CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- openlistteam openlistOpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API6.5 Medium
- openlistteam openlistOpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search4.3 Medium
- openlistteam openlistOpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal7.6 High
- http4s blazehttp4s-blaze-server: Unbounded WebSocket message aggregation7.5 High
- http4s blazeblaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)7.4 High
- http4s blaze, org.http4s blaze-http 2.13, blaze-http 3 +1 more +3 moreblaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser7.4 High
- weintek cmt3092x firmware, easyweb +1 moreWeintek cMT3092X Reliance on Cookies without Validation and Integrity Checking in a Security Decision8.7 High
- weintek cmt3092x firmware, easyweb +1 moreWeintek cMT3092X Incorrect Permission Assignment for Critical Resource8.7 High
- weintek cmt3092x firmware, easyweb +1 moreWeintek cMT3092X Plaintext Storage of a Password7.1 High
- weintek cmt3092x firmware, easyweb +1 moreWeintek cMT3092X Incorrect User Management7.1 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset9.8 Critical
poweradmin/poweradminPackagistPoweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover8.1 Highpoweradmin/poweradminPackagistPoweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own8.1 Highpoweradmin/poweradminPackagistPoweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account8.8 Highpheditor/pheditorPackagistPheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password10.0 Critical- juneandgreen sm-cryptosm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock9.1 Critical
- cloudreveCloudreve before 4.17.0 SSRF via Admin.Read OAuth scope5.3 Medium
- vantage6vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review7.1 High
hubuum_clientcrates.ioHubuum client library (Rust): Sensitive data may be exposed through default diagnostics2.3 Lowhubuum_clientcrates.ioHubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic6.3 Mediumhubuum_clientcrates.ioHubuum client library (Rust): Authenticated requests may escape the configured base path through redirects6.3 Medium- fatedier frpfrp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow8.7 High
- anephenix hubHub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion7.5 High
github.com/zxh326/kiteGoKite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources6.5 Medium- openidentityplatform opendjOpenDJ: Authorization bypass in SASL PLAIN allowing a `proxied-auth` holder to impersonate any resolvable non-root user without an ACI proxy grant9.6 Critical
org.openidentityplatform.opendj:opendj-dsml-servletMavenOpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway9.4 Criticalpheditor/pheditorPackagistPheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes8.8 High- gitpython-developers gitpythonGitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()8.7 High
- budibaseBudibase: SSRF via bare fetch() in uploadUrl during AI table generation4.9 Medium
- budibaseBudibase: SSRF via DNS rebinding in the REST datasource integration8.5 High
- budibase serverBudibase before 3.40.0 NoSQL Injection via MongoDB datasource7.1 High
- budibaseBudibase: Account Enumeration via Login Lockout Response Differential5.3 Medium
- budibase serverBudibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF8.7 High
- tycon systems tpdin-monitor-web2Tycon Systems TPDIN-Monitor-WEB2 Missing Authentication for Critical Function9.3 Critical
- tycon systems tpdin-monitor-web2Tycon Systems TPDIN-Monitor-WEB2 Cleartext Storage of Sensitive Information5.3 Medium
- budibaseBudibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector7.6 High
- budibase serverBudibase Server before 3.40.0 NoSQL Injection via JSON Parameter8.7 High
- budibaseBudibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders5.7 Medium
- budibaseBudibase: Unauthenticated user information disclosure via public tenant user lookup endpoint7.5 High
- budibaseBudibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-48152))9.0 Critical
- cloudreveCloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored6.3 Medium
- budibaseBudibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified9.0 Critical
- budibase serverBudibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST8.4 High
- budibase serverBudibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL8.3 High
- budibaseBudibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile5.1 Medium
- budibaseBudibase: SQL Injection via `multipleStatements: true`9.6 Critical
- budibaseBudibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)8.2 High
- budibaseBudibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users4.9 Medium
- budibaseBudibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings4.3 Medium
- budibaseBudibase: Privilege escalation via public role assignment API missing app-level authorization8.8 High
- Show moreLoading…