CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- xenbuffer overruns in libfsimage iso9660 handling5.5 Medium
- xenbuffer overruns in libfsimage iso9660 handling5.5 Medium
- xenbuffer overruns in libfsimage iso9660 handling6.1 Medium
- xenvIRQ event channel binding may break Xenstore7.5 High
- xenx86 shadow paging is deprecated7.5 High
- universal software inc. ukbsImproper Authentication in Universal Sotware's UKBS8.8 High
- lookylooZip Bomb in Lookyloo Capture Upload Allows Denial of Service6.9 Medium
- red hat openshift container platform 4.12, openshift container platform 4.13, openshift container platform 4.14 +8 more +10 moreOpenshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams8.5 High
- opensolution quick.cartHard-coded admin credentials in Quick.Cart6.8 Medium
- casfid servicios tecnológicos nfc wristbandsInsufficient Encryption Level in CasfID Servicios Tecnológicos NFC Wristbands6.8 Medium
- wedevs storegrowth – upsell, bogo, quick view, direct checkout & side cart for woocommerceStoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via…5.3 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter4.9 Medium
- wedevs storegrowth – upsell, bogo, quick view, direct checkout & side cart for woocommerceStoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Options Update via create_popup AJAX Action5.3 Medium
- quantumcloud wpbot – ai chatbot for live support, lead generation, ai servicesWPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action5.3 Medium
- wedevs storegrowth – upsell, bogo, quick view, direct checkout & side cart for woocommerceStoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'message_popup' Parameter7.2 High
- quantumcloud wpbot – ai chatbot for live support, lead generation, ai servicesWPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action5.3 Medium
- uncannyowl uncanny automator – easy automation, integration, webhooks & workflow builder pluginUncanny Automator <= 7.3.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Integration Metadata Disclosure via Multiple AJAX Endpoints7.5 High
- samsung mobile devicesOut-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote attackers to...8.3 High
- opensolution quick.cmsPath Traversal in Quick.CMS5.1 Medium
- opensolution quick.cmsLocal File Inclusion in Quick.CMS5.1 Medium
- opensolution quick.cmsDenial of Service in Quick.CMS7.0 High
- pretixMissing authorization check in event quick setup view2.3 Low
- pretix gmbh pretix-girosolutionInsufficient validation of payment status in pretix-girosolution6.3 Medium
- balbooa.com balbooa forms component for joomlaJoomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.310.0 Critical
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreGstreamer1-plugins-good: gst-plugins-good: 4-byte heap over-read in gst_matroska_parse_flac_stream_headers when parsing flac codec data in matroska containers3.3 Low
- microsoft libxpmDenial of service via unsigned underflow in libXpm's write path5.5 Medium
- gitpython-developers gitpythonGitPython before 3.1.50 Newline Injection via config_writer section7.3 High
- ninenines cowboyCowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion6.9 Medium
sambaDebian,ctdbTuxCare,ldb-toolsTuxCare +49 more +51 moresamba: Fix of CVE-2026-69498.8 High- samba, red hat ceph storage 9.2, enterprise linux 10 +7 more +9 moreSamba: ctdb fails to do integrity checking of received packets6.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreSamba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributes8.8 High
sambaDebiansamba security update8.8 High- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreSamba: dns signing dos via tkey name cache exhaustion5.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreSamba: kpasswd service: kpasswd packet that contains malformed asn.1 might cause the server to access 6 bytes of unallocated memory leading server to crash5.3 Medium
- ninenines cowlibUnbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS8.7 High
- sap se netweaver application server for abapInformation Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform4.3 Medium
- mihail-chepovskiy web directory freeWeb Directory Free <= 1.7.13 - Unauthenticated SQL Injection7.5 High
- lrnz shortcodifyShortcodify <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute5.0 Medium
- eazyplugins eazy plugin manager – powerful plugin management solution for wordpressEazy Plugin Manager <= 4.4.1 - Authenticated (Subscriber+) Privilege Escalation via pos_get_option AJAX Action and admin/login REST Endpoint8.8 High
- pickplugins question answerPickPlugins Question Answer <= 1.2.73 - Unauthenticated SQL Injection via 'id' Parameter7.5 High
- weidmueller interface procon-web scadaSQL injection via unauthenticated GetGridData endpoint9.3 Critical
- sick ag icr890-4, inspectorp61x, inspectorp62x +3 more +5 moreCVE-2026-118419.4 Critical
- ads-tec industrial it dvg-irf1401, dvg-irf1421, dvg-irf3401 +3 more +5 moreads-tec Industrial IT: Post-login open redirect in the web interface6.1 Medium
- ads-tec industrial it dvg-irf1401, dvg-irf1421, dvg-irf3401 +3 more +5 moreads-tec Industrial IT: Account lockout via non-atomic user creation8.1 High
- ads-tec industrial it dvg-irf1401, dvg-irf1421, dvg-irf3401 +3 more +5 moreads-tec Industrial IT: Vertical privilege escalation via configuration table write8.8 High
- ads-tec industrial it dvg-irf1401, dvg-irf1421, dvg-irf3401 +3 more +5 moreads-tec Industrial IT: Privilege escalation during configuration import8.7 High
- alibaba cloud rds openapi mcp serverMCP Server Exposure via Insecure Default Binding on alibabacloud-rds-openapi-mcp-server5.8 Medium
- elecom co.,ltd. wab-i1750-ps, wab-m1775-ps, wab-m2133 +2 more +4 moreELECOM wireless LAN routers and access points devices contain an OS Command Injection...8.6 High
- elecom co.,ltd. wrc-x3000gs3-b, wrc-x3000gs3a-b +1 moreELECOM wireless LAN routers and access points devices contain an OS Command Injection...8.6 High
- elecom co.,ltd. wab-i1750-ps, wab-m1775-ps, wab-m2133 +2 more +4 moreELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting...5.1 Medium
- Show moreLoading…