2026-50986PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF).
- CVE-2026-51953An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handl
Medium, low and unrated 91
- CVE-2026-45377Decidim: Private exports can be downloaded through reusable linksdecidim · decidim-core
- CVE-2026-45376Decidim: Admin user search allows SQL injection through similarity-based sortingdecidim · decidim-admin
- CVE-2026-54785gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline modeeLyiN gemini-bridge · gemini-bridge
- CVE-2026-54768WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)wp-graphql · wp-graphql/wp-graphql
- CVE-2026-53573core-geonetwork has an Open Redirect Bypasscore-geonetwork · org.geonetwork-opensource:geonetwork
- CVE-2026-45330Decidim: Verification admins can access supplied IDs from other organisationsdecidim · decidim-verifications
- CVE-2026-54909Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attributepion stun · github.com/pion/stun/v3 +2
- CVE-2026-54787sigstore-go fails to check signature timestamps against a signing key's validity periodsigstore-go · github.com/sigstore/sigstore-go
- CVE-2026-45086Decidim: Forms admin question editor lacks authorizationdecidim · decidim-demographics
- CVE-2026-53551free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failurefree5gc · github.com/free5gc/free5gc +1
- CVE-2026-65841Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitizationxdan jodit · jodit
- CVE-2026-62324Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSSxdan jodit · jodit
- CVE-2026-55825Contao: Possible path traversal in job download URIscontao · contao/contao +1
- CVE-2026-55824Contao crawler leaks auth credentials to external hostscontao · contao/contao +1
- CVE-2026-57232Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Modulecontao · contao/contao +1
- CVE-2026-25552Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For HeaderTryGhost Ghost-CLI
- CVE-2026-18321Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in ntpsecntpsec
- CVE-2026-34497FMS Employee Vulnerable to HTML InjectionJohnson Controls FM Systems Employee
- CVE-2026-34495FMS Employee vulnerable to XSSJohnson Controls FM Systems Employee
- CVE-2026-21662FMS Employee Allows Upload of Unrestricted FilesJohnson Controls FM Systems Employee
- CVE-2026-34490XAAP Android Data Stored in Unencrypted DatabaseJohnson Controls XAAP Application
- CVE-2026-58047HTTP Smuggling in cPanel allows potential leak of credentials.WebPros cPanel · WebPros WP Squared
- CVE-2026-54706OnionShare follows symlinks in shared directories, allowing unintended disclosure of local filesonionshare · onionshare-cli
- CVE-2026-54707OnionShare Receive mode writes uploaded files even when file uploads are disabledonionshare · onionshare-cli
- CVE-2026-52857Wings: Maliciously or erroneously created parsed config files can cause wings process to OOMpterodactyl wings · github.com/pterodactyl/wings
- CVE-2026-59232Stored Cross-site Scripting in Prospero Flow CRM lead name fieldRoskus Prospero Flow CRM
- CVE-2026-17350pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlerspgadmin.org pgAdmin
- CVE-2026-17348pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-12046)pgadmin.org pgAdmin
- CVE-2026-10686Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routerszephyrproject zephyr
- CVE-2025-62347HCL iControl was affected by Improper Input Validation vulnerability.HCL iControl
- CVE-2026-56571HCL iControl is affected by multiple security vulnerabilities.HCL Software HCL iControl
- CVE-2026-59231Server-Side Request Forgery in Pentestify PDF export via unvalidated image URLsccyl13 Pentestify
- CVE-2026-56570HCL iControl is affected by multiple security vulnerabilities.HCL Software HCL iControl
- CVE-2026-56569HCL iControl is affected by multiple security vulnerabilities.HCL Software HCL iControl
- CVE-2026-56568HCL iControl is affected by multiple security vulnerabilities.HCL Software HCL iControl
- CVE-2026-56567HCL iControl is affected by multiple security vulnerabilities.HCL Software HCL iControl
- CVE-2026-67350Serendipity < 2.6.1 Open Redirect via exit.phps9y Serendipity
- CVE-2026-28144WordPress WP Maps plugin <= 4.9.6 - Sensitive Data Exposure vulnerabilityFlipper Code WP Maps
- CVE-2026-65636YAML injection via unescaped newlines in ymlr document commentsufirstgroup ymlr
- CVE-2026-28145WordPress MasterStudy LMS plugin <= 3.7.39 - Broken Access Control vulnerabilityStylemixThemes MasterStudy LMS
- CVE-2026-15227Missing Authorization Allows Editing of Foreign ReportsCheckmk
- CVE-2026-46594Reflected XSS in PHP Poll ScriptPHP Jabbers PHP Poll Script
- CVE-2025-67651CSRF in PHP Jabbers scriptsPHP Jabbers Appointment Scheduler · PHP Jabbers Bus Res… +33
- CVE-2026-44615Path traversal in NotebookRepo note and folder path compositionApache Software Foundation Apache Zeppelin
- CVE-2026-64607Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoSApache Software Foundation Apache HttpComponents Client · o…
- CVE-2026-17567Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameterwpmanageninja Fluent Forms – Customizable Contact Forms, Su…
- CVE-2026-18436MailerPress <= 1.5.0 - Missing Authorization to Unauthenticated Arbitrary Modification via REST API EndpointMailerPress – Newsletter, email marketing & AI automation
- CVE-2026-18437MailPress <= 1.5.0 - Missing Authorization to Unauthenticated Contact UpdatesMailerPress – Newsletter, email marketing & AI automation
- CVE-2026-65311Missing authentication for logging-configuration endpointANDRITZ HIPASE-250 · ANDRITZ 250 SCALA
- CVE-2026-18209Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution checkRed Hat build of Keycloak · Red Hat Data Grid +2
- CVE-2026-18206Keycloak-services: keycloak-services: client policy source-host wildcard domain matching bypassRed Hat Build of Keycloak · Red Hat Data Grid +2
- CVE-2026-18214Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restrictionRed Hat build of Keycloak · Red Hat Data Grid +2
- CVE-2026-18203Keycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixesRed Hat Build of Keycloak · Red Hat Data Grid +2
- CVE-2026-18211Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domainsRed Hat Build of Keycloak · Red Hat Data Grid +2
- CVE-2026-18208Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claimRed Hat Build of Keycloak · Red Hat Data Grid +2
- CVE-2026-16105Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpointsRed Hat build of Keycloak · Red Hat Data Grid +2
- CVE-2026-18215Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenantRed Hat build of Keycloak · Red Hat Data Grid +2
- CVE-2026-18217Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollutionRed Hat Build of Keycloak · Red Hat Data Grid +2
- CVE-2026-18218Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzeroRed Hat build of Keycloak · Red Hat Data Grid +2
- CVE-2026-14862Support Genix Lite < 1.4.48 - Unauthenticated Ticket Attachment Download via Missing AuthorizationSupport Genix
- CVE-2026-12697wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDORwpForo Forum
- CVE-2026-12376Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST EndpointAcademy LMS
- CVE-2026-13393ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite)ElementsKit Elementor Addons
- CVE-2026-8155BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDORBuddyPress
- CVE-2026-15381WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filterWP Go Maps
- CVE-2026-15209JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure via IDORJS Help Desk
- CVE-2026-14931JS Help Desk < 3.1.4 - Contributor+ User Email DisclosureJS Help Desk
- CVE-2026-14929JS Help Desk < 3.1.4 - Subscriber+ Ticket Reply Modification via IDORJS Help Desk
- CVE-2026-14928JS Help Desk < 3.1.4 - Subscriber+ Sensitive Information Disclosure via checkAIReplyTicketsBySubjectJS Help Desk
- CVE-2026-14927FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print RoutesFluentCart A New Era of eCommerce
- CVE-2026-14922WP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo CommentWP Photo Album Plus
- CVE-2026-14921Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons ShortcodeUltimate Addons for WPBakery Page Builder
- CVE-2026-14849Paid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export FilesPaid Membership Subscriptions
- CVE-2026-14847Paid Member Subscriptions < 3.0.7 - Subscriber+ Payment Data Disclosure via IDORPaid Membership Subscriptions
- CVE-2026-14845NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post WidgetNewStatPress
- CVE-2026-14843Events Made Easy < 3.1.4 - Unauthenticated Person Data Modification via IDOREvents Made Easy
- CVE-2026-14834Mailgun for WordPress < 2.2.1 - Unauthenticated Arbitrary Mailgun List Subscription via add_list AJAXMailgun for WordPress
- CVE-2026-14833Lightbox with PhotoSwipe < 5.9.0 - Author+ Stored XSS via data-lbwps-caption AttributeLightbox with PhotoSwipe
- CVE-2026-14554Check & Log Email < 2.0.15 - Admin+ SQL Injection via d and s ParametersCheck & Log Email
- CVE-2026-14317GiveWP < 4.16.3 - Unauthenticated Payment Gateway Restriction BypassGiveWP
- CVE-2026-63220CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()CodeIgniter4 · codeigniter4/framework
- CVE-2026-62323Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignoredcloudreve · github.com/cloudreve/Cloudreve +2
- CVE-2026-55499Cloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipientscloudreve · github.com/cloudreve/Cloudreve/v4 +2
- CVE-2026-55497Cloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS)cloudreve · github.com/cloudreve/Cloudreve/v4 +2
- CVE-2026-55496Cloudreve: Inactive/banned account emails leaked via GET /api/v4/user/search because SearchActive() omits the active-status predicatecloudreve · github.com/cloudreve/Cloudreve +2
- CVE-2026-55495Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Accountcloudreve · github.com/cloudreve/Cloudreve/v4 +2
- CVE-2026-14539Denial of Service via Unrestricted Payload Buffering in MCP ToolboxGoogle mcp-toolbox
- CVE-2026-14538BigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP ToolboxGoogle mcp-toolbox
- CVE-2026-58039A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths.nodejs node
- CVE-2026-52232A reflected cross-site scripting (XSS) vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118101 allows attac
- CVE-2026-52371A Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan