CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- apache zeppelinApache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-318676.5 Medium
- apache zeppelinApache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction6.5 Medium
- apache zeppelinApache Zeppelin: Cross-site request forgery in REST and WebSocket request handling6.1 Medium
- foreupforeUP customer REST API allows unauthenticated endpoint access8.1 High
- csl mobile limited 1010 m2m 3g wifi moduleCSL 1010 M2M 3G WiFi Module 2.2.1.4 Weak Encryption via Router.cfg6.9 Medium
- umai vision traffic analysis systemSQLi in UMAI Vision's Traffic Analysis System9.8 Critical
- tigera calico, calico cloud, calico enterprise +2 moreL7 policy bypass via unnormalized HTTP path matching7.9 High
- tigera calico, calico cloud, calico enterprise +2 moreCalico Tier Authorization Bypass via DeleteCollection6.2 Medium
- tigera calico, calico cloud, calico enterprise +2 moreUnauthenticated Go pprof exposure in Calico debug server6.0 Medium
- opencostOpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass8.7 High
- julep-ai julepJulep Insecure Direct Object Reference via GET /executions/{execution_id}8.6 High
- vendurehq vendureVendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update6.1 Medium
- kyegomez swarmsSwarms 6.8.1 Server-Side Request Forgery via DNS Rebinding Bypass7.7 High
- dromara maxkeyMaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theft8.5 High
- ibm sterling b2b integrator, sterling file gateway +1 moreXSS Security Vulnerability in response header affects IBM Sterling B2B Integrator and IBM Sterling File Gateway5.4 Medium
- ibm sterling b2b integrator, sterling file gateway +1 moreSecurity Vulnerability in Ebics server affects IBM Sterling B2B Integrator and IBM Sterling File Gateway5.4 Medium
- ibm websphere application server - liberty, websphere application server +1 moreIBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/27.5 High
- ibm app connect enterpriseIBM App Connect Enterprise is vulnerable to Confidentiality disclosure on Discovery Connector nodes7.5 High
- malach-it borutaBoruta accepts expired JWT client assertions due to missing exp claim validation9.1 Critical
- malach-it borutaBoruta dynamic client registration allows creation of over-privileged OAuth clients8.3 High
- malach-it borutaServer-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching6.9 Medium
- ibm aspera, aspera desktop app +1 moreCode execution in IBM Desktop App7.3 High
- ibm tivoli system automation application manager, websphere application server +1 moreMultiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager9.3 Critical
- ibm tivoli system automation application manager, websphere application server +1 moreCross-site Scripting in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager5.4 Medium
- ibm websphere application server - liberty, websphere application server +1 moreIBM WebSphere Application Server Liberty is affected by a cross-site request forgery8.3 High
- ibm app connect enterpriseIBM App Connect Enterprise is vulnerable to arbitrary file write vulnerability9.8 Critical
- ibm app connect enterpriseIBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings8.8 High
- ibm app connect enterpriseIBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings7.5 High
- ibm enterprise build of quarkusIBM Enterprise Build of Quarkus is affected by a DoS vulnerability7.5 High
- s9y serendipitySerendipity < 2.6.1 Authentication Bypass via Username Collision8.7 High
- softtr information technology trade ltd. co. e-commerce packCSRF in Softtr's E-Commerce Pack8.3 High
libdate-manip-perlDebian,perl-Date-ManipAlmaLinux +1 moreDate::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time7.5 Highlibdate-manip-perlDebian,perl-Date-ManipAzure Linux +1 moreDate::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check7.5 High- e107inc e107e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()7.7 High
opensslUbuntuopenssl vulnerabilityNo score- ftc software it services e-commerce management panelAuthentication Bypass in FTC Software's E-Commerce Management Panel8.2 High
- bosch bsh elp (electronic platform) modulesThe SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific...8.1 High
- broadcom vmware esx, vmware esx, cloud foundation +3 more +5 moreESX insufficient logging vulnerability2.7 Low
- vmware esx, fusion, workstation +3 more +5 moreOut-of-bounds read vulnerability7.6 High
- vmware esx, cloud foundation, telco cloud platform +1 more +3 moreVMXNET3 out-of-bounds write vulnerability9.3 Critical
- gladinet centrestackCentreStack < 17.4 SQL Injection via x-glad-filter Header8.7 High
- gladinet centrestackCentreStack < 17.2 Unauthenticated API Authorization Bypass8.8 High
- gladinet centrestackCentreStack < 17.4 XXE via SharePoint Storage Configuration8.7 High
- gladinet centrestackCentreStack < 17.3 Unauthenticated User Creation via Deserialization in GSNamespace.dll8.7 High
- gladinet centrestackCentreStack < 17.4 Session Injection via SelectProvider.aspx6.9 Medium
- gladinet centrestackCentreStack < 17.5 Hardcoded Key Token Forgery RCE9.3 Critical
- vmware vcenter, cloud foundation, telco cloud infrastructure +3 more +5 morevCenter authentication-bypass vulnerability9.8 Critical
- broadcom vmware vcenter, vmware vcenter, cloud foundation +4 more +6 morevCenter directory-traversal vulnerability9.8 Critical
- fusewp – wordpress user sync to email list & marketing automation (mailchimp, constant contact, activecampaign etc.)FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle4.3 Medium
golangTuxCare,golang-binTuxCare,golang-docsTuxCare +5 more +7 moregolang: Fix of 5 CVEsNo score- Show moreLoading…