# CVEs published 2026-07-31

183 CVEs were published on July 31, 2026: 28 critical, 64 high. Days are UTC.

- [CVE-2026-34641](https://cve.now/CVE-2026-34641.md): Premiere Pro | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Premiere)
- [CVE-2026-45377](https://cve.now/CVE-2026-45377.md): Decidim: Private exports can be downloaded through reusable links (CVSS 6.5, decidim · decidim-core)
- [CVE-2026-45376](https://cve.now/CVE-2026-45376.md): Decidim: Admin user search allows SQL injection through similarity-based sorting (CVSS 5.5, decidim · decidim-admin)
- [CVE-2026-54785](https://cve.now/CVE-2026-54785.md): gemini-bridge vulnerable to arbitrary local file read via consult\_gemini\_with\_files inline mode (CVSS 6.2, eLyiN gemini-bridge · gemini-bridge)
- [CVE-2026-54768](https://cve.now/CVE-2026-54768.md): WPGraphQL has deprecated \`user\` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design) (CVSS 6.9, wp-graphql · wp-graphql/wp-graphql)
- [CVE-2026-9044](https://cve.now/CVE-2026-9044.md): Command Injection Vulnerability in OpenVPN of TP-Link Archer AXE75 (CVSS 8.5, TP-Link Systems AXE75)
- [CVE-2026-53573](https://cve.now/CVE-2026-53573.md): core-geonetwork has an Open Redirect Bypass (CVSS 4.8, core-geonetwork · org.geonetwork-opensource:geonetwork)
- [CVE-2026-45330](https://cve.now/CVE-2026-45330.md): Decidim: Verification admins can access supplied IDs from other organisations (CVSS 4.9, decidim · decidim-verifications)
- [CVE-2026-54909](https://cve.now/CVE-2026-54909.md): Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute (CVSS 5.3, pion stun · github.com/pion/stun/v3 +2)
- [CVE-2026-54787](https://cve.now/CVE-2026-54787.md): sigstore-go fails to check signature timestamps against a signing key's validity period (CVSS 3.1, sigstore-go · github.com/sigstore/sigstore-go)
- [CVE-2026-45086](https://cve.now/CVE-2026-45086.md): Decidim: Forms admin question editor lacks authorization (CVSS 5.4, decidim · decidim-demographics)
- [CVE-2026-68771](https://cve.now/CVE-2026-68771.md): ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization (CVSS 9.3, Comfy-Org ComfyUI)
- [CVE-2026-65981](https://cve.now/CVE-2026-65981.md): Coturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeover (CVSS 7.1, coturn)
- [CVE-2026-68770](https://cve.now/CVE-2026-68770.md): sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust\_remote\_code=False (CVSS 9.3, Hugging Face sentence-transformers · sentence-transformers)
- [CVE-2026-53551](https://cve.now/CVE-2026-53551.md): free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure (CVSS 6.9, free5gc · github.com/free5gc/free5gc +1)
- [CVE-2026-62959](https://cve.now/CVE-2026-62959.md): Coturn: Pre-authentication heap memory disclosure in ACME redirect (\`try\_acme\_redirect\`) (CVSS 8.2, coturn)
- [CVE-2026-53599](https://cve.now/CVE-2026-53599.md): Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod\_php multi-extension handlers (CVSS 7.5, redaxo core · redaxo/source)
- [CVE-2026-62999](https://cve.now/CVE-2026-62999.md): Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass) (CVSS 7.5, copier-org copier)
- [CVE-2026-53510](https://cve.now/CVE-2026-53510.md): Savon::Model evaluates WSDL operation names as Ruby source (CVSS 8.1, savonrb savon · savon)
- [CVE-2026-18394](https://cve.now/CVE-2026-18394.md): Incorrect authorization in Strands Agents Tools http\_request proxy credential exfiltration (CVSS 7.4, AWS Strands Agents Tools)
- [CVE-2026-65841](https://cve.now/CVE-2026-65841.md): Jodit has cross-site scripting (XSS) via \<script\> nested in SVG that bypasses clean-html sanitization (CVSS 5.3, xdan jodit · jodit)
- [CVE-2026-62324](https://cve.now/CVE-2026-62324.md): Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS (CVSS 5.4, xdan jodit · jodit)
- [CVE-2026-55825](https://cve.now/CVE-2026-55825.md): Contao: Possible path traversal in job download URIs (CVSS 3.1, contao · contao/contao +1)
- [CVE-2026-55824](https://cve.now/CVE-2026-55824.md): Contao crawler leaks auth credentials to external hosts (CVSS 2.6, contao · contao/contao +1)
- [CVE-2026-53502](https://cve.now/CVE-2026-53502.md): Thumbor has path traversal via post-validation URL decoding bypass in file\_loader (CVSS 8.7, thumbor)
- [CVE-2026-53505](https://cve.now/CVE-2026-53505.md): Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS (CVSS 7.5, thumbor)
- [CVE-2026-53504](https://cve.now/CVE-2026-53504.md): Thumbor has Regex Denial of Service (ReDoS) in \`convolution\` filter (CVSS 7.5, thumbor)
- [CVE-2026-53503](https://cve.now/CVE-2026-53503.md): Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS (CVSS 7.5, thumbor)
- [CVE-2026-53501](https://cve.now/CVE-2026-53501.md): Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature (CVSS 8.2, thumbor)
- [CVE-2026-53500](https://cve.now/CVE-2026-53500.md): Thumbor treats ALLOWED\_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot (CVSS 8.2, thumbor)
- [CVE-2026-57232](https://cve.now/CVE-2026-57232.md): Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module (CVSS 3.1, contao · contao/contao +1)
- [CVE-2026-25552](https://cve.now/CVE-2026-25552.md): Ghost CLI \< 1.30.1 IP Spoofing via X-Forwarded-For Header (CVSS 6.3, TryGhost Ghost-CLI)
- [CVE-2026-18481](https://cve.now/CVE-2026-18481.md): Stored XSS in Participant URL Field leads to Account Takeover via Session Token Theft (CVSS 7.3, AWS Ops Wheel)
- [CVE-2026-18321](https://cve.now/CVE-2026-18321.md): Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in ntpsec (CVSS 4.7, ntpsec)
- [CVE-2026-54737](https://cve.now/CVE-2026-54737.md): @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging (CVSS 7.3, phun-ky defaults-deep · @phun-ky/defaults-deep)
- [CVE-2026-54725](https://cve.now/CVE-2026-54725.md): vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API (CVSS 9.6, bank-vaults vault-secrets-webhook · github.com/bank-vaults/…)
- [CVE-2026-34497](https://cve.now/CVE-2026-34497.md): FMS Employee Vulnerable to HTML Injection (CVSS 4.8, Johnson Controls FM Systems Employee)
- [CVE-2026-34495](https://cve.now/CVE-2026-34495.md): FMS Employee vulnerable to XSS (CVSS 4.8, Johnson Controls FM Systems Employee)
- [CVE-2026-21662](https://cve.now/CVE-2026-21662.md): FMS Employee Allows Upload of Unrestricted Files (CVSS 4.8, Johnson Controls FM Systems Employee)
- [CVE-2026-34490](https://cve.now/CVE-2026-34490.md): XAAP Android Data Stored in Unencrypted Database (CVSS 4.8, Johnson Controls XAAP Application)
- [CVE-2026-55100](https://cve.now/CVE-2026-55100.md): hashi-vault-js has a path traversal and query parameter injection (CVSS 8.7, kyndryl-open-source hashi-vault-js · hashi-vault-js)
- [CVE-2026-54729](https://cve.now/CVE-2026-54729.md): dssrf: any users using 1.1.1.1 DNS is impacted by SSRF (CVSS 8.7, HackingRepo dssrf-js · dssrf)
- [CVE-2026-58048](https://cve.now/CVE-2026-58048.md): Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context. (CVSS 9.4, WebPros cPanel · WebPros WP Squared)
- [CVE-2026-58047](https://cve.now/CVE-2026-58047.md): HTTP Smuggling in cPanel allows potential leak of credentials. (CVSS 5.6, WebPros cPanel · WebPros WP Squared)
- [CVE-2026-54706](https://cve.now/CVE-2026-54706.md): OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files (CVSS 4.8, onionshare · onionshare-cli)
- [CVE-2026-54707](https://cve.now/CVE-2026-54707.md): OnionShare Receive mode writes uploaded files even when file uploads are disabled (CVSS 5.4, onionshare · onionshare-cli)
- [CVE-2026-52856](https://cve.now/CVE-2026-52856.md): Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service (CVSS 7.5, pterodactyl wings · github.com/pterodactyl/wings)
- [CVE-2026-52855](https://cve.now/CVE-2026-52855.md): Wings exposes node configuration secrets through egg configuration-file templating (CVSS 9.9, pterodactyl wings · github.com/pterodactyl/wings)
- [CVE-2026-52857](https://cve.now/CVE-2026-52857.md): Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM (CVSS 5.5, pterodactyl wings · github.com/pterodactyl/wings)
- [CVE-2026-59232](https://cve.now/CVE-2026-59232.md): Stored Cross-site Scripting in Prospero Flow CRM lead name field (CVSS 5.3, Roskus Prospero Flow CRM)
- [CVE-2026-17566](https://cve.now/CVE-2026-17566.md): pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780) (CVSS 9.9, pgadmin.org pgAdmin)
- [CVE-2026-17351](https://cve.now/CVE-2026-17351.md): pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045) (CVSS 9.0, pgadmin.org pgAdmin)
- [CVE-2026-17350](https://cve.now/CVE-2026-17350.md): pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers (CVSS 5.4, pgadmin.org pgAdmin)
- [CVE-2026-17349](https://cve.now/CVE-2026-17349.md): pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner (CVSS 9.6, pgadmin.org pgAdmin)
- [CVE-2026-17348](https://cve.now/CVE-2026-17348.md): pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-12046) (CVSS 6.5, pgadmin.org pgAdmin)
- [CVE-2026-17347](https://cve.now/CVE-2026-17347.md): pgAdmin 4: OS command injection in MASTER\_PASSWORD\_HOOK via untrusted username substitution (CVSS 7.5, pgadmin.org pgAdmin)
- [CVE-2026-17346](https://cve.now/CVE-2026-17346.md): pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044) (CVSS 8.8, pgadmin.org pgAdmin)
- [CVE-2026-67607](https://cve.now/CVE-2026-67607.md): LightFTP 2.3.1 Race Condition DoS via worker\_thread\_cleanup (CVSS 8.2, hfiref0x LightFTP)
- [CVE-2026-10686](https://cve.now/CVE-2026-10686.md): Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routers (CVSS 5.8, zephyrproject zephyr)
- [CVE-2026-18141](https://cve.now/CVE-2026-18141.md): Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header (CVSS 8.2, Red Hat Ansible Automation Platform 2.6 for RHEL · Red Hat…)
- [CVE-2026-16504](https://cve.now/CVE-2026-16504.md): VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities (CVSS 9.8, VPS.org Zulip template)
- [CVE-2026-16503](https://cve.now/CVE-2026-16503.md): VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities (CVSS 9.1, VPS.org Supabase template)
- [CVE-2025-62347](https://cve.now/CVE-2025-62347.md): HCL iControl was affected by Improper Input Validation vulnerability. (CVSS 4.3, HCL iControl)
- [CVE-2026-56571](https://cve.now/CVE-2026-56571.md): HCL iControl is affected by multiple security vulnerabilities. (CVSS 3.7, HCL Software HCL iControl)
- [CVE-2026-59231](https://cve.now/CVE-2026-59231.md): Server-Side Request Forgery in Pentestify PDF export via unvalidated image URLs (CVSS 5.3, ccyl13 Pentestify)
- [CVE-2026-56570](https://cve.now/CVE-2026-56570.md): HCL iControl is affected by multiple security vulnerabilities. (CVSS 3.7, HCL Software HCL iControl)
- [CVE-2026-56569](https://cve.now/CVE-2026-56569.md): HCL iControl is affected by multiple security vulnerabilities. (CVSS 4.0, HCL Software HCL iControl)
- [CVE-2026-56568](https://cve.now/CVE-2026-56568.md): HCL iControl is affected by multiple security vulnerabilities. (CVSS 3.7, HCL Software HCL iControl)
- [CVE-2026-56567](https://cve.now/CVE-2026-56567.md): HCL iControl is affected by multiple security vulnerabilities. (CVSS 5.1, HCL Software HCL iControl)
- [CVE-2026-10685](https://cve.now/CVE-2026-10685.md): Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler (CVSS 7.6, zephyrproject zephyr)
- [CVE-2026-18446](https://cve.now/CVE-2026-18446.md): fast-uri vulnerable to host confusion via backslash authority introducer (CVSS 7.5, fast-uri)
- [CVE-2026-67350](https://cve.now/CVE-2026-67350.md): Serendipity \< 2.6.1 Open Redirect via exit.php (CVSS 2.1, s9y Serendipity)
- [CVE-2026-28144](https://cve.now/CVE-2026-28144.md): WordPress WP Maps plugin \<= 4.9.6 - Sensitive Data Exposure vulnerability (CVSS 4.3, Flipper Code WP Maps)
- [CVE-2026-65636](https://cve.now/CVE-2026-65636.md): YAML injection via unescaped newlines in ymlr document comments (CVSS 2.1, ufirstgroup ymlr)
- [CVE-2026-28145](https://cve.now/CVE-2026-28145.md): WordPress MasterStudy LMS plugin \<= 3.7.39 - Broken Access Control vulnerability (CVSS 5.3, StylemixThemes MasterStudy LMS)
- [CVE-2026-17561](https://cve.now/CVE-2026-17561.md): Unauthenticated RCE in Innotim Software's Logsign SIEM (CVSS 9.8, Innotim Software, Telecommunications and Consulting Trade L…)
- [CVE-2026-15227](https://cve.now/CVE-2026-15227.md): Missing Authorization Allows Editing of Foreign Reports (CVSS 5.3, Checkmk)
- [CVE-2026-18358](https://cve.now/CVE-2026-18358.md): Gnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of service (CVSS 7.5, gnome-remote-desktop · Red Hat Enterprise Linux)
- [CVE-2026-46594](https://cve.now/CVE-2026-46594.md): Reflected XSS in PHP Poll Script (CVSS 5.1, PHP Jabbers PHP Poll Script)
- [CVE-2026-46593](https://cve.now/CVE-2026-46593.md): Authenticated SQL Injection in PHP Poll Script (CVSS 8.6, PHP Jabbers PHP Poll Script)
- [CVE-2025-67651](https://cve.now/CVE-2025-67651.md): CSRF in PHP Jabbers scripts (CVSS 6.9, PHP Jabbers Appointment Scheduler · PHP Jabbers Bus Res… +33)
- [CVE-2025-67650](https://cve.now/CVE-2025-67650.md): Authenticated SQL Injection in PHP Jabbers scripts (CVSS 8.6, PHP Jabbers Appointment Scheduler · PHP Jabbers Bus Res… +33)
- [CVE-2025-67649](https://cve.now/CVE-2025-67649.md): Unauthenticated SQL Injection in PHP Jabbers - Car Rental Script script (CVSS 9.3, PHP Jabbers Car Rental Script)
- [CVE-2026-44615](https://cve.now/CVE-2026-44615.md): Path traversal in NotebookRepo note and folder path composition (CVSS 6.5, Apache Software Foundation Apache Zeppelin)
- [CVE-2026-64607](https://cve.now/CVE-2026-64607.md): Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS (CVSS 5.3, Apache Software Foundation Apache HttpComponents Client · o…)
- [CVE-2026-62391](https://cve.now/CVE-2026-62391.md): Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases (CVSS 8.1, Apache Software Foundation Apache Kyuubi)
- [CVE-2026-17567](https://cve.now/CVE-2026-17567.md): Fluent Forms \<= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter (CVSS 5.3, wpmanageninja Fluent Forms – Customizable Contact Forms, Su…)
- [CVE-2026-16843](https://cve.now/CVE-2026-16843.md): Some Hikvision Networking Products are vulnerable to authenticated command execution due to insufficient input validation. (CVSS 7.2, Hikvision DS-3WAP521-SI · Hikvision DS-3WAP522-SI +8)
- [CVE-2026-11770](https://cve.now/CVE-2026-11770.md): 389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check (CVSS 7.5, Red Hat Directory Server 11.5 E4S for RHEL · Red Hat Dir… +5)
- [CVE-2026-15722](https://cve.now/CVE-2026-15722.md): 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get\_ruvelement\_from\_berval() via unbounded replica id parsing (CVSS 7.5, Red Hat Directory Server 11.5 E4S for RHEL · Red Hat Dir… +5)
- [CVE-2026-10079](https://cve.now/CVE-2026-10079.md): Stackrox: stackrox: deploy-time policy enforcement and visibility bypass via label injection (CVSS 8.5, Red Hat Advanced Cluster Security)
- [CVE-2026-18436](https://cve.now/CVE-2026-18436.md): MailerPress \<= 1.5.0 - Missing Authorization to Unauthenticated Arbitrary Modification via REST API Endpoint (CVSS 5.3, MailerPress – Newsletter, email marketing & AI automation)
- [CVE-2026-18437](https://cve.now/CVE-2026-18437.md): MailPress \<= 1.5.0 - Missing Authorization to Unauthenticated Contact Updates (CVSS 5.3, MailerPress – Newsletter, email marketing & AI automation)
- [CVE-2026-65313](https://cve.now/CVE-2026-65313.md): Use of hard-coded VNC credentials in the engineering-workstation provisioning (CVSS 8.1, ANDRITZ HIPASE-250 · ANDRITZ 250 SCALA)
- [CVE-2026-65311](https://cve.now/CVE-2026-65311.md): Missing authentication for logging-configuration endpoint (CVSS 5.3, ANDRITZ HIPASE-250 · ANDRITZ 250 SCALA)
- [CVE-2026-65310](https://cve.now/CVE-2026-65310.md): Missing authentication and permissive CORS policy (CVSS 7.5, ANDRITZ HIPASE-250 · ANDRITZ 250 SCALA)
- [CVE-2026-65309](https://cve.now/CVE-2026-65309.md): Storage of passwords in a reversible format (CVSS 7.5, ANDRITZ HIPASE-250 · ANDRITZ 250 SCALA)
- [CVE-2026-18209](https://cve.now/CVE-2026-18209.md): Keycloak-services: keycloak-services: oidc redirect\_uri fragment bypass in http parameter pollution check (CVSS 3.4, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-18206](https://cve.now/CVE-2026-18206.md): Keycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass (CVSS 3.7, Red Hat Build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-18214](https://cve.now/CVE-2026-18214.md): Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction (CVSS 6.8, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-18203](https://cve.now/CVE-2026-18203.md): Keycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes (CVSS 6.5, Red Hat Build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-18211](https://cve.now/CVE-2026-18211.md): Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains (CVSS 4.2, Red Hat Build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-18208](https://cve.now/CVE-2026-18208.md): Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim (CVSS 6.5, Red Hat Build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-16105](https://cve.now/CVE-2026-16105.md): Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints (CVSS 4.9, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-18215](https://cve.now/CVE-2026-18215.md): Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant (CVSS 6.8, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-18217](https://cve.now/CVE-2026-18217.md): Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution (CVSS 3.4, Red Hat Build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-18218](https://cve.now/CVE-2026-18218.md): Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero (CVSS 4.2, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-14919](https://cve.now/CVE-2026-14919.md): ShopMonitor.io \< 1.2.0 - Unauthenticated Administrator Account Takeover via Password-Reset Email Reroute (CVSS 9.8, ShopMonitor.io)
- [CVE-2026-14862](https://cve.now/CVE-2026-14862.md): Support Genix Lite \< 1.4.48 - Unauthenticated Ticket Attachment Download via Missing Authorization (CVSS 3.7, Support Genix)
- [CVE-2026-13609](https://cve.now/CVE-2026-13609.md): Frontend Admin by DynamiApps \< 3.29.9 - Unauthenticated Stored Cross-Site Scripting via Form Field (CVSS 8.8, Frontend Admin by DynamiApps)
- [CVE-2026-12697](https://cve.now/CVE-2026-12697.md): wpForo Forum \< 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR (CVSS 5.4, wpForo Forum)
- [CVE-2026-12695](https://cve.now/CVE-2026-12695.md): miniOrange 2FA \< 6.2.6 - 2FA Bypass via Attacker-Controlled ga\_secret (CVSS 8.1, miniOrange 2FA)
- [CVE-2026-12376](https://cve.now/CVE-2026-12376.md): Academy LMS \<= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz\_attempts REST Endpoint (CVSS 4.3, Academy LMS)
- [CVE-2026-13393](https://cve.now/CVE-2026-13393.md): ElementsKit Lite \< 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite) (CVSS 3.5, ElementsKit Elementor Addons)
- [CVE-2026-13392](https://cve.now/CVE-2026-13392.md): ElementsKit Lite \< 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite) (CVSS 7.2, ElementsKit Elementor Addons)
- [CVE-2026-12721](https://cve.now/CVE-2026-12721.md): Kirki \< 6.0.13 - Unauthenticated SQL Injection (CVSS 8.6, Kirki)
- [CVE-2026-12720](https://cve.now/CVE-2026-12720.md): Kirki \< 6.0.13 - Unauthenticated PHP Object Injection (CVSS 7.5, Kirki)
- [CVE-2026-12251](https://cve.now/CVE-2026-12251.md): Ultimate Member \< 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field (CVSS 8.1, Ultimate Member)
- [CVE-2026-8155](https://cve.now/CVE-2026-8155.md): BuddyPress \< 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR (CVSS 5.4, BuddyPress)
- [CVE-2026-15381](https://cve.now/CVE-2026-15381.md): WP Go Maps \< 10.1.04 - Unauthenticated SQL Injection via Markers REST filter (CVSS 3.7, WP Go Maps)
- [CVE-2026-15258](https://cve.now/CVE-2026-15258.md): Product Feed Manager for WooCommerce \< 7.6.1 - Contributor+ SQL Injection via Feed Filter (CVSS 8.1, Product Feed Manager For WooCommerce)
- [CVE-2026-15209](https://cve.now/CVE-2026-15209.md): JS Help Desk – AI-Powered Support & Ticketing System \< 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure via IDOR (CVSS 6.5, JS Help Desk)
- [CVE-2026-15048](https://cve.now/CVE-2026-15048.md): GeekyBot \< 1.2.8 - Unauthenticated Sensitive Information Exposure via Chat History (CVSS 7.5, Geeky Bot)
- [CVE-2026-14931](https://cve.now/CVE-2026-14931.md): JS Help Desk \< 3.1.4 - Contributor+ User Email Disclosure (CVSS 6.5, JS Help Desk)
- [CVE-2026-14930](https://cve.now/CVE-2026-14930.md): JS Help Desk \< 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload (CVSS 7.5, JS Help Desk)
- [CVE-2026-14929](https://cve.now/CVE-2026-14929.md): JS Help Desk \< 3.1.4 - Subscriber+ Ticket Reply Modification via IDOR (CVSS 4.3, JS Help Desk)
- [CVE-2026-14928](https://cve.now/CVE-2026-14928.md): JS Help Desk \< 3.1.4 - Subscriber+ Sensitive Information Disclosure via checkAIReplyTicketsBySubject (CVSS 6.5, JS Help Desk)
- [CVE-2026-14927](https://cve.now/CVE-2026-14927.md): FluentCart \< 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes (CVSS 3.7, FluentCart A New Era of eCommerce)
- [CVE-2026-14922](https://cve.now/CVE-2026-14922.md): WP Photo Album Plus \< 9.2.04.003 - Subscriber+ Stored XSS via Photo Comment (CVSS 6.1, WP Photo Album Plus)
- [CVE-2026-14921](https://cve.now/CVE-2026-14921.md): Ultimate Addons for WPBakery Page Builder \< 3.21.5 - Contributor+ Stored XSS via ult\_buttons Shortcode (CVSS 6.1, Ultimate Addons for WPBakery Page Builder)
- [CVE-2026-14849](https://cve.now/CVE-2026-14849.md): Paid Member Subscriptions \< 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export Files (CVSS 3.7, Paid Membership Subscriptions)
- [CVE-2026-14847](https://cve.now/CVE-2026-14847.md): Paid Member Subscriptions \< 3.0.7 - Subscriber+ Payment Data Disclosure via IDOR (CVSS 4.3, Paid Membership Subscriptions)
- [CVE-2026-14845](https://cve.now/CVE-2026-14845.md): NewStatPress \< 1.4.5 - Unauthenticated Stored XSS via Top Post Widget (CVSS 6.1, NewStatPress)
- [CVE-2026-14843](https://cve.now/CVE-2026-14843.md): Events Made Easy \< 3.1.4 - Unauthenticated Person Data Modification via IDOR (CVSS 5.3, Events Made Easy)
- [CVE-2026-14834](https://cve.now/CVE-2026-14834.md): Mailgun for WordPress \< 2.2.1 - Unauthenticated Arbitrary Mailgun List Subscription via add\_list AJAX (CVSS 6.5, Mailgun for WordPress)
- [CVE-2026-14833](https://cve.now/CVE-2026-14833.md): Lightbox with PhotoSwipe \< 5.9.0 - Author+ Stored XSS via data-lbwps-caption Attribute (CVSS 6.8, Lightbox with PhotoSwipe)
- [CVE-2026-14830](https://cve.now/CVE-2026-14830.md): FlxWoo \< 3.1.1 - Unauthenticated Payment Bypass (CVSS 7.5, FlxWoo)
- [CVE-2026-14554](https://cve.now/CVE-2026-14554.md): Check & Log Email \< 2.0.15 - Admin+ SQL Injection via d and s Parameters (CVSS 6.5, Check & Log Email)
- [CVE-2026-14333](https://cve.now/CVE-2026-14333.md): Demi - One Click Demo Import, Backup & Site Migration \< 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Backup Directory (CVSS 7.5, Demi)
- [CVE-2026-14319](https://cve.now/CVE-2026-14319.md): GiveWP \< 4.16.3 - Unauthenticated Recurring Donor Information Disclosure (CVSS 7.5, GiveWP)
- [CVE-2026-14317](https://cve.now/CVE-2026-14317.md): GiveWP \< 4.16.3 - Unauthenticated Payment Gateway Restriction Bypass (CVSS 5.3, GiveWP)
- [CVE-2026-18452](https://cve.now/CVE-2026-18452.md): Rich Source｜DMS+ (Non-Mobile) - Use of Hard-coded Credentials (CVSS 10.0, Rich Source DMS+)
- [CVE-2026-16236](https://cve.now/CVE-2026-16236.md): Realtyna Organic IDX plugin + WPL Real Estate \<= 5.3.0 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, Realtyna Organic IDX plugin + WPL Real Estate)
- [CVE-2026-14483](https://cve.now/CVE-2026-14483.md): Realtyna Organic IDX plugin + WPL Real Estate \<= 5.2.0 - Unauthenticated Arbitrary File Upload via 'files\[file\]' Parameter via Public I/O 'set\_property' Command (CVSS 9.8, Realtyna Organic IDX plugin + WPL Real Estate)
- [CVE-2026-56673](https://cve.now/CVE-2026-56673.md): ComfyUI: Path traversal in LoadImage via the /prompt API allows arbitrary file existence probing and image exfiltration (CVSS 7.5, Comfy-Org ComfyUI)
- [CVE-2026-56672](https://cve.now/CVE-2026-56672.md): ComfyUI: Stored XSS via /userdata/{file} due to Missing Content-Type Sanitization (CVSS 8.2, Comfy-Org ComfyUI)
- [CVE-2026-56671](https://cve.now/CVE-2026-56671.md): ComfyUI: Path traversal in /experiment/models/preview allows arbitrary image file read (CVSS 7.5, Comfy-Org ComfyUI)
- [CVE-2026-56670](https://cve.now/CVE-2026-56670.md): ComfyUI: Stored XSS via SVG file upload on the /view endpoint (CVSS 8.2, Comfy-Org ComfyUI)
- [CVE-2026-63223](https://cve.now/CVE-2026-63223.md): CodeIgniter: Uploaded file extension validation bypass in is\_image and mime\_in rules (CVSS 9.8, CodeIgniter4 · codeigniter4/framework)
- [CVE-2026-63222](https://cve.now/CVE-2026-63222.md): CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames (CVSS 7.5, CodeIgniter4 · codeigniter4/framework)
- [CVE-2026-63221](https://cve.now/CVE-2026-63221.md): CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions (CVSS 9.4, CodeIgniter4 · codeigniter4/framework)
- [CVE-2026-63220](https://cve.now/CVE-2026-63220.md): CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure() (CVSS 4.8, CodeIgniter4 · codeigniter4/framework)
- [CVE-2026-62323](https://cve.now/CVE-2026-62323.md): Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored (CVSS 6.3, cloudreve · github.com/cloudreve/Cloudreve +2)
- [CVE-2026-55502](https://cve.now/CVE-2026-55502.md): Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials (CVSS 7.1, cloudreve · github.com/cloudreve/Cloudreve/v4 +2)
- [CVE-2026-55499](https://cve.now/CVE-2026-55499.md): Cloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipients (CVSS 4.3, cloudreve · github.com/cloudreve/Cloudreve/v4 +2)
- [CVE-2026-55497](https://cve.now/CVE-2026-55497.md): Cloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS) (CVSS 6.5, cloudreve · github.com/cloudreve/Cloudreve/v4 +2)
- [CVE-2026-55496](https://cve.now/CVE-2026-55496.md): Cloudreve: Inactive/banned account emails leaked via GET /api/v4/user/search because SearchActive() omits the active-status predicate (CVSS 4.3, cloudreve · github.com/cloudreve/Cloudreve +2)
- [CVE-2026-43833](https://cve.now/CVE-2026-43833.md): A stack-based buffer overflow vulnerability in the upload functionality could allow an authenticated attacker to achieve code execution. (CVSS 7.5, Advantech ADAM-3600)
- [CVE-2026-43832](https://cve.now/CVE-2026-43832.md): A stack-based buffer overflow vulnerability in the Cookie parsing methods could allow an unauthenticated attacker to achieve code execution (CVSS 9.2, Advantech ADAM-3600)
- [CVE-2026-55495](https://cve.now/CVE-2026-55495.md): Cloudreve: Path Traversal in WOPI PUT\_RELATIVE Allows Arbitrary File Creation in Owner Account (CVSS 4.3, cloudreve · github.com/cloudreve/Cloudreve/v4 +2)
- [CVE-2026-43831](https://cve.now/CVE-2026-43831.md): A stack-based buffer overflow vulnerability in the log message functionality could allow an unauthenticated attacker to achieve code executi (CVSS 9.2, Advantech ADAM-3600)
- [CVE-2026-43830](https://cve.now/CVE-2026-43830.md): A command injection vulnerability in the firmware upgrade file verification process could allow an attacker to execute arbitrary commands. (CVSS 8.6, Advantech ADAM-3600)
- [CVE-2026-43829](https://cve.now/CVE-2026-43829.md): A stack-based buffer overflow vulnerability in the password functionality could allow an unauthenticated attacker to achieve code execution (CVSS 9.2, Advantech ADAM-3600)
- [CVE-2026-18157](https://cve.now/CVE-2026-18157.md): Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote code execution via apt argument injection (CVSS 7.8, RedHatInsights yggdrasil-worker-package-manager · Red Hat E…)
- [CVE-2026-14541](https://cve.now/CVE-2026-14541.md): Authentication Bypass and Audience Confusion in MCP Toolbox OAuth Provider (CVSS 8.0, Google mcp-toolbox)
- [CVE-2026-14540](https://cve.now/CVE-2026-14540.md): Server-Side Request Forgery via Unrestricted HTTP Redirection in MCP Toolbox (CVSS 8.0, Google mcp-toolbox)
- [CVE-2026-14539](https://cve.now/CVE-2026-14539.md): Denial of Service via Unrestricted Payload Buffering in MCP Toolbox (CVSS 6.6, Google mcp-toolbox)
- [CVE-2026-14538](https://cve.now/CVE-2026-14538.md): BigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP Toolbox (CVSS 5.7, Google mcp-toolbox)
- [CVE-2026-14537](https://cve.now/CVE-2026-14537.md): Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints (CVSS 8.1, Google mcp-toolbox)
- [CVE-2026-58039](https://cve.now/CVE-2026-58039.md): A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. (CVSS 3.3, nodejs node)
- [CVE-2025-69946](https://cve.now/CVE-2025-69946.md): SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters district\_id , division\_id (CVSS 9.8)
- [CVE-2025-69948](https://cve.now/CVE-2025-69948.md): SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete\_group.php?id=1. (CVSS 9.8)
- [CVE-2026-38708](https://cve.now/CVE-2026-38708.md): TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2 (CVSS 9.8)
- [CVE-2026-38710](https://cve.now/CVE-2026-38710.md): TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in the system.setclock interface. (CVSS 7.2)
- [CVE-2026-38711](https://cve.now/CVE-2026-38711.md): TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2 (CVSS 9.8)
- [CVE-2026-38713](https://cve.now/CVE-2026-38713.md): TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2 (CVSS 9.8)
- [CVE-2026-50986](https://cve.now/CVE-2026-50986.md): PrestaShop module, totadministrativemandate \<1.8.1 is vulnerable to Cross Site Request Forgery (CSRF). (CVSS 8.8)
- [CVE-2026-51785](https://cve.now/CVE-2026-51785.md): An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request (CVSS 9.8)
- [CVE-2026-51953](https://cve.now/CVE-2026-51953.md): An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handl (CVSS 7.4)
- [CVE-2026-52134](https://cve.now/CVE-2026-52134.md): An issue in the parseGoosePayload() function (/goose/goose\_receiver.c) of libiec61850 v1.6 allows attackers to bypass authentication via a c (CVSS 9.8)
- [CVE-2026-52232](https://cve.now/CVE-2026-52232.md): A reflected cross-site scripting (XSS) vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118101 allows attac (CVSS 6.1)
- [CVE-2026-52371](https://cve.now/CVE-2026-52371.md): A Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan (CVSS 6.5)
- [CVE-2026-67822](https://cve.now/CVE-2026-67822.md): Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-07-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.