CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- koxudaxi datamodel-code-generatordatamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)8.2 High
- koxudaxi datamodel-code-generatordatamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements7.5 High
- koxudaxi datamodel-code-generator`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description7.8 High
- koxudaxi datamodel-code-generator`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator7.8 High
- koxudaxi datamodel-code-generatordatamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas3.7 Low
- koxudaxi datamodel-code-generatordatamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects8.2 High
- koxudaxi datamodel-code-generatorArbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate7.5 High
- koxudaxi datamodel-code-generator`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field7.8 High
- ibm langflow oss, langflow +1 moreLangflow is affected by NET Misconfiguration: Use of Impersonation due to multiple unauthenticated and insufficiently authorized API endpoints7.1 High
- ibm cloud pak systemDue to use of IBM Storage Protect, IBM Cloud Pak System is affected by vulnerability []7.5 High
- ibm websphere application serverIBM WebSphere Application Server is affected by a privilege escalation9.8 Critical
- ibm websphere application serverIBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities6.1 Medium
- ibm websphere application serverIBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information9.8 Critical
- azukaar cosmos-serverCosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server6.1 Medium
- ibm websphere application serverIBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information7.4 High
- ibm observability with instana (agent)IBM Instana Observability is affected by multiple Prototype Pollution within Instana Agent container image7.3 High
- ibm aspera faspex 5, aspera faspex +1 moreOS command injection in IBM Aspera Faspex9.1 Critical
- ibm aspera faspex 5, aspera faspex +1 moreOS Command Injection in IBM Aspera Faspex9.1 Critical
- azukaar cosmos-serverCosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens5.3 Medium
- ibm aspera, aspera desktop app +1 morePath Traversal in IBM Desktop App9.3 Critical
- ibm websphere application serverIBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities8.1 High
- ibm websphere application server - liberty, websphere application server +1 moreIBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability7.1 High
- ibm websphere application server, websphere application server - liberty +1 moreIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities7.5 High
- ibm aspera faspex 5, aspera faspex +1 moreMultiple vulnerabilities in IBM Aspera Faspex8.2 High
- ibm websphere application server - liberty, websphere application server +1 moreIBM WebSphere Application Server Liberty is affected by a denial of service vulnerability7.5 High
- ibm websphere application server, websphere application server - liberty +1 moreIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities8.7 High
- ibm websphere application server - liberty, websphere application server +1 moreIBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability7.5 High
- ibm websphere application server, websphere application server - liberty +1 moreIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities8.7 High
- igloohome smart lock mobile applicationInclusion of sensitive information in source code in igloohome Smart Lock Mobile Application6.9 Medium
- ibm websphere application server, websphere application server - liberty +1 moreIBM WebSphere Application Server and WebSphere Application Server Liberty is inconsistent Interpretation of HTTP Requests7.4 High
- ellucian advance web, legacy advance +1 moreAuthenticated SQL Injection Enables Unauthorized Access to Sensitive Information in Ellucian Advance Web and Legacy Advance9.4 Critical
- ibm ts4500 cli toolTS4500 CLI tool addresses security vulnerability5.9 Medium
- mikrotik cloud hosted router, routeros +1 moreImproper restriction of excessive authentication attempts in MikroTik RouterOS and Cloud Hosted Router8.7 High
- ibm websphere application serverIBM WebSphere Application Server is affected by an authentication bypass7.0 High
- ibm websphere application server - liberty, websphere application server +1 moreIBM WebSphere Application Server Liberty is affected by a denial of service7.1 High
- ibm sterling b2b integrator, sterling file gateway +1 moreIBM Sterling B2B Integrator and IBM Sterling File Gateway store sensitive information in a log file4.9 Medium
- ibm sterling b2b integrator, sterling file gateway +1 moreSecurity Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosure in mailbox UI4.3 Medium
- ibm sterling b2b integrator, sterling file gateway +1 moreSecurity Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosure4.3 Medium
- superplanehq superplaneSuperPlane < 0.30.0 SMTP Header Injection via Webhook Event Title6.3 Medium
- superplanehq superplaneSuperPlane < 0.27.0 Broken Object Level Authorization via CanvasService gRPC8.7 High
- tanium patchTanium addressed a SQL injection vulnerability in Patch.6.3 Medium
- softaculous speedycache – cache, optimization, performanceSpeedyCache <= 1.3.8 - Authenticated (Administrator+) Arbitrary File Read4.9 Medium
- tigroumeow media cleaner: clean your wordpress!Media Cleaner: Clean your WordPress! <= 7.0.3 - Authenticated (Administrator+) Server-Side Request Forgery4.1 Medium
- teydeastudio wp password policyWP Password Policy <= 3.7.1 - Authenticated (Subscriber+) Privilege Escalation8.8 High
- foomagoo plugin organizerPlugin Organizer <= 10.2.4 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +3 more +5 moreCriu: criu: container escape via rseq critical section hijack during checkpoint/restore7.8 High
- at&t arris bgw210‑700CVE-2026-167718.8 High
- artica tech proxy, articatech artica proxy +1 moreArtica Proxy 4.50 Session Fixation via fw.login.php7.5 High
- ibm powervm hypervisor, power system e1050 \(9043-mrx\) firmware, power system e1080 \(9080-hex\) firmware +15 more +17 moreThis Power System update is being released to address Insufficient Entropy4.2 Medium
freerdp3Ubuntufreerdp3 regressionNo score- Show moreLoading…