CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- unknown demiDemi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Backup Directory7.5 High
- stellarwp givewpGiveWP < 4.16.3 - Unauthenticated Recurring Donor Information Disclosure7.5 High
- stellarwp givewpGiveWP < 4.16.3 - Unauthenticated Payment Gateway Restriction Bypass5.3 Medium
- rich source dms+ (non-mobile)Rich Source｜DMS+ (Non-Mobile) - Use of Hard-coded Credentials10.0 Critical
- realtyna organic idx plugin + wpl real estate, unknown realtyna organic idx plugin + wpl real estate +1 moreRealtyna Organic IDX plugin + WPL Real Estate <= 5.3.0 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- realtyna organic idx plugin + wpl real estate, unknown realtyna organic idx plugin + wpl real estate +1 moreRealtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' Command9.8 Critical
- comfy-org comfyuiComfyUI: Path traversal in LoadImage via the /prompt API allows arbitrary file existence probing and image exfiltration7.5 High
- comfy-org comfyuiComfyUI: Stored XSS via /userdata/{file} due to Missing Content-Type Sanitization8.2 High
- comfy-org comfyuiComfyUI: Path traversal in /experiment/models/preview allows arbitrary image file read7.5 High
- comfy-org comfyuiComfyUI: Stored XSS via SVG file upload on the /view endpoint8.2 High
- codeigniter4CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules9.8 Critical
- codeigniter4CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames7.5 High
- codeigniter4CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions9.4 Critical
- codeigniter4CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()4.8 Medium
- advantech adam-3600Successful exploitation of the vulnerability could allow an authenticated attacker to exploit a...7.5 High
- advantech adam-3600Successful exploitation of the vulnerability could allow an unauthenticated attacker to exploit a...9.2 Critical
- advantech adam-3600Successful exploitation of the vulnerability could allow an unauthenticated attacker to exploit a...9.2 Critical
- advantech adam-3600Successful exploitation of the command injection vulnerability could allow an attacker to execute...8.6 High
- advantech adam-3600Successful exploitation of the vulnerability could allow an unauthenticated attacker to exploit a...9.2 Critical
- redhatinsights yggdrasil-worker-package-manager, red hat enterprise linux 10 +1 moreYggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote code execution via apt argument injection7.8 High
- google mcp-toolbox, mcp toolbox for databases +1 moreAuthentication Bypass and Audience Confusion in MCP Toolbox OAuth Provider8.0 High
- google mcp-toolbox, mcp toolbox for databases +1 moreServer-Side Request Forgery via Unrestricted HTTP Redirection in MCP Toolbox8.0 High
- google mcp-toolbox, mcp toolbox for databases +1 moreDenial of Service via Unrestricted Payload Buffering in MCP Toolbox6.6 Medium
- google mcp-toolbox, mcp toolbox for databases +1 moreBigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP Toolbox5.7 Medium
- google mcp-toolbox, mcp toolbox for databases +1 moreAuthorization Bypass in MCP Toolbox Legacy HTTP Endpoints8.1 High
- nodejs nodeA flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites)...3.3 Low
gdAlmaLinux,libgdMageia,apache2-mod_php7SUSE +51 more +53 moreImportant: gd security update6.5 Medium- No product listedTenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform...9.8 Critical
- persesPerses project query parameter authorization bypass exposes cross-project resources7.1 High
- persesPerses: Unvalidated project parameter enables filesystem path traversal7.1 High
- persesPerses: Missing authorization in datasource proxy allows cross-scope secret disclosure8.3 High
- borgbackup borgborg extract might modify out-of-tree files when extracting maliciously crafted archives5.3 Medium
- No product listedA Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger component of xxl-job v3...6.5 Medium
- No product listedA reflected cross-site scripting (XSS) vulnerability in the /logo.asp component of FS Inc S3150...6.1 Medium
- No product listedAn issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows...9.8 Critical
- No product listedAn issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management...7.4 High
- No product listedAn issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary...9.8 Critical
- No product listedPrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery ...8.8 High
- No product listedTR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10,...9.8 Critical
- No product listedTR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10,...9.8 Critical
- No product listedTR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in...7.2 High
- No product listedTR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10,...9.8 Critical
- No product listedSourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin...9.8 Critical
- No product listedSourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php...9.8 Critical
- mz automation lib60870MZ Automation lib60870 Out-of-bounds Read6.9 Medium
- mz automation lib60870MZ Automation lib60870 Out-of-bounds Read6.9 Medium
- drakkan sftpgoSFTPGo < 2.7.4 Permission Bypass via Symbolic Link Creation5.3 Medium
- mz automation libiec61850MZ Automation libiec61850 Out-of-bounds Read7.1 High
- mz automation libiec61850MZ Automation libiec61850 Out-of-bounds Read7.1 High
- mz automation libiec61850MZ Automation libiec61850 Out-of-bounds Read7.1 High
- Show moreLoading…