Skip to content
OpenAdvisories

Archive

13 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /13 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-15598 Public exploit

    antv layout object.js setNestedValue prototype pollution

    A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in the library lib/util/object.js. Executing a manipulation of the argument path can lead to improperly controlled modification of object prototype attributes. The a…

    antv layout
  • Critical 9.5
    CVE-2026-6875 Public exploit Scanner template

    Sandbox Escape in ServiceNow AI Platform

    ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform. ServiceNow add…

    ServiceNow ServiceNow AI Platform
  • High 7.8
    CVE-2026-53365 Public exploit

    vsock/virtio: fix zerocopy completion for multi-skb sends

    In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix zerocopy completion for multi-skb sends When a large message is fragmented into multiple skbs, the zerocopy uarg is only allocated and attached to the last skb in the loop. …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-61500 Public exploit

    Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key

    Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of logi…

    rejetto hfs
  • Critical 9.8
    CVE-2026-60121 Public exploit

    Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via ping.php

    Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote attackers to execute arbitrary commands by exploiting a double-evaluation flaw in shell argument handling. The endpoint…

    VITEC Flamingo
  • Critical 10.0
    CVE-2026-57811 Public exploit

    WordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Remote Code Inclusion.This issue affects Realtyna Organic IDX plugin: from n/a through <= 5.2.0.

    Realtyna Realtyna Organic IDX plugin
  • High 8.8
    CVE-2026-57830 Public exploit

    Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7

    Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticated arbitrary file deletion.

    joomshaper.com Helix Ultimate extension for Joomla Web / CMS
  • High 8.7
    CVE-2026-57829 Public exploit

    Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7

    Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticated stored XSS.

    joomshaper.com Helix Ultimate extension for Joomla Web / CMS