CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- drupal photoswipe - responsive javascript modal image galleryPhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-0889.1 Critical
- drupal webform restWebform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-0879.1 Critical
- drupal lunr exposed filtersLunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-0865.7 Medium
- drupal email login otpEmail Login OTP - Critical - Unsupported - SA-CONTRIB-2026-0855.7 Medium
- drupal commerce elavonCommerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-0849.8 Critical
- drupal search api autocompleteSearch API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-0826.1 Medium
- drupal internationalization single sign-onInternationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-0819.8 Critical
- drupal media foldersMedia Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-0806.1 Medium
- duplicatiDuplicati backup software v2.3.0.1 is vulnerable to an incorrect permission assignment vulnerability7.8 High
- ffmpegFFmpeg 4.4 - 8.1.2 Out-of-Bounds Memory Access in ADX Audio Decoder8.7 High
- elggElgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar...4.3 Medium
- ffmpegFFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF Demuxer8.7 High
- ffmpegFFmpeg 0.7.1 - 8.1.2 Out-of-Bounds Read via S/PDIF Muxer spdifenc.c7.1 High
- ffmpegFFmpeg 4.4 - 8.1.2 Double-Free in NVDEC Hardware Decoder via nvdec.c8.7 High
exim4Ubuntuexim4 vulnerabilitiesNo score- ffmpegFFmpeg 8.0 - 8.1.2 Stack Buffer Overflow in Vulkan HEVC Decoder8.7 High
- ffmpegFFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle Demuxer8.7 High
- caliptra core runtime firmwareUnverified AXI Address in Subsystem Mode Commands Enables Denial of Service6.8 Medium
- onlook repoOnlook tRPC Insecure Direct Object Reference via multiple procedures8.7 High
- invoke-ai invokeaiInvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folder6.3 Medium
- graylog2 graylog2-serverGraylog2 Server Missing Permission Check on Event Definition Duplicate5.3 Medium
- gnome librest, red hat enterprise linux 10, enterprise linux 10.0 extended update support +2 moreLibrest: weak random number generation in pkce implementation6.8 Medium
- dell powerprotect data managerDell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input...6.7 Medium
- dell powerprotect data managerDell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) a Generation of Incorrect...8.8 High
- froiden tabletrackFroiden TableTrack 1.3.10 Stored XSS via Order Notes Field5.3 Medium
- dell powerprotect data managerDell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input...9.1 Critical
- dell powerprotect data managerDell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input...9.1 Critical
- dell powerprotect data managerDell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input...7.2 High
- fujitsu linux openft, oracle solaris openft +1 moreUnauthenticated remote code execution (pre-auth RCE) vulnerability in openFT for Linux and Oracle Solaris9.3 Critical
- shepherdwind velocity.jsVelocity.js: Remote Code Execution via property-read to Function constructor (bypass of CVE-2026-44966 fix)9.8 Critical
- dell powerprotect data managerDell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Exposure of Sensitive...6.0 Medium
- fujitsu linux openft, oracle solaris openft +1 moreAuthenticated local root privilege escalation vulnerability in openFT for Linux and Oracle Solaris8.5 High
- analog way picturall quad compact mark iiCVE-2026-149857.8 High
- isc bind, bind 9 +1 moreDNSSEC Validation Bypass via Out-of-Zone NSEC Next Field8.6 High
- isc bind, bind 9 +1 moreUnexpected exit in certain situations with NSEC and NSEC3 both present7.5 High
- isc bind, bind 9 +1 moreRecord ordering based unexpected exit with CNAME or DNAME7.5 High
- isc bind, bind 9 +1 moreCache poisoning possible with label count discrepancy, RRSIG, and wildcards7.5 High
- isc bind, bind 9 +1 morePotential memory usage beyond configured limits7.5 High
- isc bind, bind 9 +1 moreUnnecessary validation of DNSSEC signed records7.5 High
- isc bind, bind 9 +1 morePotential wildcard CNAME RPZ policy bypass7.5 High
- isc bind, bind 9 +1 moreKey Record using PRIVATEDNS algorithm may lead to unexpected exit6.5 Medium
- isc bind, bind 9 +1 moreIncorrect acceptance of NSEC3 records6.8 Medium
- xpoda türkiye informatics technology inc. no code platformSQLi in Xpoda Türkiye Informatics Technology's No Code Platform9.8 Critical
- checkpoint quantum security gateway, quantum security management +1 moreLocal Privilege Escalation in Gaia Portal7.5 High
- checkpoint multi-domain security management, quantum security management +1 moreManagement Authentication Bypass and Privilege Escalation9.1 Critical
- check point smartconsole, checkpoint multi-domain security management, quantum security management +2 moreAuthentication Bypass in the SmartConsole Login Process Using an Application Token9.3 Critical
- progress telerik ui for asp.net ajaxUnauthenticated File Read and Deletion via Hardcoded Encryption Key in RadChart6.5 Medium
- progress telerik ui for asp.net ajaxXXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAX5.3 Medium
- progress telerik ui for asp.net ajaxRadEditor PDF Export SSRF Vulnerability in Telerik UI for ASP.NET AJAX6.5 Medium
- progress telerik ui for asp.net ajaxPersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX8.1 High
- Show moreLoading…