CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- mainwp child, unknown mainwp child +1 moreMainWP Child < 6.1.2 - Unauthenticated Administrator Authentication Bypass via Passwordless Site Registration8.1 High
- monetizemore advanced adsAdvanced Ads – Ad Manager & AdSense < 2.0.23 - Contributor+ Stored XSS via the_ad Shortcode 'ad_args' Parameter6.1 Medium
- printcart web to print product designer for woocommerce, unknown printcart web to print product designer for woocommerce +1 morePrintcart Web to Print Product Designer for WooCommerce < 2.5.3 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery8.6 High
- leantimeLeantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC7.1 High
- xmlrpc-cXMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting...8.2 High
- ggml-org llama.cppggml-org llama.cpp JSON-Schema-to-GBNF Conversion json-schema-to-grammar.cpp transform recursion6.9 Medium
- ggml-org llama.cppggml-org llama.cpp json-schema-to-grammar.cpp _visit_pattern null pointer dereference6.9 Medium
- No product listedCross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php in Milk admin <=0.9.8...6.1 Medium
- No product listedAn issue in the redirect parameter in Milk admin <=0.9.8 allows remote attackers to redirect...4.9 Medium
- No product listedAn issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the...7.5 High
- No product listedSQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive...7.5 High
ansibleDebian,ansible-coreUbuntu +1 more[Unknown description]No score- the libreswan project libreswanFIPS mode assertion failure via malicious CERT payload7.5 High
opensbiDebian,qemuAzure Linux +1 moreAn issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via...7.5 High- No product listedSQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in...9.1 Critical
- quest kace systems management applianceAn issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API...9.8 Critical
- quest kace systems management applianceAn issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs...8.8 High
- quest kace systems management applianceAn issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a...9.8 Critical
- quest kace systems management applianceAn issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs...8.8 High
- quest kace systems management applianceAn issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. If a customer...9.8 Critical
qemuAlpaquita,qemu-hweUbuntu +1 moreqemu security update8.2 HighqemuAlpaquita,qemu-hweUbuntu +1 moreqemu security update8.2 HighqemuAlpaquita,qemu-hweUbuntu +1 moreqemu security update8.2 HighqemuAlpaquita,qemu-hweUbuntu +1 moreqemu security update8.2 HighqemuAlpaquita,qemu-hweUbuntu +1 moreqemu security update8.2 HighqemuAlpaquita,qemu-hweUbuntu +1 moreqemu security update8.2 HighqemuAlpaquita,qemu-hweUbuntu +1 moreqemu security update8.2 High- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Information Disclosure Vulnerability7.4 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Information Disclosure Vulnerability7.4 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability5.4 Medium
- codexu notegenNoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python8.3 High
- codexu notegenNoteGen chat preview XSS via unsanitized AI/skill HTML rendering8.1 High
nostrcrates.ioRemote Denial of Service via malformed NIP-04 IV7.5 High- dji sparkperwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink5.3 Medium
- mf-yang openclaw-cnmf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery5.3 Medium
- mf-yang openclaw-cnmf-yang openclaw-cn Scheme navigation-guard.ts assertBrowserNavigationAllowed information disclosure5.3 Medium
- linuxnet: nexthop: Increase weight to u167.8 High
- linux, linux kernel +1 morenet/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle9.8 Critical
- koxudaxi datamodel-code-generatordatamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field7.5 High
- nanocoai nanoclawnanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization5.3 Medium
- nanocoai nanoclawnanocoai NanoClaw MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorization4.8 Medium
- techjewel fluent forms pro add on packFluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field8.8 High
- nousresearch hermes-agentNousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control2.3 Low
- valkey-io valkeyValkey: UAF in stream deserialization may lead to remote code execution8.8 High
- valkey-io valkeyValkey: TLS pending-data processing use-after-free may allow remote code execution7.5 High
openssl-3SUSESecurity update for openssl-3No scoreopenssl-3SUSESecurity update for openssl-3No scoreopenssl-3SUSESecurity update for openssl-3No scoreopenssl-3openSUSESecurity update for openssl-3No score- zephyrproject zephyrSMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slot6.5 Medium
- Show moreLoading…