CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- redhat 389 directory server, directory server, red hat directory server 11.5 e4s for rhel 8 +22 more +24 more389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check7.5 High
- redhat 389 directory server, directory server, red hat directory server 11.5 e4s for rhel 8 +22 more +24 more389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing7.5 High
- red hat advanced cluster security 4Stackrox: stackrox: deploy-time policy enforcement and visibility bypass via label injection8.5 High
- mailerpress – newsletter, email marketing & ai automationMailPress <= 1.5.0 - Missing Authorization to Unauthenticated Contact Updates5.3 Medium
- mailerpress – newsletter, email marketing & ai automationMailerPress <= 1.5.0 - Missing Authorization to Unauthenticated Arbitrary Modification via REST API Endpoint5.3 Medium
- andritz hipase-250, 250 scala +1 moreUse of hard-coded VNC credentials in the engineering-workstation provisioning8.1 High
- andritz 250 scala, hipase-250 +1 moreMissing authentication for logging-configuration endpoint5.3 Medium
- andritz 250 scala, hipase-250 +1 moreMissing authentication and permissive CORS policy7.5 High
- andritz 250 scala, hipase-250 +1 moreStorage of passwords in a reversible format7.5 High
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check3.4 Low
- red hat build of keycloak 26.6, build of keycloak 26.6.8, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass3.7 Low
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction6.8 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes6.5 Medium
- red hat build of keycloak, data grid 8, jboss enterprise application platform expansion pack +1 more +3 moreKeycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains4.2 Medium
- red hat build of keycloak, build of keycloak 26.6, build of keycloak 26.6.8 +3 more +5 moreKeycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim6.5 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints4.9 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant6.8 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +5 more +7 moreKeycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution3.4 Low
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero4.2 Medium
- unknown shopmonitor.ioShopMonitor.io < 1.2.0 - Unauthenticated Administrator Account Takeover via Password-Reset Email Reroute9.8 Critical
- palscode support genixSupport Genix Lite < 1.4.48 - Unauthenticated Ticket Attachment Download via Missing Authorization3.7 Low
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps < 3.29.9 - Unauthenticated Stored Cross-Site Scripting via Form Field8.8 High
- unknown elementskit elementor addonsElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite)3.5 Low
- tomdever wpforo forumwpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR5.4 Medium
- unknown miniorange 2faminiOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret8.1 High
- kodezen llc academy lmsAcademy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint4.3 Medium
- unknown buddypressBuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR5.4 Medium
- unknown elementskit elementor addonsElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)7.2 High
- themeum kirkiKirki < 6.0.13 - Unauthenticated SQL Injection8.6 High
- themeum kirkiKirki < 6.0.13 - Unauthenticated PHP Object Injection7.5 High
- ultimate member member, unknown ultimate member +1 moreUltimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field8.1 High
- unknown wp go maps, wp go maps (formerly wp google maps) go maps +1 moreWP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter3.7 Low
- unknown product feed manager for woocommerceProduct Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter8.1 High
- joomsky js help deskJS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure via IDOR6.5 Medium
- unknown geeky botGeekyBot < 1.2.8 - Unauthenticated Sensitive Information Exposure via Chat History7.5 High
- joomsky js help deskJS Help Desk < 3.1.4 - Contributor+ User Email Disclosure6.5 Medium
- joomsky js help deskJS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload7.5 High
- joomsky js help deskJS Help Desk < 3.1.4 - Subscriber+ Ticket Reply Modification via IDOR4.3 Medium
- joomsky js help deskJS Help Desk < 3.1.4 - Subscriber+ Sensitive Information Disclosure via checkAIReplyTicketsBySubject6.5 Medium
- unknown fluentcart a new era of ecommerceFluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes3.7 Low
- opajaap wp photo album plusWP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo Comment6.1 Medium
- brainstorm force ultimate addons for wpbakery page builderUltimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons Shortcode6.1 Medium
- unknown paid membership subscriptionsPaid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export Files3.7 Low
- unknown paid membership subscriptionsPaid Member Subscriptions < 3.0.7 - Subscriber+ Payment Data Disclosure via IDOR4.3 Medium
- ice00 newstatpressNewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget6.1 Medium
- unknown events made easyEvents Made Easy < 3.1.4 - Unauthenticated Person Data Modification via IDOR5.3 Medium
- unknown mailgun for wordpressMailgun for WordPress < 2.2.1 - Unauthenticated Arbitrary Mailgun List Subscription via add_list AJAX6.5 Medium
- unknown lightbox with photoswipeLightbox with PhotoSwipe < 5.9.0 - Author+ Stored XSS via data-lbwps-caption Attribute6.8 Medium
- unknown flxwooFlxWoo < 3.1.1 - Unauthenticated Payment Bypass7.5 High
- unknown check & log emailCheck & Log Email < 2.0.15 - Admin+ SQL Injection via d and s Parameters6.5 Medium
- Show moreLoading…