CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- apache thriftApache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()6.9 Medium
- apache thriftApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()8.7 High
- apache thriftApache Thrift: Node.js quadratic-time DoS in server receive transports8.7 High
- apache thriftApache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb7.5 High
- apache thriftApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit8.7 High
- apache thriftApache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass8.2 High
- apache thriftApache Thrift: c_glib TLS Client Missing Hostname Verification9.1 Critical
- apache thriftApache Thrift: Unbounded Read Leading to Denial of Service6.9 Medium
- apache thriftApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit8.7 High
- apache thriftApache Thrift: Unbounded Zlib Decompression in Python THeaderTransport7.5 High
- mercusys mb115-4gStack-Based Buffer Overflow in the Mercusys MB115-4G5.3 Medium
- asseco procertum smartsignImproper Restriction of XML External Entity Reference in proCertum SmartSign4.8 Medium
- asseco procertum smartsignArbitrary Path Execution via CPS URI in proCertum SmartSign4.6 Medium
- media manager tastyigniterStored Cross-Site Scripting (XSS) in TastyIgniter Media Manager6.3 Medium
- zte blade a75 5gPath Traversal Vulnerability in ZTE Blade A75 5G1.8 Low
- red hat container native virtualization 4.14, container native virtualization 4.16, container native virtualization 4.17 +6 more +8 moreVirt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/source, allowing unauthorized pvc clone7.7 High
- moonshotai kimi codeKimi Code FetchURL SSRF protection bypass via DNS-resolving hostnames and redirects5.5 Medium
- linux, linux kernel +1 morecan: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet7.8 High
- cjson project cjsonInteger Overflow Leading to Heap Buffer Overflow in cJSON5.1 Medium
- phoca.cz phoca commander extension for joomlaJoomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.16.9 Medium
- phoca.cz phoca commander extension for joomlaJoomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.1.15.1 Medium
- cp-plus ez-p21 ip cameraImproper Authentication Vulnerability in CP PLUS EZ-P21 IP Camera8.7 High
- cp-plus ez-p21 ip cameraArbitrary Code Execution Vulnerability in CP PLUS EZ-P21 IP Camera7.0 High
- lenze c430, c520, c550 +2 more +4 moreSSH Enablement Signature Verification Bypass8.5 High
- linuxstaging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop8.1 High
- linuxnvmet-tcp: Fix potential UAF when ddgst mismatch9.8 Critical
- linuxnvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path9.8 Critical
- linuxfs/ntfs3: validate lcns_follow in log_replay conversion7.8 High
- linux, linux kernel +1 morefs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}7.8 High
- linux, linux kernel +1 morenet: openvswitch: reject oversized nested action attrs7.8 High
- unknown bookingpress-appointment-booking-proBookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug8.2 High
- humhub calendarCalendar < 1.3.18 - Contributor+ Stored XSS via event_link Parameter6.8 Medium
- unknown quiz and survey master (qsm)Quiz And Survey Master < 11.1.3 - Unauthenticated User Enumeration and Password Oracle via Quiz Login5.3 Medium
- unknown user frontend: ai powered frontend post submission, user directory, user profile, membership & user registrationWP User Frontend < 4.3.8 - Unauthenticated Author-less Attachment Deletion6.5 Medium
- unknown facturaone para woocommerce con verifactuWP FacturaONE < 5.37 - Unauthenticated Remote Code Execution9.0 Critical
- takayukister contact form 7Contact Form 7 – PayPal & Stripe Add-on < 2.5 - Open Redirect4.7 Medium
- codename065 download managerWordPress Download Manager < 3.3.62 - Unauthorized Protected File Download via Reusable Download Key7.5 High
- unknown smart managerSmart Manager < 8.92.0 - Contributor+ Stored XSS via Post Title4.8 Medium
- shaonsina sina extension for elementorSina Extension for Elementor < 3.10.2 - Reflected XSS6.1 Medium
- unknown wpbotWPBot AI ChatBot < 8.5.2 - Admin+ Second-Order SQL Injection via qc_bot_str_fields3.8 Low
- themeisle mpgMultiple Page Generator Plugin – MPG < 4.1.8 - Reflected XSS via mpg_shortcode7.1 High
- unknown realtyna organic idx plugin + wpl real estateRealtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution9.8 Critical
- unknown 微信二维码登陆QRcode Login for WeChat <= 1.3 - Unauthenticated Account Takeover9.1 Critical
- nsquared simply schedule appointmentsSimply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer Information6.1 Medium
- stellarwp the events calendarThe Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status Manipulation5.3 Medium
- unknown masteriyo lmsMasteriyo LMS < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service)9.1 Critical
- silverplugins217 custom fields account registration for woocommerceCustom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege Escalation8.1 High
- dan rossiter document galleryDocument Gallery < 5.1.1 - Reflected XSS via dg_generate_gallery6.1 Medium
- elbanyaoui clover payment gateway by zaytech for woocommerceClover Payment Gateway by Zaytech for WooCommerce < 1.3.6 - Unauthenticated Payment Bypass via check_order7.5 High
- unknown memberglutMemberGlut < 1.1.5 - Unauthenticated Privilege Escalation to Administrator9.8 Critical
- Show moreLoading…