Skip to content
OpenAdvisories

Archive

7 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /7 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.8
    CVE-2026-23697 Public exploit

    Vtiger CRM < 8.4.0 Authenticated File Upload RCE via Documents Module

    Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file containing arbitrary PHP code through the Documents module, bypassing the extension denylis…

    Vtiger Vtiger CRM
  • High 7.2
    CVE-2026-23698 Public exploit

    Vtiger CRM 8.4.0 Authenticated RCE via Module Import File Upload

    Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature that allows administrator-level attackers to upload arbitrary PHP files by submitting a crafted zip archive through the ModuleManager imp…

    Vtiger Vtiger CRM
  • High 7.8
    CVE-2026-57851 Public exploit

    MSI KernCoreLib64.sys Privilege Escalation via IOCTL Handlers

    MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allows any locally logged-on user to perform arbitrary physical memory read/write and unrestricted I/O port operations by accessing exposed IOC…

    Micro-Star International (MSI) KernCoreLib64.sys
  • Medium 4.8
    CVE-2026-12948 Public exploit

    Stored Cross-Site Scripting (XSS)

    A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allows a remote, authenticated administrator to inject script into certain system configuration fields. T…

    Digi International Digi PortServer TS Digi One SP Digi One IA
  • Medium 5.9
    CVE-2026-12352 Public exploit

    Incorrect Authorization

    This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device.

    Digi International Digi One SP / SP IA / IA PortServer TS 1/2/4
  • High 8.7
    CVE-2026-12277 Public exploit

    Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Deletion via Saved File Metadata Path Traversal

    The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php) when guest…

    Web / CMS
  • Critical 9.9
    CVE-2026-34048 Public exploit

    Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal websocket bootstrap routes only check authentication and do not enforce terminal authorization, allowing a low-privileged tea…

    coollabsio coolify