CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- bold reports (by syncfusion) standalone report designerBold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Database Download9.3 Critical
- bold reports (by syncfusion) standalone report designerBold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Font Processing9.3 Critical
- bold reports (by syncfusion) standalone report designerBold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via SVG Processing9.3 Critical
tomcatTuxCare,tomcat-admin-webappsTuxCare,tomcat-docs-webappTuxCare +5 more +7 moretomcat: Fix of 3 CVEsNo score- cure53 dompurifyDOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage5.1 Medium
- cure53 dompurifyDOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode2.3 Low
- juliangruber brace-expansionbrace-expansion DoS via unbounded expansion length causing an out-of-memory process crash7.5 High
- qtXML injection vulnerability in QDom comment, CDATA and processing-instruction serialization2.9 Low
- jetbrains teamcityIn JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible9.1 Critical
- jetbrains pycharmIn JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python...8.6 High
- jetbrains teamcityIn JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was...8.8 High
- wp chill modula image galleryWordPress Modula Image Gallery plugin 2.14.25-2.14.30 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- multivendorx woocommerce product stock alertWordPress WooCommerce Product Stock Alert plugin <= 3.0.6 - Sensitive Data Exposure vulnerability6.5 Medium
- mailpoetWordPress MailPoet plugin 5.30.0-5.33.0 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- getgrav gravGrav API Plugin 1.0.9 Privilege Escalation via Invitations groups8.7 High
- getgrav gravGrav API Plugin before 1.0.10 Path Traversal via move7.1 High
- getgrav gravGrav API Plugin before 1.0.10 Broken Access Control8.2 High
- getgrav gravGrav before 2.0.9 Remote Code Execution via FlexDirectory8.7 High
- siyuan-note siyuanSiYuan before v3.7.2 Path Traversal via /export/temp/7.1 High
- siyuan-note siyuanSiYuan before v3.7.2 Cross-Site Scripting to RCE9.4 Critical
- siyuan-note siyuanSiYuan before v3.7.2 Stored XSS to RCE via Attribute View9.4 Critical
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer...8.1 High
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote...8.6 High
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a...10.0 Critical
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote...10.0 Critical
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting...7.8 High
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification,...4.3 Medium
- jetbrains phpstormIn JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project...8.4 High
- jetbrains phpstormIn JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project...8.4 High
- jetbrains webstormIn JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied...7.8 High
- jetbrains webstormIn JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project...8.4 High
- jetbrains webstormIn JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project...8.4 High
- jetbrains webstormIn JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project...8.4 High
- jetbrains golandIn JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project...7.8 High
- jetbrains golandIn JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project...7.8 High
- jetbrains golandIn JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default3.5 Low
- billy bryant tabsWordPress Tabs plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- metin saraç popup for cf7 with sweet alertWordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- bimal rekhadiya kwayy html sitemapWordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability7.1 High
- nilo velez macheteWordPress Machete plugin <= 5.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- themeisle cyr to lat reloaded – transliteration of links and file namesWordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control vulnerability4.3 Medium
- mahdi yousefi افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری)WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin <= 4.4.5 - Cross Site Request Forgery (CSRF) vulnerability6.5 Medium
- takayuki miyauchi tinymce templatesWordPress TinyMCE Templates plugin <= 4.8.1 - Sensitive Data Exposure vulnerability4.3 Medium
- charlie etienne custom links in elementor image carouselWordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- wbolt.com smart seo toolWordPress Smart SEO Tool plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- persianscript persian woocommerce smsWordPress Persian Woocommerce SMS plugin <= 7.2.2 - SQL Injection vulnerability7.6 High
- themeum qubelyWordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability4.8 Medium
- templatespareWordPress TemplateSpare plugin <= 4.2.2 - Broken Access Control vulnerability4.3 Medium
- iqonic designs graphina – charts and graphs for elementorWordPress Graphina plugin <= 3.1.12 - Broken Access Control vulnerability5.3 Medium
- bannersky bsk pdf managerWordPress BSK PDF Manager plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- Show moreLoading…