CVEs published in July 2026
10,022 vulnerabilities, 1,307 critical, 23 exploited.
- dynatrace-oss dynatrace-mcpDynatrace MCP Server: Unauthenticated HTTP MCP Tool Invocation in `@dynatrace-oss/dynatrace-mcp-server`7.5 High
- dynatrace-oss dynatrace-mcpDynatrace MCP Server: Workflow template injection via create_workflow_for_notification4.2 Medium
- roskus prospero flow crmStored Cross-site Scripting in Prospero Flow CRM lead name field5.3 Medium
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)9.4 Critical
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)9.4 Critical
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers5.3 Medium
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner9.3 Critical
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-12046)6.9 Medium
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution7.7 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)8.7 High
- hfiref0x lightftpLightFTP 2.3.1 Race Condition DoS via worker_thread_cleanup8.2 High
- dynatrace-oss dynatrace-mcpDynatrace MCP Server: DQL injection via parameters not documented as DQL4.3 Medium
- zephyrproject zephyrMissing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routers5.8 Medium
- red hat ansible automation platform 2, ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9 +1 more +3 moreAap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header8.2 High
- vps.org zulip templateVPS.org one-click Zulip template deployment instance contains multiple vulnerabilities9.8 Critical
- vps.org supabase templateVPS.org one-click Supabase template deployment instance contains multiple vulnerabilities9.1 Critical
- hcl icontrolHCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to...4.3 Medium
- hcl software icontrolHCL iControl is affected by multiple security vulnerabilities.3.7 Low
- ccyl13 pentestifyServer-Side Request Forgery in Pentestify PDF export via unvalidated image URLs5.3 Medium
- hcl software icontrolHCL iControl is affected by multiple security vulnerabilities.3.7 Low
- hcl software icontrolHCL iControl is affected by multiple security vulnerabilities.4.0 Medium
- hcl software icontrolHCL iControl is affected by multiple security vulnerabilities.3.7 Low
- hcl software icontrolHCL iControl is affected by multiple security vulnerabilities.5.1 Medium
- zephyrproject zephyrUse-after-free of GATT subscribe params in Bluetooth host CCC-write response handler7.6 High
- fast-urifast-uri vulnerable to host confusion via backslash authority introducer7.5 High
- s9y serendipitySerendipity < 2.6.1 Open Redirect via exit.php2.1 Low
- flipper code wp mapsWordPress WP Maps plugin <= 4.9.6 - Sensitive Data Exposure vulnerability4.3 Medium
- ufirstgroup ymlrYAML injection via unescaped newlines in ymlr document comments2.1 Low
- stylemix masterstudy lmsWordPress MasterStudy LMS plugin <= 3.7.39 - Broken Access Control vulnerability5.3 Medium
- innotim software, telecommunications and consulting trade ltd. co. logsign siemUnauthenticated RCE in Innotim Software's Logsign SIEM9.8 Critical
- checkmk gmbh checkmkMissing Authorization Allows Editing of Foreign Reports5.3 Medium
- gnome gnome-remote-desktop, red hat enterprise linux 10, enterprise linux 10.0 extended update support +2 more +4 moreGnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of service7.5 High
- bytecodealliance wasmtimeWasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion1.0 Low
- bytecodealliance wasmtimeWasmtime: Preemption and traps during bulk operations enable breaking internal VM state2.0 Low
- php jabbers poll scriptReflected XSS in PHP Poll Script5.1 Medium
- php jabbers poll scriptAuthenticated SQL Injection in PHP Poll Script8.6 High
- gz scripts car rental script, event booking calendar, property listing script +32 more +34 moreCSRF in PHP Jabbers scripts6.9 Medium
- gz scripts car rental script, event booking calendar, property listing script +32 more +34 moreAuthenticated SQL Injection in PHP Jabbers scripts8.6 High
- gz scripts car rental scriptUnauthenticated SQL Injection in PHP Jabbers - Car Rental Script script9.3 Critical
- apache zeppelinPath traversal in NotebookRepo note and folder path composition6.5 Medium
- ai nanoidnanoid: Integer Overflow or Wraparound7.4 High
- nodejs nodeA flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in...6.2 Medium
- nodejs nodeA flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding...3.7 Low
- nodejs nodeA flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response...5.9 Medium
- nodejs nodeA flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync...5.3 Medium
- nodejs nodeA flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory...7.5 High
- apache httpclient, apache software foundation httpcomponents client +1 moreApache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS5.3 Medium
- apache kyuubiApache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases8.1 High
- techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builderFluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter5.3 Medium
- hikvision ds-3wap521-si, ds-3wap522-si, ds-3wap621e-si +7 more +9 moreSome Hikvision Wireless Access Points are vulnerable to authenticated command execution due to...7.2 High
- Show moreLoading…