CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations5.5 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching6.5 Medium
- apache traffic serverApache Traffic Server: Out-of-bounds reads while parsing DNS responses6.3 Medium
- holest spreadsheet price changer for woocommerce and wp e-commerce – lightSpreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account Creation9.8 Critical
- apache traffic serverApache Traffic Server: Listener and ACL handling allow access-control bypass7.0 High
- apache traffic serverApache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow8.2 High
- apache traffic serverApache Traffic Server: Improper server-session reuse can expose data across client connections6.9 Medium
- apache traffic serverApache Traffic Server: URL and port parsing errors allow access-control bypass6.3 Medium
- apache traffic serverApache Traffic Server: Header-name length truncation enables header aliasing and request smuggling9.2 Critical
- apache traffic serverApache Traffic Server: Memory-safety errors in MIME and header parsing9.2 Critical
- apache traffic serverApache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification6.3 Medium
- apache traffic serverApache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion8.2 High
- apache traffic serverApache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely6.3 Medium
- apache traffic serverApache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory6.9 Medium
- apache traffic serverApache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server8.7 High
- linux, linux kernel +1 moreBluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()8.8 High
- linux, linux kernel +1 moreperf/core: Detach event groups during remove_on_exec7.8 High
- facturadorvirtual facturación electrónica costa ricaFacturación Electrónica Costa Rica <= 2.0.2 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- wp lab wp-lister lite for ebayWP-Lister Lite for eBay <= 3.8.8 - Authenticated (Shop Manager+) SQL Injection via 'orderby' Parameter4.9 Medium
- code4life database for cf7Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Values7.2 High
rsyslogSUSESecurity update for rsyslogNo score- apache traffic serverApache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling7.8 High
- apache traffic serverApache Traffic Server: Malformed chunked message body allows request smuggling7.0 High
- apache traffic serverApache Traffic Server: Buffer overflow via Host field that has a long string value8.2 High
- apache traffic serverApache Traffic Server: Request smuggling via chunked extension quoted-string parsing6.9 Medium
- apache traffic serverApache Traffic Server: Untrusted @ headers can spoof ATS internal metadata7.7 High
- apache traffic serverApache Traffic Server: Regex mappings match with malicious domain names6.9 Medium
- apache traffic serverApache Traffic Server: SNI to Host header matching policy is not properly enforced7.0 High
- codesys profinetOut-of-bounds Write in CODESYS PROFINET Controller7.1 High
- link libraryImproper neutralization of input during web page generation ('cross-site scripting')...6.4 Medium
- vacron vin-ds783e-e6Vacron｜IP Camera - Arbitrary File Read7.1 High
- vacron vin-ds783e-e6Vacron｜IP Camera - Hidden Functionality9.3 Critical
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsBusiness logic vulnerability4.3 Medium
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsInsecure direct object reference vulnerability3.1 Low
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsInformation disclosure vulnerability4.3 Medium
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsHard-coded AWS IAM credentials vulnerability5.4 Medium
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsAuthentication bypass vulnerability6.5 Medium
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsTOTP two-factor authentication bypass vulnerability4.8 Medium
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsImproper access control vulnerability3.7 Low
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsImproper access control vulnerability3.7 Low
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsSQL injection and unsafe deserialisation vulnerability9.9 Critical
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsSQL injection and unsafe deserialisation vulnerability9.9 Critical
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsSQL injection and unsafe deserialisation vulnerability9.9 Critical
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsPost-authentication SQL injection vulnerability8.1 High
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsPre-authentication error-based SQL injection vulnerability9.1 Critical
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsPre-authentication blind SQL injection vulnerability9.1 Critical
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsUnrestricted image upload vulnerability2.6 Low
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsUnrestricted SCORM file upload vulnerability9.9 Critical
- cyberlord92 miniorange social login and register (discord, google, twitter, linkedin)miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover8.1 High
- realmag777 wolfWOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF7.1 High
- Show moreLoading…