CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- red hat cost management 4, redhat cost management metrics operator +1 moreProject-koku/koku-metrics-operator: koku-metrics-operator: service-account client credentials sent to user-controlled token_url6.8 Medium
- red hat cost management 4, redhat cost management metrics operator +1 moreProject-koku/koku-metrics-operator: koku-metrics-operator: cluster pull-secret token exfiltration via user-controlled api_url (ssrf / confused deputy)7.6 High
- red hat cost management 4, redhat cost management metrics operator +1 moreProject-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service_address7.6 High
- phpStack overflow in phar with circular symlinks5.4 Medium
- phpOut-of-bounds write in bccomp() via crafted operand and scale8.1 High
- phpSQL injection in ext-pgsql via E'...' backslash breakout8.1 High
libarchiveSUSESecurity update for libarchiveNo score- wp swings subscriptions for woocommerceSubscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action7.2 High
- enhancesoft llc osticketWeak password recovery mechanism in osTicket by Enhancesoft LLC9.1 Critical
- red hat certificate system 10, certificate system 10.4 eus for rhel-8, certificate system 11 +6 more +8 moreDogtag-pki: pki-core: redhat-pki: pki: acme http-01 validation ssrf via ip literal identifiers and unvalidated redirects5.8 Medium
- eaton padmImproper input validation in one of the session management interface of Eaton's Tripp Lite series...8.8 High
- eaton padmImproper input validation in one of the session management interface of Eaton's Tripp Lite Series...8.3 High
- eaton padmImproper input validation in the authentication component of Eaton's Tripp Lite series PADM...8.6 High
- dfir-iris iris-webDFIR-IRIS Insufficient Logout Implementation4.2 Medium
- dfir-iris iris-webDFIR-IRIS Missing Brute Force Protection in User Authentication5.9 Medium
- dfir-iris iris-webDFIR-IRIS Missing Brute Force Protection in OTP Validation5.9 Medium
- dfir-iris iris-webDFIR-IRIS Stored XSS in Datastore Upload7.6 High
- dfir-iris iris-webDFIR-IRIS Stored XSS in Custom Attributes7.6 High
- dfir-iris iris-webDFIR-IRIS Stored XSS in Assets7.6 High
- linuxKVM: x86: wean fast IN from emulator_pio_inNo score
- eclipse foundation csi - piaUnauthenticated SSRF in PIA via OIDC issuer allowlist bypass8.8 High
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreCommand Injection in SCM (idledisconnect parameter)9.3 Critical
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreFirewall bypass during shutdown9.3 Critical
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreExposed Reboot via Modbus8.7 High
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreCleartext password in logs5.8 Medium
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreLocal Privilege Escalation vulnerability in /etc/init.d/user-applications via customer website file8.5 High
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreControllerAgent does not perform validation of firmware9.3 Critical
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreJupiCore does not perform validation of firmware6.9 Medium
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreOCPP Firmware download is not properly locked6.9 Medium
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreOCPP reconfiguration vulnerability9.3 Critical
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreJupiCore charging point reconfiguration without auth8.8 High
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreLocal Privilege Escalation via pppd password injection8.5 High
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreOS Command Injection in OCPP Agent via charge_box_id8.8 High
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreFile Upload vulnerability5.3 Medium
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreudhcpc Privilege Escalation8.5 High
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreLocal Privilege Escalation via Network scripts8.5 High
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreFallback to second RAUC slot with default credentials8.3 High
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreLocal Privilege Escalation vulnerability in /etc/init.d/user-applications via user-application start script8.5 High
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreMissing input validation / stripping of CRLF characters in SystemConfigManager8.8 High
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreCreation of a new configuration by posting a malicious ID to MQTT8.8 High
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 moreMissing authentication for MQTT Broker9.3 Critical
- mitsubishi electric corporation ac servo melservo-j5 mr-j5-g, ac servo melservo-j5 mr-j5-g-hs, ac servo melservo-j5 mr-j5-g-ll +119 more +121 moreInformation tampering and Denial-of-service (DoS) vulnerability in CC-Link IE TSN communication protocol7.1 High
- rocket.chatRocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8,...9.8 Critical
- pleskImproper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged...9.9 Critical
- nodejs node, node.js +1 moreA flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree...7.5 High
- nodejs node, node.js +1 moreA flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions,...4.1 Medium
- nodejs node, node.js +1 moreA flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()`...3.3 Low
- veeam service provider consoleImproper handling of the returnUrl parameter in the Forgot Password function of Veeam Service...5.3 Medium
- nodejs nodeAn incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname...6.3 Medium
- themeum tutor lmsTutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection5.4 Medium
- Show moreLoading…