CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- easyappointments easy appointmentsEasy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR5.4 Medium
- payuplugin payu commercepro pluginPayU CommercePro < 3.9.0 - Unauthenticated Order Tampering5.3 Medium
- stiofan userswpUsersWP < 1.2.67 - Two-Factor Authentication Bypass7.4 High
- unknown photoswipePhoto Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute6.8 Medium
- iqonicdesign streamitStreamit < 4.5.2 - Unauthenticated Remote Code Execution via Arbitrary Function Call9.8 Critical
- unknown wp-media-folder-addonMedia folder Addon < 4.1.7 - Unauthenticated Arbitrary File Download8.6 High
- unknown shinystat analyticsShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information Disclosure5.3 Medium
- nico23 advanced responsive video embedder for rumble, odysee, youtube, vimeo, kick …Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter9.8 Critical
- bplugins survey form block – collect answers and insights from your audienceSurvey Form Block <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export4.3 Medium
- opajaap wp photo album plusWP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter4.9 Medium
- smub easy digital downloads – ecommerce payments and subscriptions made easyEasy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter7.2 High
- wpxpo wowstore – store builder & product blocks for woocommerceWowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'currentPostId' Block Attribute6.4 Medium
- wpxpo wowstore – store builder & product blocks for woocommerceWowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filterMobileText' Block Attribute6.4 Medium
- magepeopleteam event booking manager for woocommerce – sell tickets, event registration, rsvp & event calendarEvent Booking Manager for WooCommerce <= 5.3.7 - Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification via mep_save_payment_settings_modal AJAX Action4.3 Medium
- contrid newslettersNewsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute6.4 Medium
- saadiqbal wholesale for woocommerceWholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter8.8 High
- it path solutions pvt ltd contact form to any apiContact Form to Any API <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta6.4 Medium
- contrid newslettersNewsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute6.4 Medium
javaparserOSS-FuzzSecurity exception in com.github.javaparser.ast.expr.Name.acceptNo score- alanxz rabbitmq-crabbitmq-c: Heap Buffer Overflow in amqp_send_frame() When Serializing Oversized AMQP_FRAME_BODY9.8 Critical
- alanxz rabbitmq-crabbitmq-c: amqp_decode_bytes size_t integer overflow bypasses bounds check on 32-bit (OOB read)7.4 High
- No product listedJinher OA C6 contains an XML External Entity (XXE) injection vulnerability in the /c6/JHSoft.Web...7.5 High
- No product listedkishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability...7.3 High
- No product listedkishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient...7.3 High
- No product listedkishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in the view-medhistory...7.3 High
- No product listedkishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get_doctor.php via the...9.8 Critical
- No product listedkishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view...9.8 Critical
- No product listedSourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save_user...7.3 High
- No product listedSourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in...7.3 High
- No product listedhttps://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL...7.3 High
- No product listedSourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in...7.3 High
- No product listedSourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save_stud...9.8 Critical
- No product listedSourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in...9.8 Critical
- No product listedkishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates...9.8 Critical
- No product listedSourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting (XSS) in...6.1 Medium
- No product listedAn Insecure Direct Object Reference (IDOR) in the Employee Compensation View function of Infor...7.5 High
- ddnexus pagyPagy I18n locale option is not validated before being used in a file path6.9 Medium
skilocrates.ioskilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source6.5 Medium- bablilayoub openholeopenhole-server vulnerable to path traversal via URL-decoded request path8.6 High
- hypequery@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution9.8 Critical
- gotd tdtd has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode7.5 High
- goshs-labs goshsgoshs has ACL Bypass & Path Traversal5.3 Medium
- goshs-labs goshsgoshs has a Path Traversal issue6.5 Medium
- goshs-labs goshsgoshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite9.1 Critical
- goshs-labs goshsgoshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)7.5 High
- goshs-labs goshsgoshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)9.1 Critical
- koxudaxi datamodel-code-generatordatamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`7.5 High
- koxudaxi datamodel-code-generator`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field8.8 High
- koxudaxi datamodel-code-generatordatamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding7.5 High
- koxudaxi datamodel-code-generator`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data7.8 High
- Show moreLoading…