Skip to content
OpenAdvisories

Archive

9 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /9 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

130 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-12517

    Fediverse Embeds < 1.5.8 - Unauthenticated SSRF via Site Info Endpoint

    The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthenticated site-info endpoint before fetching it, allowing anonymous users (the gating nonce is exposed on public pages carryi…

    Web / CMS
  • Medium 5.3
    CVE-2026-11875

    WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated Support Ticket Access via Session Cookie Forgery

    The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sign or verify its guest-session cookie, allowing unauthenticated attackers to forge it and impersonate any ticket owner (identified by email address) to read, reply to, and …

    Web / CMS
  • Medium 5.3
    CVE-2026-11869

    WP DSGVO Tools (GDPR) < 3.1.40 - Unauthenticated Sensitive Information Disclosure via Subject Access Request

    The WP DSGVO Tools (GDPR) WordPress plugin before 3.1.40 does not perform an authorization check on the immediate-processing path of its data subject access request feature, allowing unauthenticated attackers to generate and download the full personal-data ex…

    Web / CMS
  • Medium 5.3
    CVE-2026-12516

    Fediverse Embeds < 1.5.8 - Unauthenticated SSRF via Media Proxy

    The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthenticated media-proxying endpoint, allowing anonymous users to make the site fetch arbitrary URLs, including internal and pri…

    Web / CMS
  • Medium 6.5
    CVE-2026-12270

    Everest Forms < 3.5.0 - Unauthenticated Missing Authorization via Site Assistant REST Endpoints

    The Everest Forms WordPress plugin before 3.5.0 does not correctly restrict access to several REST API endpoints belonging to its onboarding assistant: the capability check is only applied when an attacker-controllable request header holds a specific value, s…

    Web / CMS
  • Medium 6.3
    CVE-2026-15138

    tumf mcp-text-editor text_editor.py _validate_file_path path traversal

    A security vulnerability has been detected in tumf mcp-text-editor up to 1.0.2. This issue affects the function _validate_file_path of the file mcp_text_editor/text_editor.py. Such manipulation of the argument file_path leads to path traversal. The attack can…

    tumf mcp-text-editor
  • Medium 5.5
    CVE-2026-39243

    decompress allows arbitrary hardlink creation during archive extraction

    decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() …

    decompress npm
  • Medium 6.2
    CVE-2026-39245

    decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file…

  • Medium 5.7
    CVE-2026-31267

    Mercusys MW302R MW302R(EU)_V1_1.4.10 Build 231023 is vulnerable to Buffer Overflow in the administrative web interface.…

  • Medium 6.5
    CVE-2026-51598

    An input validation vulnerability in the RTSP service of MERCURY MIPC252W IP Camera v1.0.5 Build 230306 Rel.79931n) all…