CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- linux, linux kernel +1 moreKVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier4.7 Medium
- linux, linux kernel +1 moresvcrdma: wake sq waiters when the transport closes7.5 High
- linux, linux kernel +1 morefpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()8.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morei2c: core: fix adapter deregistration race7.8 High
- linux, linux kernel +1 morei2c: imx-lpi2c: mark I2C adapter when hardware is powered down5.5 Medium
- linux, linux kernel +1 moreInput: synaptics-rmi4 - bound the F3A keymap to the GPIO count7.8 High
- linux, linux kernel +1 moreInput: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count7.8 High
- linux, linux kernel +1 moreInput: elan_i2c - prevent division by zero and arithmetic underflow5.5 Medium
- linux, linux kernel +1 moreInput: goodix - clamp the device-reported contact count7.8 High
- linux, linux kernel +1 moreInput: iforce - bound the device-reported force-feedback effect index7.8 High
- linux, linux kernel +1 moreInput: mms114 - fix touch indexing for MMS134S and MMS1367.8 High
- linux, linux kernel +1 moreInput: touchwin - reset the packet index on every complete packet7.8 High
- linux, linux kernel +1 moreInput: mms114 - reject an oversized device packet size7.8 High
- linux, linux kernel +1 moreRDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg9.1 Critical
- linux, linux kernel +1 moreRDMA/siw: bound Read Response placement to the RREAD length9.8 Critical
- linux, linux kernel +1 morefuse: avoid 32-bit prune notification count wrap5.5 Medium
- linux, linux kernel +1 morefuse: re-lock request before returning from fuse_ref_folio()7.8 High
- linux, linux kernel +1 morefuse: clear intr_entry in fuse_resend and fuse_remove_pending_req7.8 High
- linux, linux kernel +1 morefuse-uring: fix EFAULT clobber in fuse_uring_commit5.5 Medium
- linux, linux kernel +1 morefuse-uring: fix moving cancelled entry to ent_in_userspace list5.5 Medium
- linux, linux kernel +1 morefuse-uring: end fuse_req on io-uring cancel task work5.5 Medium
- linux, linux kernel +1 morefuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues7.8 High
- linux, linux kernel +1 morefuse-uring: Avoid queue->stopped races and set/read that value under lock7.8 High
- linux, linux kernel +1 morefuse-uring: make a fuse_req on SQE commit only findable after memcpy7.8 High
- linux, linux kernel +1 morefuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref5.5 Medium
- linux, linux kernel +1 moresmb: client: reject overlapping data areas in SMB2 responses9.1 Critical
- linux, linux kernel +1 morexfs: don't wrap around quota ids in dqiterate5.5 Medium
- rrwo catalyst::view::wkhtmltopdfCatalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options9.8 Critical
- wpforms proWPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering8.1 High
- yoast seo – advanced seo with real-time guidance and built-in aiYoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)6.4 Medium
- themehigh checkout field editor for woocommerce (pro)Checkout Field Editor for WooCommerce (Pro) <= 3.7.7 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'thwcfe_legacy_file' Parameter6.5 Medium
LibSSHJuliaWriting to SFTP files resulting in sending out-of-bounds data to the server3.9 Low- nic knot resolverKnot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the...8.1 High
- redisRedis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE,...7.5 High
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()5.4 Medium
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()6.5 Medium
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels6.5 Medium
- etcd-io etcdetcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline8.7 High
@frontmcp/adaptersnpmFrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller5.9 Medium- getkin kin-openapikin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema5.3 Medium
- etcd-io etcdetcd: Watch API authorization bypass via open-ended range requests7.1 High
- libp2p py-libp2ppy-libp2p: yamux connection DoS via oversized data frame7.5 High
- quasarframework quasarQuasar Framework: Prototype pollution in Quasar extend() utility5.6 Medium
- jandedobbeleer oh-my-poshOh My Posh: Arbitrary command execution via template injection in the path segment7.8 High
- jandedobbeleer oh-my-poshOh My Posh: Terminal escape sequence injection via unsanitized prompt segment data6.1 Medium
- omnifacesOmniFaces: Forged combined-resource IDs and related output/push boundaries8.2 High
- ericcornelissen shescapeShescape: Quadratic-time denial of service in flag-protection8.7 High
- ericcornelissen shescapeShescape: Home-directory disclosure in assignment context on Unix with Dash6.3 Medium
- ericcornelissen shescapeShescape: Shell injection via unescaped parentheses on Windows with CMD9.2 Critical
- ericcornelissen shescapeShescape: Path disclosure on Unix with Zsh6.3 Medium
- Show moreLoading…