CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- No product listedAn issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to...9.8 Critical
zpaqfranzopenSUSEAn issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate...8.8 High- No product listedBandiZip v.7.37 is affected by a Authentication Bypass Vulnerability. This vulnerability allows...5.4 Medium
- No product listedAn issue in Milos Paripovic OneCommander v.3.96.0.0 allows a remote attacker to execute arbitrary...8.8 High
- No product listedAn issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading...8.8 High
- No product listedAn issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via...8.8 High
- No product listedjsforce SFDX Connection Registry sfdx.js _execCommand os command injection4.8 Medium
- qusetions minicode-pythonQUSETIONS MiniCode-Python Project File config.py subprocess.Popen os command injection2.3 Low
- elastic elasticsearchUncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service6.5 Medium
- elastic kibanaMissing Authorization in Kibana Leading to Information Disclosure4.3 Medium
- elastic kibanaUncontrolled Resource Consumption in Kibana Leading to Denial of Service6.5 Medium
- elastic kibanaUncontrolled Resource Consumption in Kibana Leading to Denial of Service6.5 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System BSIS.php cross site scripting5.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 moreLibarchive: libarchive: signed integer overflow in archive_write_zip_header2.9 Low
- elastic kibanaAuthorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure4.3 Medium
- elastic kibanaIncorrect Authorization in Kibana Leading to Machine Learning Audit Log Integrity Compromise4.3 Medium
- elastic elasticsearchUncontrolled Recursion in Elasticsearch Leading to Denial of Service6.5 Medium
- elastic kibanaMissing Authorization in Kibana Leading to Unauthorized Information Disclosure4.3 Medium
- code16 sharpSharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability8.9 High
- naturalintelligence fast-xml-parserfast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits8.7 High
- gitpython-developers gitpythonGitPython before 3.1.52 Environment Variable Exfiltration via clone_from8.7 High
- rails rails-html-sanitizerrails-html-sanitizer: Possible XSS vulnerability with certain configurations5.1 Medium
- elastic kibanaIncomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery5.0 Medium
- honojs node-server@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake5.3 Medium
- google chromeUse after free in GPU in Google Chrome on Android prior to 150.0.7871.182 allowed a remote...9.6 Critical
- google chromeUse after free in UI in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who...8.8 High
- google chromeInsufficient validation of untrusted input in Certificate in Google Chrome on Linux prior to 150...7.5 High
- google chromeOut of bounds read and write in ANGLE in Google Chrome on Android prior to 150.0.7871.182 allowed...9.6 Critical
- google chromeStack buffer overflow in V8 in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to...8.8 High
- google chromeUninitialized Use in Skia in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who...3.1 Low
- google chromeInteger overflow in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker...9.3 Critical
- google chromeInsufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.182...5.4 Medium
- google chromeInsufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.182...7.8 High
- google chromeOut of bounds write in ANGLE in Google Chrome prior to 150.0.7871.182 allowed a remote attacker...8.3 High
- google chromeInappropriate implementation in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a...8.8 High
- google chromeType Confusion in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to...8.8 High
google.golang.org/grpcGo,rootio-google.golang.org/grpcRoot +1 moregRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities8.8 High- flavorjones loofahLoofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons2.3 Low
- flavorjones loofahLoofah: SVG `href` attribute bypasses local-reference restriction4.7 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System class.php cross site scripting5.3 Medium
- typeormTypeORM: migration:generate template-literal code injection5.7 Medium
- fasterxml jackson-corejackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)8.7 High
- nettyNetty: Memory Exhaustion via HTTP/3 Reserved Frame Types7.5 High
- gitea open source git serverPublic-Only Personal access tokens scope bypass in Organization and Permission Endpoints4.9 Medium
- gitea open source git serverSSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata7.5 High
- giteaGitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass8.3 High
- gitea open source git serverWebhook Authorization Header Returned in Plaintext via API2.7 Low
- gitea open source git serverCross-Repo Information Disclosure via Org-Level Actions Run/Job APIs6.5 Medium
- gitea open source git serverGHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private4.3 Medium
- gitea open source git serverPublic-only API token restriction is not enforced on team API routes4.3 Medium
- Show moreLoading…