Skip to content
OpenAdvisories

Archive

17 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /17 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Medium 5.6
    CVE-2026-46420 Public exploit

    setup-php: Command Injection in Repository-Derived PHP Version Resolution

    setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock t…

    shivammathur setup-php shivammathur/setup-php GitHub Actions
  • Critical 9.8
    CVE-2026-63030 Exploited Public exploit Scanner template EPSS 11%

    WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

    WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Re…

    WordPress WordPress wordpress wordpress Web / CMS Debian Ubuntu
    KEV Jul 21, 2026
  • Medium 5.9
    CVE-2026-60137 Exploited Public exploit

    WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

    WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

    WordPress WordPress wordpress wordpress Web / CMS Debian Ubuntu
    KEV Jul 21, 2026
  • Critical 9.8
    CVE-2026-9198 Exploited Public exploit Scanner template EPSS 29%

    Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

    IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments

    IBM Langflow OSS
    KEV Aug 4, 2026
  • Critical 9.3
    CVE-2026-9586 Exploited Public exploit Scanner template EPSS 19%

    Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB

    An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries wit…

    Sangoma Switchvox SMB Edition
    KEV Sep 2, 2026
  • High 7.1
    CVE-2026-14871 Public exploit

    osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure

    osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Object Reference (IDOR) in the AJAX ticket-management subsystem.

    osTicket osTicket
  • High 7.7
    CVE-2026-62201 Public exploit

    OpenClaw < 2026.6.6 Network Policy Bypass via exec-server

    OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust callers to reach internal network destinations blocked by OpenClaw policy. Attackers can send HTTP requests through the exec-ser…

    OpenClaw OpenClaw
  • High 8.1
    CVE-2025-60357 Public exploit

    AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentE…

  • Critical 9.8
    CVE-2026-36669 Public exploit

    An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11.13.11 allows remote…

  • Critical 9.1
    CVE-2026-52199 Public exploit

    An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin…

  • High 7.5
    CVE-2026-51833 Public exploit

    Xenforo 2.3.8 is vulnerable to SSRF. Attackers that have administrator privileges or are able to add/save RSS feeds can…