Skip to content
OpenAdvisories

Archive

7 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /7 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Low 3.7
    GHSA-cwv4-h3j5-w3cf

    rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

    Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3 ## Summary `plabayo/rama` contains a stored/reflected cross-site scripting issue in the `ServeDir` HTML directory listing feature. When `ServeDir` is configured with `Di…

    rama crates.io
  • Low —
    GHSA-gq4g-fpc9-vjfq

    Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection

    ## Impact `Webauthn\SimpleFakeCredentialGenerator` is the library-provided default implementation of the `FakeCredentialGenerator` interface. It returns a stable list of decoy `PublicKeyCredentialDescriptor` objects for a given username so that an assertion r…

    web-auth/webauthn-lib Packagist
  • Low 2.1
    CVE-2026-59153

    Anki's local HTTP server does not sufficiently validate requests

    Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its interface, but requests from other origins were not sufficiently blocked. A malicious website coul…

    ankitects anki anki aqt Ubuntu PyPI
  • Low 3.1
    CVE-2026-28378

    Cross-Organization Public Dashboard Deletion via Missing Org Isolation

    The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.

    Grafana Grafana OSS Grafana Enterprise Web / CMS
  • Low 3.9
    CVE-2026-55592 Scanner template

    Dashy: XSS in workspace url parameter

    Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascrip…

    lissy93 dashy
  • Low —
    GHSA-7856-g3gv-9wq8

    netfoil: Attacker controlled data written to logs

    ### Summary Domain names were written to the log without first being validated to contain allowed characters. ### Impact Depends on how the logs were used.

    github.com/tinfoil-factory/netfoil Go
  • Low —
    GHSA-3g4q-2f67-2gvh

    netfoil has a resource leak in LRU cache

    ### Summary When an entry was removed from the LRU cache, a pointer to the removed element was not properly cleaned up. ### Impact A local attacker can get netfoil to use more memory. By default this is limited to 100MB via systemd, which would trigger servic…

    github.com/tinfoil-factory/netfoil Go
  • Low 3.7
    CVE-2026-14935

    Gstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence check

    A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  • Low 2.7
    CVE-2026-27844

    Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticate…

    Gallagher Controller 7000 and 6000
  • Low 2.7
    CVE-2026-27790

    Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by…

    Gallagher T-20 Readers
  • Low 3.3
    CVE-2026-42201

    Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, database credential fields (redis_password, keydb_password, dragonfly_password, clickhouse_admin_user, clickhouse_admin_password, post…

    coollabsio coolify
  • Low 3.3
    CVE-2026-34149

    Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, DatabaseBackupJob interpolates user-controlled database credentials and MongoDB collection exclusion names into backup shell commands …

    coollabsio coolify
  • Low 3.1
    CVE-2026-42145

    Coolify: File Upload Without Type or Size Validation in Database Backup Restore

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the file upload endpoint (app/Http/Controllers/UploadController.php) for database backup restore uploads did not enforce file type or …

    coollabsio coolify
  • Low 3.1
    CVE-2026-42172

    Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Access

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Sanctum API tokens did not expire, allowing a leaked token to retain access indefinitely until manually revoked. This issue is fixed i…

    coollabsio coolify