Skip to content
OpenAdvisories

Archive

10 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /10 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-49844 Public exploit

    Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()

    Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-…

    Apache Software Foundation Apache Log4j API druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 5.1
    CVE-2026-14461 Public exploit

    Out-of-bound read in mtr

    mtr is vulnerable to Out-of-bound read vulnerability in ipinfo_lookup() function. An attacker who can influence the TXT response used for AS lookups can trigger this bug by returning a DNS response that is larger than 512 bytes and uses a crafted compression …

    BitWizard mtr mtr mtr Debian Ubuntu Azure Linux
  • Medium 6.4
    CVE-2026-13247 Public exploit

    Logo Slider <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lgx_tooltip_position' Parameter

    The Logo Slider – Logo Carousel, Client Logo Slider & Brand Showcase for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lgx_tooltip_position' parameter in all versions up to, and including, 5.5 due to insufficient input s…

    logichunt Logo Slider WP – Responsive Logo Carousel, Logo Gallery & Logo Showcase Web / CMS
  • Medium 4.3
    CVE-2026-6440 Public exploit

    GoodMeet <= 1.1.8 - Cross-Site Request Forgery to Google Meet Credential Reset via 'goodmeet_reset_google_meet_credential'

    The GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.1.8. This is due to a missing nonce verification in the reset_credential() functi…

    Sovlix GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference Web / CMS
  • Medium 4.3
    CVE-2026-12400 Public exploit

    FlowForms <= 1.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification via REST API '/flowforms/v1/forms/{id}' Endpoints

    The FlowForms – Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1 via the update_form due to missing validation on a user controlled key. This makes it possible for a…

    priyanshuchaudhary FlowForms – Conversational Form Builder Web / CMS