17 July 2026

5 results · Clear filters · Feed

• Critical 9.8
  CVE-2026-63030 Exploited Public exploit Scanner template EPSS 11%

  WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

  WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Re…

  WordPress WordPress wordpress wordpress Web / CMS Debian Ubuntu
  Jul 17, 2026

  KEV Jul 21, 2026
• Critical 9.8
  CVE-2026-9198 Exploited Public exploit Scanner template EPSS 29%

  Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

  IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments

  IBM Langflow OSS
  Jul 17, 2026

  KEV Aug 4, 2026
• Critical 9.3
  CVE-2026-9586 Exploited Public exploit Scanner template EPSS 19%

  Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB

  An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries wit…

  Sangoma Switchvox SMB Edition
  Jul 17, 2026

  KEV Sep 2, 2026
• Critical 9.8
  CVE-2026-36669 Public exploit

  An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11.13.11 allows remote…

  Jul 17, 2026
• Critical 9.1
  CVE-2026-52199 Public exploit

  An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin…

  Jul 17, 2026