Skip to content
OpenAdvisories

Archive

15 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /15 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-49352 Public exploit

    9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass

    9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.js, allowing attack…

    decolua 9Router 9router npm
  • Critical 10.0
    CVE-2026-46339 Public exploit Scanner template

    9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes

    9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js a…

    decolua 9Router 9router npm
  • Critical 10.0
    CVE-2026-52887 Public exploit

    NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE

    NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestMsgReceiveTim…

    nocobase nocobase @nocobase/plugin-notification-in-app-message npm
  • Critical 9.8
    CVE-2026-14960 Public exploit

    CVE-2026-14960

    Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface. IOCTL handlers including `TDE_IOCTL_INDEXIO_READ` and `TDE_IOCTL_INDEXIO_WRITE` permit unprivileged user-mode callers to perform arbit…

    Pegatron Tdelo64.sys
  • High 8.8
    CVE-2026-45805 Public exploit

    Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

    Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP's mcp/packages/server/src/ReplServer.ts bound the ReplServer to 0.0.0.0:4403 and exposed an unauthenticated /execute endpoint that passed the code field to Plu…

    penpot penpot @penpot/mcp npm
  • High 7.7
    CVE-2026-45806 Public exploit

    Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-url

    Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot's remote image import passed the user-controlled url from frontend/src/app/main/data/workspace/media.cljs into the backend RPC method :create-file-media-object-fro…

    penpot penpot
  • High 8.1
    CVE-2026-42533 Public exploit

    NGINX Map directive and Regex matching vulnerability

    A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achiev…

    F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  • Critical 9.1
    CVE-2026-43637 Public exploit

    Cornac < 2.6.0 Path Traversal via _extract_archive() in download.py

    Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allows attackers to write arbitrary files outside the intended cache directory by supplying a crafted TAR archive containing ../ sequences, absolute paths, or symlink/hardlink entries…

    PreferredAI cornac cornac PyPI
  • High 8.1
    CVE-2026-57821 Public exploit

    Apache Fineract: Office list: SQL Injection via Subquery in orderBy

    A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated u…

    Apache Software Foundation Apache Fineract
  • High 8.6
    CVE-2026-15583 Public exploit

    SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header

    A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrar…

    Grafana Grafana MCP Server Web / CMS
  • High 8.2
    CVE-2026-13585 Public exploit

    Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in…

    ASUS System Control Interface System Control Interface v3 Business Manager
  • High 7.5
    CVE-2026-36590 Public exploit

    An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function i…

  • Critical 9.8
    CVE-2026-30623 Public exploit Scanner template

    LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The applicatio…

  • Medium 6.1
    CVE-2026-26719 Public exploit

    Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a cr…

  • Critical 9.1
    CVE-2026-26718 Public exploit

    A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an at…