CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- dompdfDompdf: Chroot Validation Bypass2.3 Low
- No product listedoclif JIT Plugin Entry child_process.exec os command injection4.8 Medium
- regularlabs.com articles anywhere extension for joomla, modules anywhere extension for joomla +1 moreJoomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions9.1 Critical
- regularlabs.com articles anywhere extension for joomla, users anywhere extension for joomla +1 moreJoomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions6.5 Medium
- regularlabs.com ip login extension for joomlaJoomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension7.5 High
- regularlabs.com advanced module manager extension for joomla, articles anywhere extension for joomla, articles field extension for joomla +20 more +22 moreJoomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints8.0 High
- regularlabs.com db replacer extension for joomlaJoomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension8.8 High
- regularlabs.com advanced module manager extension for joomla, conditional content extension for joomla, content templater pro extension for joomla +1 more +3 moreJoomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager8.8 High
- regularlabs.com sourcerer extension for joomlaJoomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension9.8 Critical
- regularlabs.com advanced module manager extension for joomla, conditional content extension for joomla, content templater pro extension for joomla +1 more +3 moreJoomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager7.5 High
- regularlabs.com ip login extension for joomlaJoomla Extension - regularlabs.com - Insecure login URL keys in IP login extension9.1 Critical
- regularlabs.com articles anywhere pro extension for joomla, modals extension for joomla, modules anywhere pro extension for joomla +2 more +4 moreJoomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions5.4 Medium
- regularlabs.com articles anywhere extension for joomla, conditional content extension for joomla, modules anywhere extension for joomla +4 more +6 moreJoomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions7.5 High
- regularlabs.com advanced module manager extension for joomla, conditional content extension for joomla, content templater pro extension for joomla +1 more +3 moreJoomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager4.8 Medium
- regularlabs.com regular labs extension manager extension for joomlaJoomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager8.8 High
- regularlabs.com content templater extension for joomla, rereplacer extension for joomla, snippets extension for joomla +2 moreJoomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension8.8 High
- ritou oidc::liteOIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify7.5 High
- q2a question2answerQuestion2Answer 1.8.8 Session Fixation via Forgot-Password Flow9.1 Critical
- mongodb compassCompass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow8.4 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreServer crash via aggregation pipeline expression with compound wildcard index specification7.1 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreA user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM7.1 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreAuthorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META6.0 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreTransaction Command Insufficient Input Validation Leading to Process Termination7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass8.6 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreFind command with $meta sort can lead to crash7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 more$graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access7.1 High
- mozilla thunderbirdOff-by-one out of bounds read in MIME header parser for forwarding7.5 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage5.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 morelibmongocrypt Improper Input Validation Leading to Process Termination5.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreServer-Side JavaScript DBPointer BSON Serialization Memory Disclosure7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moretlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket7.2 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse2.3 Low
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreQueryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination6.0 Medium
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreServer-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termination7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption9.2 Critical
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination5.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreAwaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service6.9 Medium
- mongodb server, mongodb, mongodb, inc. mongodb server +2 more$rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreAggregation Framework Memory Exhaustion Leading to Process Termination7.1 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreOut-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreLocal File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader6.3 Medium
- netapp ontap, ontap 9 +1 moreONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are...8.7 High
multipath-toolsSUSESecurity update for multipath-toolsNo score- cal.com cal.diyCVE-2026-166249.6 Critical
- ibm sterling b2b integrator, sterling file gateway +1 moreIBM Sterling B2B Integrator and IBM Sterling File Gateway Authorization Bypass5.3 Medium
- drupal development environmentDevelopment Environment - Critical - Unsupported - SA-CONTRIB-2026-0895.7 Medium
- Show moreLoading…