CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- nasa-ammos ait-gui, nasa ait gui +1 moreAIT-GUI < 2.5.1 Missing Authentication via Sessions.create()9.3 Critical
- brightio penelopePenelope unsafe tar extraction allows arbitrary local file write via crafted session archive5.9 Medium
- No product listedKong Operator cluster-wide ingress configuration DoS via embedded KIC CA-certificate ID collision7.1 High
- No product listedKong Kubernetes Ingress Controller cluster-wide ingress configuration DoS via CA-certificate ID collision7.1 High
- autodesk autocad, advance steel, autocad lt +8 more +10 moreDWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCAD5.5 Medium
- autodesk autocad, advance steel, autocad lt +8 more +10 moreDWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCAD6.1 Medium
- autodesk autocad, advance steel, autocad lt +8 more +10 moreDXF File Parsing Heap-Based Overflow in Autodesk AutoCAD7.8 High
- verapdf verapdf-parserveraPDF Parser DoS via PostScript Type 1 Font Programs6.9 Medium
- verapdf verapdf-parserveraPDF Parser DoS via PostScript CMap Streams6.9 Medium
- verapdf verapdf-validationveraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs6.5 Medium
- verapdf verapdf-validationveraPDF Validation XXE via Rich Text8.7 High
- verapdf verapdf-validationveraPDF Validation XXE via XFA8.7 High
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies8.3 High
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to code injection via unescaped enum string values8.3 High
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template8.3 High
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`6.1 Medium
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template8.3 High
- gleamInsufficient verification of Hex package metadata in Gleam7.6 High
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`7.4 High
- teamviewer remote, samsung open source one, teamviewer tensor +2 moreBypass of 2FA for Connections via Unattended Access in TeamViewer for macOS8.0 High
- cert.pl mwdb coreMissing authentication requirement in Remote Instances proxy API in MWDB Core7.0 High
- cert.pl mwdb corePermission Bypass Via Undocumented HTTP Methods In MWDB Core5.3 Medium
- balbooa gridbox, balbooa.com gridbox extension for joomla +1 moreJoomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.27.3 High
- balbooa gridbox, balbooa.com gridbox extension for joomla +1 moreJoomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.210.0 Critical
- balbooa gridbox, balbooa.com gridbox extension for joomla +1 moreJoomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.210.0 Critical
- balbooa gridbox, balbooa.com gridbox extension for joomla +1 moreJoomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.29.2 Critical
- balbooa gridbox, balbooa.com gridbox extension for joomla +1 moreJoomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.29.2 Critical
- balbooa gridbox, balbooa.com gridbox extension for joomla +1 moreJoomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.25.3 Medium
- balbooa gridbox, balbooa.com gridbox extension for joomla +1 moreJoomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.25.3 Medium
- balbooa gridbox, balbooa.com gridbox extension for joomla +1 moreJoomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.29.2 Critical
- balbooa gridbox, balbooa.com gridbox extension for joomla +1 moreJoomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.26.1 Medium
- @fastify/forwarded, fastify fastify\/forwarded +1 more@fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For5.3 Medium
- axway securetransportServer-Side Template Injection in SecureTransport's Apache Velocity mail templates9.4 Critical
- multiple open source open-iscsiDouble-free in the iSNS attribute decoder in open-iscsi8.7 High
- cjson project cjsoncJSON JSON Patch Non-Atomic Application Destroys Data Before Validation6.9 Medium
- cjson project cjsoncJSON cJSON_Compare Exponential Complexity Denial of Service8.2 High
- cjson project cjsoncJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion8.7 High
- nanoid project nanoidnanoid Infinite Loop via Negative Size in non-secure module8.2 High
- nanoid project nanoidnanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom8.2 High
- getgrav gravGrav Login Plugin before 3.8.13 Insufficient Session Expiration6.3 Medium
- ente museum serverEnte Museum Server Authorization Bypass Vulnerability6.5 Medium
- multiple open source open-iscsiiscsiuio control-socket authentication bypass in open-iscsi8.5 High
- opensolution quick.cmsBlind SQL Injection in Quick.CMS5.1 Medium
- rolandd ro csvi, rolandd.com ro csvi extension for joomla +1 moreJoomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.08.8 High
- rolandd ro csvi, rolandd.com ro csvi extension for joomla +1 moreJoomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.07.5 High
- rolandd ro csvi, rolandd.com ro csvi extension for joomla +1 moreJoomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.06.1 Medium
- oracle business intelligencePlaintext password storage in Streamsoft Business Intelligence7.1 High
- widgetfactorylimited jce, joomlacontenteditor.net joomla content editor (jce) extension for joomla +1 moreJoomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.9.99.106.5 Medium
- schneider electric igss definition (def.exe)CWE-787 Out-of-bounds write vulnerability exists that could cause loss of data or potentially...8.4 High
- schneider electric remoteconnect, scadapack 47x, scadapack 47xi +1 more +3 moreCWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause...9.3 Critical
- Show moreLoading…