Skip to content
OpenAdvisories

Archive

1 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /1 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Low 2.3
    CVE-2026-54786

    Wasmtime: Leak in WASIp1 `fd_renumber` implementation

    Wasmtime is a runtime for WebAssembly. All versions prior to 24.0.10; versions 25.0.0 through those before 36.0.11; versions 37.0.0 through those before 44.0.3; and versions 45.0.0 and 45.0.1 contain a native implementation of WASIp1 which suffers from a leak…

    bytecodealliance wasmtime rust-wasmtime rust-wasmtime Debian Ubuntu crates.io
  • Low —
    GHSA-hwmc-r6mf-jh83

    Schema.org has cross-site scripting (XSS) via script break-out in toScript() output

    Schema.org has a cross-site scripting (XSS) vulnerability via script break-out in toScript() output.

    spatie/schema-org Packagist
  • Low 2.1
    CVE-2026-58036

    Users API leaks whether privileged users have their user groups disabled for lack of 2FA

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryAllUsers.Php, includes/Api/ApiQueryUsers.Php, includes/Permissions/PermissionM…

    Wikimedia Foundation MediaWiki mediawiki Web / CMS Ubuntu
  • Low 2.4
    CVE-2026-8387

    Relative Path Traversal in allegroai/clearml

    A vulnerability in allegroai/clearml versions up to and including 1.16.5 allows for relative path traversal when extracting `.zip` archives using the `ZipFile.extractall()` method in `StorageManager._extract_to_cache()`. This issue arises due to the lack of p…

    Allegro.AI allegroai/clearml
  • Low 3.1
    CVE-2026-11880

    Fluent Forms < 6.2.1 - Subscriber+ Subscription Cancellation via IDOR

    The Fluent Forms WordPress plugin before 6.2.1 does not properly verify ownership before processing a subscription cancellation request, allowing authenticated users with a low-privilege account to cancel subscriptions belonging to other users.

    Web / CMS
  • Low 3.7
    CVE-2026-44042

    UltraVNC repeater wi_uudecode off-by-one in base64 decode boundary check

    UltraVNC repeater through 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for HTTP Basic authentication. In repeater/webgui/webutils.c:817, the wi_uudecode() function checks whether the input length exceeds the output buffer with a stric…

    uvnc UltraVNC
  • Low 3.3
    CVE-2026-41579

    runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations

    runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs, setupPtmx and setupDevSymlinks call os.Remove and…

    opencontainers runc k3s-static-1.32 falco-no-driver Debian Ubuntu Azure Linux Alpine Wolfi Go