CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- techjewel fluent support – helpdesk & customer support ticket systemFluent Support <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute6.4 Medium
- cozythemes cozy blocks – page builder for gutenberg editor & fse with 600+ patterns, 58 blocks & templatesCozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute6.4 Medium
- red hat openshift update service, quay 3 +1 moreQuay: ssrf in red hat quay notification webhooks (slack/generic)5.5 Medium
- unknown wowoptin: next-gen popup makerWowOptin < 1.4.38 - Unauthenticated Opt-in Deactivation and Template Row Injection7.5 High
- unknown cafehaus apiCAFEHAUS API <= 1.0.0 - Unauthenticated Arbitrary User Password Reset7.5 High
- unknown project management, bug and issue tracking pluginSoftware Issue Manager < 5.1.0 - Unauthenticated SQL Injection via Search Parameter9.1 Critical
- metagauss profilegridProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tampering via Missing Authorization3.8 Low
- metagauss profilegridProfileGrid < 5.9.9.7 - Subscriber+ Cross-User Private Message Thread Deletion and Tampering via Missing Authorization5.4 Medium
- metagauss profilegridProfileGrid < 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery6.5 Medium
- unknown paid membership plugin, ecommerce, user registration form, login form, user profile & restrict contentProfilePress < 4.16.18 - Unauthenticated Privilege Escalation via Registration Role Selection7.5 High
- rapid7 insight agent, insightvm, nexpose +2 moreRapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation7.8 High
- snowflake libsnowflakeclient, odbc driver, php pdo driver +2 moreMultiple Security Vulnerabilities in Snowflake libsnowflakeclient8.8 High
- eximExim before 4.99.5 allows .forward privilege escalation because force_command for a pipe...7.4 High
- eximExim before 4.99.5 allows directory traversal to access files outside of the spool area, and...8.4 High
- openstack zaqarOpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID...4.8 Medium
- openstack ironic python agentIn OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can...7.2 High
- openstack ironic python agentIn OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using...5.5 Medium
- zenml-io zenml-io/zenmlRate-limit Bypass in zenml-io/zenml6.5 Medium
- wpify woo – withdrawal, crn/vat, qr payments, heureka and more for woocommerceWPify Woo <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint8.0 High
- xnau participants databaseParticipants Database <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via 'id' Parameter5.3 Medium
- posimyththemes nexter blocks – gutenberg blocks, page builder & ai website builderNexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter4.3 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter5.3 Medium
- oyatek mapsvg – vector maps, image maps, google mapsMapSVG Lite <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- firelightwp firelight lightboxFirelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute6.4 Medium
- wpxpo post grid gutenberg blocks – postxPost Grid Gutenberg Blocks <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute6.4 Medium
- microsoft azure dnsAzure DNS Elevation of Privilege Vulnerability10.0 Critical
- microsoft azure key vaultAzure Key Vault Elevation of Privilege Vulnerability10.0 Critical
- microsoft exchange online, microsoft exchange online +1 moreMicrosoft Exchange Online Tampering Vulnerability10.0 Critical
- microsoft 365 copilotMicrosoft M365 Copilot Remote Code Execution Vulnerability9.9 Critical
- microsoft graphMicrosoft Graph Information Disclosure Vulnerability6.5 Medium
- microsoft azure api management (apim), azure api management +1 moreAzure API Management (APIM) Remote Code Execution Vulnerability8.0 High
- linux, linux kernel +1 moreKVM: x86: Check for invalid/obsolete root *after* making MMU pages available8.8 High
- apache opennlpApache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML5.6 Medium
- networkupstools nutupsmon: remote OS command injection (RCE) via attacker-controlled ups.alarm in NOTIFYCMD execution8.1 High
- microsoft azure red hat openshift (aro), azure red hat openshift +1 moreAzure Red Hat OpenShift (ARO) Elevation of Privilege Vulnerability9.1 Critical
- microsoft accountMicrosoft Account Remote Code Execution Vulnerability9.8 Critical
- microsoft surface management servicesMicrosoft Surface Remote Code Execution Vulnerability9.9 Critical
- microsoft azure ai searchAzure AI Search Elevation of Privilege Vulnerability8.5 High
dotnet8-runtimeAlpaquitaNo score- ne-lexa php-zipNe-Lexa php-zip ZIP ZipFile.php extractTo path traversal6.9 Medium
- pronetiqs panduit intravueExposure of Sensitive System Information to an Unauthorized Control Sphere in Panduit IntraVUE by Pronetiqs9.2 Critical
- pronetiqs panduit intravueInadequate Encryption Strength in Panduit IntraVUE by Pronetiqs7.6 High
- pronetiqs panduit intravueExposure of Sensitive System Information to an Unauthorized Control Sphere in Panduit IntraVUE by Pronetiqs6.9 Medium
- pronetiqs panduit intravueUnintended Proxy or Intermediary in Panduit IntraVUE by Pronetiqs10.0 Critical
- pronetiqs panduit intravuePlaintext Storage of a Password in Panduit IntraVUE by Pronetiqs8.7 High
- codeastro online classroomCodeAstro Online Classroom loginlinkadmin.php sql injection6.9 Medium
- google chromeUse after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to...8.8 High
- google chromeUse after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who...8.3 High
- google chromeOut of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote attacker...8.8 High
- google chromeUse after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to...8.8 High
- Show moreLoading…