CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- taskbuilder – project management & task management tool with kanban boardTaskbuilder <= 5.0.9 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- themetechmount truebooker – appointment booking and scheduler systemTrueBooker <= 1.2.2 - Unauthenticated SQL Injection7.5 High
- codename065 premium packages – sell digital products securelyPremium Packages <= 6.2.0 - Unauthenticated SQL Injection7.5 High
- ladela online scheduling and appointment booking system – booklyOnline Scheduling and Appointment Booking System <= 27.5 - Unauthenticated SQL Injection7.5 High
- thewp digital solutions news theme v8Reflected XSS in theWP's News Theme V86.1 Medium
- eshare eshareproBypass of application rate-limiting mechanism3.3 Low
- bouncycastle bc-javaML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash)8.2 High
- epsiloncool wp fast total search – the power of indexed searchWP Fast Total Search <= 1.80.280 - Unauthenticated SQL Injection7.5 High
flywayOSS-FuzzSecurity exception in com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternalNo score- dassault systèmes station launcher app in 3dexperience platformDeserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x10.0 Critical
mrab-regexPyPIUNKNOWN READ in bytes1_char_atNo scorelibiec61850OSS-FuzzHeap-buffer-overflow in parseGoosePayloadNo scoreassimpOSS-FuzzHeap-buffer-overflow in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<chNo scoremrab-regexPyPIUNKNOWN READ in _regex.cpython-311-x86_64-linux-gnu.soNo scorejavaparserOSS-FuzzSecurity exception in com.github.javaparser.ast.expr.FieldAccessExpr.acceptNo scoremrab-regexPyPIUNKNOWN READ in bytes1_char_atNo scoreshadercOSS-FuzzSegv on unknown address in glslang::TPpContext::tokenPasteNo scorememcachedMageiaUpdated memcached packages fix security and other issuesNo scorelibjpeg-turboOSS-FuzzUNKNOWN READ in jpeg_abortNo score- rubengc gamipress – gamification plugin to reward points, achievements, badges & ranks in wordpressGamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute6.4 Medium
- cozyvision1 sms alert – sms & otp for woocommerce, order notifications & abandoned cart recoverySMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' Settings4.4 Medium
- cozyvision1 sms alert – sms & otp for woocommerce, order notifications & abandoned cart recoverySMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter4.9 Medium
- cozyvision1 sms alert – sms & otp for woocommerce, order notifications & abandoned cart recoverySMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter4.9 Medium
- cozyvision1 sms alert – sms & otp for woocommerce, order notifications & abandoned cart recoverySMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter9.8 Critical
- unknown fluentcart a new era of ecommerceFluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR4.2 Medium
- unknown tablesome tableTablesome < 1.1.31 - Unauthenticated Post Creation and Modification7.5 High
- crmperks database for contact form 7, wpforms, elementor formsDatabase for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id7.1 High
- unknown quiz and survey master (qsm)Quiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Template Deletion2.7 Low
- theeventscalendar event tickets and registrationEvent Tickets < 5.28.4 - Editor+ Stored XSS via Ticket Move3.5 Low
- themetechmount truebookerTrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset9.8 Critical
- devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement pluginShopLentor <= 3.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter4.9 Medium
- nasirahmed advanced form integration — connect forms to 200+ appsAdvanced Form Integration <= 2.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite via auth_redirect() Function4.3 Medium
- wordplus better messages – chat rooms, group chat, private messages & ai chat botsBetter Messages <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter7.2 High
- devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement pluginShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter4.3 Medium
- wplegalpages wplp cookie consent – cookie banner & consent management for gdpr, ccpa & google consent modeCookie Banner for GDPR / CCPA – WPLP Cookie Consent <= 4.3.7 - Cross-Site Request Forgery via Bulk Action to Delete/Resolve Entries4.3 Medium
- deveasel demi – one click demo import, backup & site migrationDemi <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copy5.3 Medium
- deveasel demi – one click demo import, backup & site migrationDemi <= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action7.5 High
- chaty pro, notfound chaty pro +1 moreChaty Pro <= 3.5.5 - Authenticated (Subscriber+) SQL Injection via 'widget_id' Parameter6.5 Medium
- wpeverest pdfdraft – drag & drop pdf builder, pdf viewer, embed & download pdf, certificate & invoice designerPDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter5.3 Medium
- No product listedVersions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS)...5.3 Medium
- No product listedVersions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the...8.7 High
- freerdpFreeRDP: Double-free of `client_formats` in the rdpsnd server channel on a malformed Client Audio Formats PDU7.1 High
- freerdpFreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client7.7 High
- freerdpFreeRDP: Denial of service through ADPCM frame size calculation6.5 Medium
coreutilsAlmaLinux,coreutils-commonAlmaLinux,coreutils-singleAlmaLinux +2 moreNone: coreutils bug fix and enhancement updateNo score- acymailing newsletter team anti spam and list cleaner – acycheckerWordPress Anti Spam and list cleaner – AcyChecker plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wasiliy strecker / contestgallery developer contest galleryWordPress Contest Gallery plugin <= 30.0.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- wp chill kali formsWordPress Kali Forms plugin <= 2.4.18 - Cross Site Scripting (XSS) vulnerability7.1 High
- isaumya ad invalid click protector (aicp)WordPress Ad Invalid Click Protector (AICP) plugin <= 1.3.0 - Broken Access Control vulnerability6.5 Medium
- unknown backwpupWordPress BackWPup plugin <= 5.7.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- Show moreLoading…