CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- No product listedEcommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in ...9.8 Critical
- No product listedCleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not...6.1 Medium
- imagemagickImageMagick: Heap Buffer Over-Read in BGR decoder due to mising end-of-file check5.3 Medium
- webreinvent vaahcmsVaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php9.2 Critical
- nodejs undiciundici vulnerable to CRLF Injection via blob-like body 'type' property4.2 Medium
- nodejs undiciundici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives5.9 Medium
- nodejs undiciundici vulnerable to downstream response desynchronization via retry interceptor4.8 Medium
- olivetinOliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output4.3 Medium
- olivetinOliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check6.6 Medium
- olivetinOliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)7.5 High
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 moreVercelAIAdapter trusts client-controlled `providerMetadata` to construct `UploadedFile` — S3/GCS confused deputy via provider metadata injection6.8 Medium
- autel maxicharger ac elite homeAutel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability8.1 High
- autel maxicharger ac elite homeAutel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability6.8 Medium
- autel maxicharger ac elite homeAutel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability6.8 Medium
- autel maxicharger ac elite homeAutel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability4.3 Medium
- autel maxicharger ac elite homeAutel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability6.4 Medium
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 morePydantic AI AG-UI Adapter: A dangling client-submitted tool call can execute when a trailing message is dropped during `sanitize_messages`6.5 Medium
- linuxfabrik monitoring-pluginsLinuxfabrik monitoring-plugins: SSRF and auth-token disclosure via unvalidated @odata.id link in redfish-* plugins8.3 High
- linuxfabrik monitoring-pluginslinuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect6.0 Medium
- linuxfabrik monitoring-pluginsLinuxfabrik monitoring-plugins: Symlink following in logfile legacy database migration5.8 Medium
- modelcontextprotocol ruby-sdkMCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport7.5 High
- modelcontextprotocol ruby-sdkMCP Ruby SDK: Ruby SSE Session Poisoning8.3 High
- modelcontextprotocol ruby-sdkMCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)6.2 Medium
- aten unizonATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability7.5 High
- modelcontextprotocol ruby-sdkMCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood5.3 Medium
- drivelockDriveLock Directory Traversal Information Disclosure Vulnerability6.5 Medium
- drivelockDriveLock Directory Traversal Information Disclosure Vulnerability7.5 High
- drivelockDriveLock SQL Injection Privilege Escalation Vulnerability8.8 High
- drivelockDriveLock Directory Traversal Information Disclosure Vulnerability5.3 Medium
- drivelockDriveLock Directory Traversal Information Disclosure Vulnerability7.5 High
- msi centerMSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability7.8 High
- bitdefender total securityG DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability7.8 High
- modelcontextprotocol ruby-sdkMCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection6.9 Medium
- langgenius difyDify AI Workflow oauth_redirect_url Open Redirect Vulnerability5.4 Medium
- heimdall data database proxyHeimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability7.2 High
- gitlabIncorrect Authorization in GitLab3.1 Low
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab4.7 Medium
- gitlabMissing Authorization in GitLab4.3 Medium
- gitlabInsertion of Sensitive Information Into Sent Data in GitLab8.5 High
- gitlabIncorrect Authorization in GitLab5.3 Medium
- gitlabImproperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab8.4 High
- gitlabTime-of-check Time-of-use (TOCTOU) Race Condition in GitLab6.5 Medium
- gitlabMissing Authorization in GitLab4.9 Medium
- gitlabExposure of Sensitive Information Through Metadata in GitLab4.3 Medium
- gitlabImproper Neutralization of Input Used for LLM Prompting in GitLab4.3 Medium
- gitlabGeneration of Incorrect Security Tokens in GitLab4.3 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab7.5 High
- gitlabInsufficiently Protected Credentials in GitLab5.4 Medium
- pgvector project pgvectorpgvector buffer overflow via integer wraparound in IVFFlat index build on 32-bit systems8.8 High
- flytohub flyto-coreFlyto2 Core: Arbitrary file write via image.download (and other file-writing modules)10.0 Critical
- Show moreLoading…