CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- zephyrproject zephyrDivision by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image4.6 Medium
- red hat build of keycloak, build of keycloak 26.6, build of keycloak 26.6.6 +3 more +5 moreKeycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api5.5 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreAccountsservice: accountsservice: arbitrary file read via seticonfile for systemd-homed users5.5 Medium
- abis technology ltd. co. avesisImproper Access Control in Abis Technology's AVESİS5.3 Medium
- grafana irmCVE-2026-9765 CVE Record7.1 High
- apache nimbleApache NimBLE: Mesh Proxy SAR reassembly unbounded append and unchecked failure5.3 Medium
- apache nimbleApache NimBLE: NULL pointer dereference vulnerability in SMP LTK request7.5 High
- apache nimbleApache NimBLE: Remote reachable assertion in ATT Read Multiple Variable Response handler7.5 High
- apache nimbleApache NimBLE: Incorrect data validation in BASS add/modify source operation8.8 High
- apache nimbleApache NimBLE: OOB Read via sizeof(pointer) in Legacy Advertising Report Handler6.5 Medium
- apache nimbleApache NimBLE: Buffer overflow in socket HCI transport7.5 High
- apache neethiApache Neethi: Remote PolicyReference fetch lacks resource bounds7.5 High
- parse-community parse-serverParse Server 9.0.0 Information Disclosure via GraphQL Error Messages6.3 Medium
- parse-community parse-serverParse Server 9.0.0 Information Disclosure via GraphQL Error Messages6.3 Medium
- apache neethiApache Neethi: Missing global alternative-output budget across policy computation paths7.5 High
- apache neethiApache Neethi: Uncontrolled recursion in policy processing7.5 High
- apereo jasig cas client, java apereo cas client +1 moreImproper Validation of Certificate in CAS Client7.4 High
- red hat enterprise linux 10, enterprise linux 9, hardened images +3 more +5 moreDbus-broker: dbus-broker: session bus denial of service via emfile during peer setup5.5 Medium
- eset spol. s.r.o. cyber security for macos, endpoint security for macos, eset, spol. s r.o. eset endpoint security for macos +2 moreLocal privilege escalation in ESET security applications for macOS8.5 High
- fluidsynthFluidSynth: DLS ptbl Chunk Integer Overflow6.8 Medium
- fluidsynthFluidSynth: DLS Articulation Chunk Integer Overflow6.8 Medium
- fluidsynthFluidSynth: Heap-based buffer overrun for DLS samples8.0 High
- fluidsynthFluidSynth: SF2 DMOD Chunk Unsigned Underflow6.2 Medium
- fluidsynthFluidSynth: Heap Buffer Overflow in MIDI Player7.8 High
- imagemagickImageMagick: Heap Buffer Over-Write in fx operation5.0 Medium
- imagemagickImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided4.7 Medium
- google cloud lookerCross-Site Scripting (XSS) in Looker allows Admin Account Takeover8.7 High
- eset spol. s.r.o. cyber security for macos, endpoint security for macos, eset, spol. s r.o. eset endpoint security for macos +2 moreLocal privilege escalation in ESET security applications for macOS8.5 High
- kstover ninja forms – the contact form builder that grows with youNinja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key4.9 Medium
- eventon action userEventON Action User <= 2.5.14 - Missing Authorization to Unauthenticated Privilege Escalation via evoau_save_capability AJAX Action7.3 High
- e4jvikwp vikbooking hotel booking engine & pmsVikBooking Hotel Booking Engine & PMS <= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Parameter7.2 High
- felipe toml::xsTOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc999.8 Critical
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 07.8 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex()7.8 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed7.8 High
- octopus serverIn affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows...5.1 Medium
- sunnet technology co., ltd. corporate training management systemSUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type9.3 Critical
- e4jvikwp vikbooking hotel booking engine & pmsVikBooking Hotel Booking Engine & PMS <= 1.8.13 - Reflected Cross-Site Scripting via 'category_id' Parameter6.1 Medium
- richplugins rich showcase for google reviewsRich Showcase for Google Reviews <= 6.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pagination' Shortcode Attribute6.4 Medium
- brainstormforce suredash – community, courses & member dashboardSureDash <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- gnu coreutilsHeap-based Buffer Overflow in GNU coreutils1.8 Low
- gnu coreutilsOut‑of‑bounds Read in GNU coreutils4.6 Medium
- eclipse foundation basyx go componentsCWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components9.8 Critical
- geovision inc. gv-ip device utilityGeoVision GV-IP Device Utility DLL Search Order Hijacking Vulnerability7.3 High
- themeisle visualizer – tables & charts manager with built-in ai generatorVisualizer <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'backend-title' Parameter6.4 Medium
- thimpress wp hotel bookingWP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute6.4 Medium
- berocket brands for woocommerceBrands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute6.4 Medium
- paymentplugins payment plugins for stripe woocommercePayment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Secret5.3 Medium
- 100plugins open user map – interactive leaflet mapsOpen User Map <= 1.4.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- cozythemes cozy blocks – page builder for gutenberg editor & fse with 600+ patterns, 58 blocks & templatesCozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute6.4 Medium
- Show moreLoading…