CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- gnu diffutilsHeap-based Buffer Overflow in GNU diffutils2.1 Low
- progress telerik ui for asp.net ajaxSpellChecker DictionaryLanguage Path Traversal Vulnerability in Telerik UI for ASP.NET AJAX7.5 High
- progress telerik ui for asp.net ajaxDialogHandler Parameters Tampering Vulnerability in Telerik UI for ASP.NET AJAX5.9 Medium
- progress telerik ui for asp.net ajaxDialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAX8.1 High
- progress telerik ui for asp.net ajaxAppDataStorageProvider Path Traversal Deserialization Vulnerability in Telerik UI for ASP.NET AJAX8.1 High
- progress telerik ui for asp.net ajaxPersistenceFramework Cookie Deserialization Vulnerability in Telerik UI for ASP.NET AJAX8.1 High
- progress telerik ui for asp.net ajaxRadAsyncUpload Default HMAC Key Fallback Vulnerability in Telerik UI for ASP.NET AJAX7.5 High
- progress telerik ui for asp.net ajaxRadAsyncUpload Upload Metadata Timing Oracle Vulnerability in Telerik UI for ASP.NET AJAX7.5 High
- progress telerik ui for asp.net ajaxRadAsyncUpload Client-State Decrypt-vs-Parse Oracle Vulnerability in Telerik UI for ASP.NET AJAX7.5 High
- progress telerik ui for asp.net ajaxRadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX8.1 High
- nlnet labs unboundDegradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration5.9 Medium
- nlnet labs unboundPossible heap buffer overflow when validator canonicalizes RDATA that contains domain name4.8 Medium
- nlnet labs unboundRemote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp25.9 Medium
- nlnet labs unboundPacket of death for a DNSCrypt misconfigured Unbound5.9 Medium
- nlnet labs unbound'dns-error-reporting: yes' leads to stack buffer overflow7.5 High
- nlnet labs unbound'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash5.9 Medium
- nlnet labs unboundPrivacy/configuration issue when adding local data in views through 'unbound-control'3.1 Low
- nlnet labs unboundDNS Cookie bypass when combined with proxy-protocol use3.7 Low
- nlnet labs unboundMemory corruption could lead to crash and denial of service5.9 Medium
- nlnet labs unboundPossible cache poisoning attack by mapping source port population per thread5.7 Medium
- nlnet labs unboundAttacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush5.3 Medium
- nlnet labs unboundBOGUS configured primary hostname accepted for XFR in auth/rpz zones6.5 Medium
- nlnet labs unbound'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL6.3 Medium
- nlnet labs unboundPossible heap use-after-free in an error path when a DoT forwarded query is jostled out5.9 Medium
- nlnet labs unbound'max-global-quota' reset by DNSSEC validation restarts5.3 Medium
- nlnet labs unboundA wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path3.7 Low
- nlnet labs unboundCross-zone wildcard cache poisoning via RRSIG.labels manipulation7.5 High
- nlnet labs unboundOff-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN3.7 Low
- nlnet labs unboundLibunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated5.9 Medium
- nlnet labs unboundExtra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records3.7 Low
- nlnet labs unboundDegradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries3.7 Low
- nlnet labs unboundPacket of death for DNSCrypt over TCP7.5 High
- nlnet labs unboundRemote DNS-over-QUIC denial of service due to `quic-size` budget bypass7.5 High
- nlnet labs unboundAssertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments5.9 Medium
- red hat directory server 11, directory server 12, directory server 13 +5 more +7 more389-ds-base: 389-ds-base: heap-buffer-overflow in rdn_av_swap on quoted multivalued rdn5.3 Medium
- open mercato mercatoReDoS in Open Mercato6.9 Medium
- unblu inc. sparkUnblu Spark Open Redirect leading to DOM-Based XSS9.3 Critical
- red hat ansible automation platform 2Ansible-lightspeed: visual studio code ansible lightspeed extension: remote code execution via command injection in configuration settings7.8 High
- magarsus consulting ltd. co. idm-mfaOTP Bypass in Magarsus' IDM-MFA8.1 High
- red hat ansible automation platform 2Ansible-lightspeed: ansible lightspeed extension for visual studio code: information disclosure of google gemini api key3.3 Low
- red hat ansible automation platform 2Ansible-lightspeed: ansible lightspeed mcp server: remote code execution and data exfiltration via path traversal6.6 Medium
- red hat ansible automation platform 2Ansible-lightspeed: ansible lightspeed visual studio code extension: arbitrary code execution via command injection in activation script setting7.8 High
- red hat ansible automation platform 2Ansible-lightspeed: visual studio code ansible lightspeed extension: arbitrary code execution via malicious playbook filename7.8 High
smallstrcrates.iosmallstr is unmaintainedNo scoregumdropcrates.iogumdrop is unmaintainedNo score- sevenspark dtx – dynamic text extension for contact form 7Contact Form 7 – Dynamic Text Extension <= 5.0.7 - Unauthenticated Arbitrary Shortcode Execution6.5 Medium
- thinkst opencanaryDenial-of-Service in OpenCanary's MongoDB module6.9 Medium
- getgrav gravGrav Login Plugin 3.8.11 Privilege Escalation via Profile Update8.7 High
- traefikTraefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass5.3 Medium
- traefikTraefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef5.3 Medium
- Show moreLoading…