14 July 2026

9 results · Clear filters · Feed

• Critical 9.3
  CVE-2026-48356 Exploited Public exploit EPSS 47%

  Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)

  Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or sessio…

  Adobe Adobe Commerce Adobe Commerce B2B Magento Open Source Web / CMS
  Jul 14, 2026

  KEV Oct 27, 2026
• Critical 10.0
  CVE-2026-15409 Exploited · Ransomware Public exploit Scanner template

  A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A…

  SonicWall SMA1000 Network devices
  Jul 14, 2026

  KEV Jul 14, 2026
• Critical 9.8
  CVE-2026-13001 Public exploit Scanner template

  Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter

  The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'podlove_handle_cache_files' function in all versions up to, and including, 4.5.1. This makes it possible for unauthenticated…

  eteubert Podlove Podcast Publisher Web / CMS
  Jul 14, 2026
• Critical 9.8
  CVE-2026-47429 Public exploit

  Vitest: Arbitrary file can be read and executed when Vitest UI server is listening

  Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API wri…

  vitest-dev vitest vitess-23 vitest Wolfi npm
  Jul 14, 2026
• Critical 9.8
  CVE-2026-56190 Public exploit

  Remote Desktop Protocol Remote Code Execution Vulnerability

  Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network.

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Jul 14, 2026
• Critical 9.8
  CVE-2026-55944 Public exploit

  Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

  Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network.

  Microsoft Microsoft Dynamics NAV 2018
  Jul 14, 2026
• Critical 9.1
  CVE-2026-55040 Exploited Public exploit Scanner template EPSS 70%

  Microsoft SharePoint Server Security Feature Bypass Vulnerability

  Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.

  Microsoft Microsoft SharePoint Server 2019 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Server Subscription Edition
  Jul 14, 2026

  KEV Aug 18, 2026
• Critical 9.8
  CVE-2026-50522 Exploited Public exploit

  Microsoft SharePoint Remote Code Execution Vulnerability

  Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

  Microsoft Microsoft SharePoint Server 2019 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Server Subscription Edition
  Jul 14, 2026

  KEV Jul 22, 2026
• Critical 9.6
  CVE-2026-59891 Public exploit

  Credential confusion in  @sigstore/oci  can leak registry credentials to an attacker-controlled registry

  sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target regis…

  sigstore sigstore-js @sigstore/oci npm
  Jul 14, 2026