Skip to content
OpenAdvisories

Archive

17 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /17 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-63030 Exploited Public exploit Scanner template EPSS 11%

    WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

    WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Re…

    WordPress WordPress wordpress wordpress Web / CMS Debian Ubuntu
    KEV Jul 21, 2026
  • Medium 5.9
    CVE-2026-60137 Exploited Public exploit

    WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

    WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

    WordPress WordPress wordpress wordpress Web / CMS Debian Ubuntu
    KEV Jul 21, 2026
  • Critical 9.8
    CVE-2026-9198 Exploited Public exploit Scanner template EPSS 29%

    Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

    IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments

    IBM Langflow OSS
    KEV Aug 4, 2026
  • Critical 9.3
    CVE-2026-9586 Exploited Public exploit Scanner template EPSS 19%

    Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB

    An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries wit…

    Sangoma Switchvox SMB Edition
    KEV Sep 2, 2026