CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- tassos.gr convert forms extension for joomlaJoomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.28.2 High
- regularlabs.com modals pro extension for joomlaJoomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension6.5 Medium
- regularlabs.com cache cleaner pro extension for joomlaJoomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension9.8 Critical
- regularlabs.com cache cleaner extension for joomlaJoomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension5.4 Medium
- regularlabs.com modules anywhere extension for joomlaJoomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension8.1 High
- regularlabs.com articles anywhere extension for joomla, users anywhere extension for joomla +1 moreJoomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension7.5 High
- regularlabs.com rereplacer pro extension for joomlaJoomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension7.5 High
- regularlabs.com geoip extension for joomlaJoomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension6.5 Medium
- regularlabs.com geoip extension for joomlaJoomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension8.8 High
- regularlabs.com cache cleaner pro extension for joomlaJoomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension6.5 Medium
- regularlabs.com cdn for joomla pro extension for joomlaJoomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension6.2 Medium
- regularlabs.com keyboard shortcuts extension for joomlaJoomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension6.1 Medium
- regularlabs.com cache cleaner pro extension for joomlaJoomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension9.8 Critical
- regularlabs.com articles anywhere pro extension for joomla, users anywhere pro extension for joomla +1 moreJoomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions7.5 High
- regularlabs.com geoip extension for joomlaJoomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension7.5 High
- regularlabs.com geoip extension for joomlaJoomla Extension - regularlabs.com - Zipslip in GeoIP extension9.8 Critical
- emarket-design customer support ticket system & helpdeskCustomer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter9.8 Critical
- berocket grid/list view for woocommerceGrid/List View for WooCommerce <= 3.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position' Shortcode Attribute6.4 Medium
- equalizedigital equalize digital accessibility checker – wcag, ada, eaa and section 508 complianceEqualize Digital Accessibility Checker <= 1.46.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'html' Parameter6.4 Medium
- rtcamp godam – organize wordpress media library & file manager with unlimited folders for images, videos & moreGoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field9.8 Critical
- codename065 premium packages – sell digital products securelyPremium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parameter6.5 Medium
- berocket brands for woocommerceBrands for WooCommerce <= 3.8.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field4.4 Medium
- berocket brands for woocommerceBrands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute6.4 Medium
- ataurr gutenkit – page builder blocks, patterns, and templates for gutenberg block editorGutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints5.3 Medium
- tickera – sell tickets & manage eventsTickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_event_filter' Parameter6.5 Medium
- kilbot wcpos – point of sale (pos) plugin for woocommerceWCPOS <= 1.9.8 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read via 'type' Parameter6.5 Medium
- niklaslindemann bulk page generator – lpageryBulk Page Generator <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title6.4 Medium
- alibaba fastjsonRemote Code Execution in fastjson 1.2.68–1.2.839.0 Critical
- powerdns recursorRRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation7.5 High
- powerdns recursorWildcard CNAME proof validation bypass3.7 Low
- bosch camera firmwareA missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an...7.5 High
- bosch configuration managerInformation disclosure in Bosch Configuration Manager in Version 7.72.0106 allows an attacker to...8.4 High
- powerdns recursorPrefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack3.7 Low
- tubitak bilgem software technologies research institute pardus-updateRoot Command Injection via Offline Update in TÜBİTAK BİLGEM's pardus-update7.8 High
- king-theme product designer for woocommerce wordpress | lumiseProduct Designer for WooCommerce WordPress | Lumise <= 2.1.1 - Unauthenticated SQL Injection via 'id' Parameter in Cart JSON Upload7.5 High
- mythemeshop wp shortcode by mythemeshopWP Shortcode by MyThemeShop <= 1.4.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute6.4 Medium
- webpushr web push notifications – webpushrWeb Push Notifications <= 4.39.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'webpushr_notification_title' Post Meta Parameter6.4 Medium
- repute info systems arformsARforms <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'password' Field Values7.2 High
- linux-gaming portprotonqtportprotonqt allows any users to mount and unmount arbitrary file systems and modify the network configuration via NetworkManager7.1 High
- selinuxproject selinuxProcess Kill Attack Vector in killall() in seunshare6.8 Medium
- selinuxproject selinuxLocal File Deletion Attack Vector in rm_rf() in seunshare5.8 Medium
- unknown post status notifier litePost Status Notifier Lite < 1.13.0 - Reflected XSS via mod Parameter4.8 Medium
- aresit wp compressWP Compress < 7.10.04 - Reflected XSS via test_zone6.1 Medium
- unknown security-ninja-premiumSecurity Ninja (Premium) < 5.290 - Two-Factor Authentication Bypass via secnin_skip_2fa7.5 High
- unknown praison ai seoPraison AI SEO < 5.0.7 - Unauthenticated Multiple Missing Authorization (Post Permalink Modification, Plugin Settings Disclosure)7.5 High
- formcraftFormCraft <= 3.9.14 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Sub-Parameters7.2 High
- fantasticplugins sumo reward points for woocommerceSUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter7.2 High
- ricoh company printers and multifunction printers (mfps)Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. do not implement...6.9 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreNano: gnu nano: arbitrary memory writes, information disclosure, or denial of service via format string vulnerability in error handling.6.8 Medium
- @fastify/static, fastify fastify-static +1 more@fastify/static vulnerable to route guard bypass via path traversal7.5 High
- Show moreLoading…