CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- roxnor fundengineWordPress FundEngine plugin <= 1.7.8 - Broken Access Control vulnerability6.5 Medium
- themewant rt mega menu – mega menu builder for elementor & gutenbergWordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpdevelop booking calendarWordPress Booking Calendar plugin <= 11.4.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- franky events made easyWordPress Events Made Easy plugin <= 3.1.3 - Broken Access Control vulnerability6.5 Medium
- acowebs dynamic pricing with discount rules for woocommerceWordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.11 - Cross Site Scripting (XSS) vulnerability7.1 High
- rextheme product feed managerWordPress Product Feed Manager plugin <= 7.6.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- shahadat hossain 3d flipbook pdf viewer & embedderWordPress 3D Flipbook PDF Viewer & Embedder plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability7.2 High
- rtcamp rtmedia for wordpress, buddypress and bbpressWordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability8.5 High
- strategy11 team awp classifiedsWordPress AWP Classifieds plugin <= 4.4.7 - SQL Injection vulnerability9.3 Critical
- rtcamp rtmedia for wordpress, buddypress and bbpressWordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability9.3 Critical
- byteflows travel & hotel bookingWordPress Byteflows Travel & Hotel Booking plugin <= 1.0.0 - Sensitive Data Exposure vulnerability7.5 High
- john darrel hide my wp ghostWordPress Hide My WP Ghost plugin <= 7.0.06 - 2FA Bypass vulnerability7.4 High
- cozmoslabs paid member subscriptionsWordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability7.5 High
- ruben garcia gamipressWordPress GamiPress plugin <= 7.9.7 - SQL Injection vulnerability9.3 Critical
- sender – newsletter, sms and email marketing automation for woocommerceWordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.10.22 - SQL Injection vulnerability7.6 High
- cocart headless – headless ecommerceWordPress CoCart – Headless ecommerce plugin <= 4.8.4 - Broken Access Control vulnerability7.5 High
- thrive themes coupon product managerWordPress Thrive Product Manager plugin <= 10.9.2 - Broken Access Control vulnerability7.3 High
- aurovrata venet post my cf7 formWordPress Post My CF7 Form plugin <= 6.2.0 - Broken Access Control vulnerability7.5 High
- christoph vielgrader relevanssi lightWordPress Relevanssi Light plugin <= 1.2.2 - SQL Injection vulnerability9.3 Critical
- magepeopleteam booking and rental managerWordPress Booking and Rental Manager plugin <= 2.7.2 - Price Manipulation vulnerability7.5 High
- anh tran falcon – wordpress optimizations & tweaksWordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.10.0 - Unknown vulnerability7.5 High
- payment plugins stripe for woocommerce, stripe for woocommerce for woocommerce +1 moreWordPress Stripe For WooCommerce plugin <= 4.0.7 - Broken Access Control vulnerability7.5 High
- motov.net ebook storeWordPress Ebook Store plugin <= 6.19 - Sensitive Data Exposure vulnerability7.5 High
- shiptime shiptime: discounted shipping ratesWordPress ShipTime: Discounted Shipping Rates plugin <= 1.1.1 - Sensitive Data Exposure vulnerability7.5 High
- romancode mapsvgWordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability9.3 Critical
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreBinutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service5.6 Medium
- zjonsson node-unzipperZJONSSON node-unzipper extract.js Extract path traversal4.8 Medium
- joomshaper.com sp page builder extension for joomlaJoomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.09.2 Critical
- joomshaper.com sp page builder extension for joomlaJoomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.18.2 High
- joomshaper.com sp page builder extension for joomlaJoomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.19.8 Critical
- joomshaper.com sp page builder extension for joomlaJoomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.19.2 Critical
- joomshaper.com sp page builder extension for joomlaJoomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.18.3 High
- ggml-org whisper.cppggml-org whisper.cpp ggml.c ggml_ftype_to_ggml_type assertion4.8 Medium
- vbulletinvBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php9.3 Critical
- ggml-org whisper.cppggml-org whisper.cpp log_mel_spectrogram out-of-bounds4.8 Medium
- progress ecs connection manager, loadmaster, progress software moveit waf +5 more +7 moreProgress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST API8.0 High
- progress ecs connection manager, loadmaster, progress software moveit waf +3 more +5 moreProgress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF Improper Authorization Allows Privilege Escalation to Root8.0 High
- progress ecs connection manager, loadmaster, progress software moveit waf +3 more +5 moreProgress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Backup Restore Functionality8.4 High
- progress ecs connection manager, loadmaster, progress software moveit waf +3 more +5 moreProgress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Geo Location Management Interface8.4 High
- progress ecs connection manager, loadmaster, progress software moveit waf +3 more +5 moreProgress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Management Interface8.4 High
- hclsoftware connectionsHCL Connections is vulnerable to information disclosure3.5 Low
- hclsoftware connectionsHCL Connections is vulnerable to information disclosure3.5 Low
- ghost robotics vision 60Multiple vulnerabilities in Ghost Robotics' Vision 608.7 High
- ghost robotics vision 60Multiple vulnerabilities in Ghost Robotics' Vision 607.7 High
- ghost robotics vision 60Multiple vulnerabilities in Ghost Robotics' Vision 608.7 High
- apache thriftApache Thrift: Python TSSLSocket Hostname Matcher Import5.9 Medium
- apache thriftApache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass8.7 High
- apache thriftApache Thrift: Rust binary protocol non-strict path missing string size limit8.7 High
- apache thriftApache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path6.9 Medium
- apache thriftApache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()9.3 Critical
- Show moreLoading…