CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- owap defectdojoOWASP DefectDojo API/Web serializers.py UserSerializer privileges management5.3 Medium
- microweberMicroweber CMS 2.0.20 Path Traversal via ServeStaticFileController8.7 High
- zalando skipperSkipper Incomplete Fix for CVE-2026-50197 Policy Bypass8.8 High
- decolua 9router9router before 0.4.60 Remote Code Execution via default password9.4 Critical
- decolua 9router9Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetch8.3 High
- calcom cal.diyCal.com before 5.9.9 Remote Code Execution via RSC10.0 Critical
- calcom cal.diycal.com Repository Takeover via pull_request_target Workflow8.5 High
- calcom cal.diyCal.com through 4.7.15 Cross-Site Scripting via booking questions9.3 Critical
- calcom cal.diyCal.com through 4.7.15 Cross-Site Scripting via booking questions9.3 Critical
- localstack serverless-localstacklocalstack serverless-localstack Configuration index.js os command injection4.8 Medium
- silicon labs matter githubWeak entropy initialization in Silicon Labs Matter SiWx917 TinyCrypt path8.7 High
- mz automation lib60870Out-of-bounds Read in MZ Automation lib608708.8 High
- mz automation libiec61850NULL Pointer Dereference in MZ Automation libIEC618508.7 High
- mz automation libiec61850Improper Handling of Syntactically Invalid Structure in MZ Automation libIEC618507.1 High
- mz automation libiec61850Stack-based Buffer Overflow in MZ Automation libIEC618509.2 Critical
- cyberlord92 saml single sign on – sso loginSAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter9.8 Critical
- mz automation libiec61850Stack-based Buffer Overflow in MZ Automation libIEC618508.7 High
- johnson controls victor webvictor Web - Priviledge Escalation7.1 High
- johnson controls ccure 9000 and victor application serverCCure and Victor Application Server - Server Side Request Forgery7.2 High
- johnson control victor, johnson controls ccure 9000, victor application server +2 moreC-CURE 9000 and Victor application server - Deserialization of Untrusted Data8.7 High
- aws bedrock-agentcore 1.18.1Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()8.4 High
- progress moveit transferStored XSS vulnerability in MOVEit Transfer7.1 High
- progress moveit transferMOVEit Transfer refresh-token processing does not enforce updated account restrictions7.5 High
- progress moveit transferImproper CORS handling in MOVEit Transfer7.5 High
- casdoorCVE-2026-156309.9 Critical
- progress moveit transferMFA Bypass in MOVEit Transfer7.5 High
- wpo365 | seamless wordpress + microsoft integration (wpo365 | login)WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 43.2 - Cross-Site Request Forgery to Privilege Escalation via Plugin Settings Update8.8 High
- @tanstack react-routerReact Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)5.1 Medium
- @tanstack react-routerReact Router: Open redirect can lead to XSS6.9 Medium
- @tanstack react-routerReact Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667)6.9 Medium
- @tanstack react-routerReact Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration6.1 Medium
- delvedor find-my-wayfind-my-way is Vulnerable to DDoS with HTTP27.5 High
- gpsdgpsd gpsprof Code Injection via SKY.satellites used Field8.5 High
- red hat certificate system 9, enterprise linux 10, enterprise linux 8 +1 more +3 moreRhcs: memory leak during https connection leads to denial of service5.3 Medium
- ffmpegFFmpeg 3.0 - 8.1.2 vf_swaprect Out-of-Bounds Write via NV12 Frame Processing8.5 High
- ffmpegFFmpeg 3.4 - 8.1.2 vf_floodfill Out-of-Bounds Write via filter_frame()7.3 High
- ffmpegFFmpeg 8.1.2 Out-of-Bounds Write via TY Demuxer and Shorten Decoder7.3 High
- ffmpegFFmpeg 2.7 - 8.1.2 Out-of-Bounds Write in TDSC Video Decoder8.5 High
- apple swift-nio-http2, swiftnio http\/2 +1 moreswift-nio-http2: Missing CR/LF/NUL validation in header values5.3 Medium
- appriss insights victim information notification exchange (vine), equifax victim information notification exchange +1 moreAppriss Insights VINE SQLI9.3 Critical
- kubernetes kubernetes-client/javaPath traversal via non-tar copyDirectoryFromPod2.7 Low
- aws aws-smithy-http-serverAllocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service8.7 High
- huggingface datasetsDatasets Symlink-following Arbitrary File Write via Extractor.extract()4.4 Medium
- chatwootChatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creation8.8 High
- huggingface diffusersDiffusers Path Traversal via weight_map Arbitrary File Read5.3 Medium
- mesheryMeshery < 1.0.57 Unauthenticated Arbitrary File Read via fileView and fileDownload8.7 High
- linuxfoundation torchvision, pytorch vision +1 morePyTorch torchvision GIF Decoder Out-of-bounds Heap Read7.1 High
- work90210 apifoldAPIFold Vulnerable to Unauthenticated Webhook Event Injection5.3 Medium
- zohocorp manageengine adaudit plusRemote Code Execution10.0 Critical
- vanna-ai vannaVanna 2.0.2 Path Traversal via FileSystemConversationStore8.8 High
- Show moreLoading…