CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- balbooa gridbox, balbooa.com gridbox extension for joomla +1 moreJoomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.210.0 Critical
- balbooa gridbox, balbooa.com gridbox extension for joomla +1 moreJoomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.29.4 Critical
webbrowsercrates.ioUnix `BROWSER` handling allows browser argument injectionNo score- schneider electric ecostruxure™ cybersecurity admin expertCWE-522 Insufficiently Protected Credentials vulnerability exists that could cause authentication...8.7 High
- themecomplete extra checkout options - addon for extra product options pluginExtra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings8.8 High
- frappe erpnextSQL Injection in Frappe's ERPNext7.1 High
- gnu binutilsGNU Binutils ELF String Table elf-strtab.c _bfd_elf_strtab_delref memory corruption4.8 Medium
- gnu binutilsGNU Binutils Section Merge merge.c _bfd_write_merged_section null pointer dereference4.8 Medium
- gnu binutilsGNU Binutils SHT_GROUP Section elf.c bfd_elf_set_group_contents null pointer dereference4.8 Medium
- gnu binutilsGNU Binutils ELF Orphan Section ldelf.c elf_orphan_compatible null pointer dereference4.8 Medium
- gnu binutilsGNU Binutils Eh Frame Section elf-eh-frame.c _bfd_elf_write_section_eh_frame buffer overflow2.4 Low
- gnu binutilsGNU Binutils ld elf64-x86-64.c elf_x86_64_relocate_section buffer overflow4.8 Medium
- gnu binutilsGNU Binutils ld libbfd.c bfd_putl64 null pointer dereference4.8 Medium
- gnu binutilsGNU Binutils ld cache.c cache_bwrite buffer overflow4.8 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreBinutils: binutils: out-of-bounds write in bfd dlx elf backend relocation processing7.8 High
- so-fancy diff-so-fancyTerminal Escape Injection in diff‑so‑fancy4.8 Medium
- gnu bisonArbitrary Output Location Change in GNU Bison4.6 Medium
- gnu bisonArbitrary Command Execution in GNU Bison6.8 Medium
- aimy-extensions aimy captcha-less form guard, aimy-extensions.com aimy captcha-less form guard plugin for joomla +1 moreJoomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.010.0 Critical
- ameliabooking booking system trafftBooking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- blendmedia wp cta – call now button, sticky button & call to action builderWP CTA <= 2.1.2 - Authenticated (Administrator+) Server-Side Request Forgery4.9 Medium
- meta box aioMeta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id' Parameter9.1 Critical
- wpclever wpc badge management for woocommerceWPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute6.4 Medium
- stylemix masterstudy lms wordpress plugin – for online courses and educationMasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion6.5 Medium
- techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builderFluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member7.2 High
- klubraum membership requestKlubraum Membership Request <= 1.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update5.3 Medium
- stylemixthemes cost calculator builder proCost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter9.8 Critical
- duracelltomi gtm4wp – a google tag manager (gtm) plugin for wordpressGTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields7.2 High
- apache atlasApache Atlas: Missing Authorization on Admin Endpoints8.8 High
- apache kyuubiApache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy7.3 High
- apache traffic serverApache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode6.3 Medium
- apache traffic serverApache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification8.2 High
- apache traffic serverApache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins8.4 High
- apache traffic serverApache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service6.3 Medium
- apache traffic serverApache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses8.2 High
- apache traffic serverApache Traffic Server: Use-after-free in the intercept plugin8.2 High
- apache traffic serverApache Traffic Server: header_rewrite plugin cookie handling can corrupt memory8.3 High
- apache traffic serverApache Traffic Server: prefetch plugin can crash on attacker-influenced input8.2 High
- apache traffic serverApache Traffic Server: ts_lua plugin has initialization and resource-handling errors8.2 High
- apache traffic serverApache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash8.2 High
- apache traffic serverApache Traffic Server: txn_box plugin overflows the stack from attacker input8.2 High
- apache traffic serverApache Traffic Server: regex_remap plugin overflows the stack from attacker input9.2 Critical
- apache traffic serverApache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery8.2 High
- apache traffic serverApache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework8.3 High
- apache traffic serverApache Traffic Server: HostDB SRV handling leaks memory8.2 High
- apache traffic serverApache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free8.3 High
- apache traffic serverApache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server8.3 High
- apache traffic serverApache Traffic Server: Certifier plugin trusts client SNI when generating certificates8.4 High
- apache traffic serverApache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server9.2 Critical
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)9.8 Critical
- Show moreLoading…