Skip to content
OpenAdvisories

Archive

8 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /8 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-44024 Public exploit

    Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder

    Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamically constructing file paths using the ${tag} placeholder, and insufficient validation of ${tag} in …

    fluent fluentd kube-fluentd-operator ruby3.4-kube-logging-operator-fluentd-outputs Wolfi RubyGems
  • Medium 4.7
    CVE-2026-14361 Public exploit

    Consul-template is vulnerable to path redirection in writeToFile through symlink attack

    The consul-template library before version 0.42.1 is vulnerable to a path redirection issue in the writeToFile template helper that may allow template output to be written outside the intended directory or to overwrite an existing file. This vulnerability (CV…

    HashiCorp Tooling
  • High 8.8
    CVE-2026-59822 Exploited Public exploit

    LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallbac…

    BerriAI litellm litellm PyPI
    KEV Sep 2, 2026
  • High 7.5
    CVE-2026-44840 Public exploit

    Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

    Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `checkpw…

    dgraph-io dgraph github.com/dgraph-io/dgraph github.com/dgraph-io/dgraph/v25 Go
  • Critical 9.8
    CVE-2026-58480 Public exploit

    Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachments

    Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the Ad…

    Creative Themes Blocksy Companion Web / CMS
  • Critical 9.1
    CVE-2026-41042 Public exploit Scanner template

    Apache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter

    Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: before 1.2.1. Users ar…

    Apache Software Foundation Apache Gravitino
  • High 8.2
    CVE-2026-57239 Public exploit

    Foxit PDF Editor/Reader Local Privilege Escalation

    The user-controllable executable files will be directly executed by high-privilege processes, allowing low-privilege users to have the opportunity to elevate their privileges to NT AUTHORITY\SYSTEM.

    Foxit Foxit PDF Reader foxit_pdf_editor
  • Medium 6.8
    CVE-2026-36027 Public exploit

    An issue in Code27 Companion Hub SQ3A.220705.003.A1 allows a physically proximate attacker to execute arbitrary code vi…

  • Critical 9.8
    CVE-2026-31309 Public exploit

    Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows …

  • Critical 9.8
    CVE-2026-52200 Public exploit

    An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /aja…