CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- mz automation libiec61850MZ Automation libiec61850 Out-of-bounds Read7.1 High
- mz automation libiec61850MZ Automation libiec61850 Out-of-bounds Read7.1 High
- mz automation libiec61850MZ Automation libiec61850 Out-of-bounds Read6.9 Medium
- mz automation libiec61850MZ Automation libiec61850 Out-of-bounds Read6.9 Medium
- mz automation libiec61850MZ Automation libiec61850 Out-of-bounds Read8.7 High
- tugcantopaloglu openclaw-dashboard, openclaw agent dashboard +1 moreOpenClaw Dashboard Stored XSS via lastMessage Session Field8.8 High
- o6 automation open62541o6 Automation open62541 Integer Underflow8.2 High
- o6 automation open62541o6 Automation open62541 Integer Overflow or Wraparound8.7 High
- o6 automation open62541o6 Automation open62541 Use After Free7.2 High
- ylianst meshcentralMeshCentral Cross-Site WebSocket Hijacking via Origin Validation Bypass on Self-Signed Certificate Deployments8.6 High
- o6 automation open62541o6 Automation open62541 Integer Overflow or Wraparound8.7 High
- nasa core flight system (cfs) health & safety (hs) applicationNASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer Dereference8.2 High
- cybertimon rapidrawRapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath7.1 High
- toptech systems multiload ii+, rcu ii+ +1 moreToptech Systems RCU II+ and Multiload II+ Missing Authentication for Critical Function8.7 High
- red hat enterprise linux 10, enterprise linux 9 +1 moreAnsible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure of postgresql data via insecure backup permissions5.5 Medium
- red hat enterprise linux 10, enterprise linux 9 +1 moreAnsible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure via leapp report tampering6.2 Medium
- watchfire bc550, bc750, bc760 +1 more +3 moreHard-coded Cryptographic Key in Watchfire Controllers7.6 High
- clastix kamajiKamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL drivers4.7 Medium
- clastix kamajiKamaji: TenantControlPlane namespace/name collision binds two tenants to the same SQL datastore schema + DB user, breaking per-tenant isolation8.5 High
- adonisjs http-serverAdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler6.1 Medium
- tugcantopaloglu openclaw-dashboard, openclaw agent dashboard +1 moreOpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field9.3 Critical
- grisuno lazyownLazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 Dashboard9.8 Critical
- grisuno lazyownLazyOwn: Unauthenticated Socket.IO `input` Event Reaches LazyOwn Command Dispatcher — Unauthenticated RCE9.8 Critical
- allinurl goaccessGoAccess: Out-of-bounds heap read in parse_ios() via crafted User-Agent leads to remote crash/DoS5.3 Medium
- allinurl goaccessGoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of service8.7 High
- microsoft azure cosmos dbAzure Cosmos DB Remote Code Execution Vulnerability10.0 Critical
- sylius molliepluginSylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII6.5 Medium
- allinurl goaccessGoAccess: Heap Out-of-Bounds Write in parse_browser()7.1 High
- sylius molliepluginSylius Mollie Plugin: Payment status forgery via the payment webhook7.5 High
- uhop node-re2re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)6.2 Medium
- uhop node-re2re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)5.7 Medium
- projectcapsule capsuleCapsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)6.6 Medium
- projectcapsule capsuleCapsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests6.8 Medium
- arnasdon wacrmWACRM: SSRF via the automation `send_webhook` action6.4 Medium
- wolfcmsWolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreController8.7 High
- opf openprojectOpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check)4.3 Medium
- wolfcmsWolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload8.7 High
- opf openprojectOpenProject: Improper Access Control through /api/v3/custom_options/:id via Path "id" leads to Sensitive Data Exposure4.3 Medium
- opf openprojectOpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"7.6 High
- apache tikaApache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=false6.9 Medium
- somta juggleJuggle 1.6.0 Unauthenticated RCE via Exposed H2 Console9.3 Critical
- apache tikaApache Tika: Arbitrary Local File Read in ISArchiveParser5.9 Medium
- yolanmees spiksterSpikster Missing Authentication via API Route Group9.3 Critical
- ibm devops deploy, ucd - ibm devops deploy, ucd - ibm urbancode deploy +1 more +3 moreIBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an Exposure of Sensitive Information Vulnerability4.3 Medium
python-sqlparseSUSESecurity update for python-sqlparseNo scorepython-sqlparseSUSESecurity update for python-sqlparseNo score- ibm websphere application serverIBM WebSphere Application Server is affected by a remote code execution vulnerability8.5 High
- ibm langflow oss, langflow +1 moreRemote Code Execution in CUGA Component CodeAgent9.9 Critical
- ibm langflow oss, langflow +1 moreLangflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints8.1 High
- amazon aws-smithy-jsonUncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers8.7 High
- Show moreLoading…