Skip to content
OpenAdvisories

Archive

2 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /2 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-54477 Public exploit

    Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax

    The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks.

    Gardyn Gardyn Studio Firmware Gardyn Home Firmware Gardyn Cloud API
  • Medium 5.3
    CVE-2026-55726 Public exploit

    Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control Sphere

    The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container.

    Gardyn Gardyn Studio Firmware Gardyn Home Firmware Gardyn Cloud API
  • Critical 10.0
    CVE-2026-13768 Public exploit

    Gardyn IoT Hub Use of Hard-coded Credentials

    Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key also allows a …

    Gardyn Gardyn Studio Firmware Gardyn Home Firmware Gardyn Cloud API
  • Critical 9.8
    CVE-2026-58455 Public exploit Scanner template

    Dockwatch 0.6.567 Unauthenticated OS Command Injection via ajax/compose.php

    Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands by exploiting a missing exit() after an authentication redirect in loader.php combined with unsanitized i…

    Notifiarr dockwatch
  • Critical 10.0
    CVE-2026-50746 Public exploit

    A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Conn…

    Ubiquiti UniFi Connect Application Network devices
  • Medium 5.5
    CVE-2026-12166 Public exploit

    CVE-2026-12166

    A NULL pointer dereference vulnerability for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to cause a denial of service via crafted requests that trigger a system crash.

    Little Orbit GameFirst Anti-Cheat
  • Critical 9.8
    CVE-2026-5524 Public exploit Scanner template

    Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter

    The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the do_image_upload() function where user-su…

    Divi Engine Divi Form Builder Web / CMS
  • Medium 4.4
    CVE-2026-10104 Public exploit

    Product Video Gallery for Woocommerce <= 1.5.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via custom_thumbnail Parameter

    The Product Video Gallery for Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom_thumbnail Parameter in all versions up to, and including, 1.5.1.8 due to insufficient input sanitization and output escaping. This makes it …

    nikhilgadhiya Product Video Gallery for Woocommerce Web / CMS