Skip to content
OpenAdvisories

Archive

21 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /21 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

654 results · Clear filters · Feed

  • High 8.8
    CVE-2026-11767

    CRT Addons for Elementor < 1.6.7 - Unauthenticated Stored XSS via Contact Form

    The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attack…

    Web / CMS
  • High 7.2
    CVE-2026-6952 Public exploit

    A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-…

    Zyxel AX7501-B1 firmware Network devices
  • High 7.3
    CVE-2026-16332

    D-Link DNS-320 multi_uploadify.php unrestricted upload

    A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multi_uploadify.php. Performing a manipulation of the argument Filedata[] results in unrestricted upload. The attack is possible to be carried out remo…

    D-Link DNS-320 Network devices
  • High 7.3
    CVE-2026-16331

    D-Link DNS-320 save_ajax.php unrestricted upload

    A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function of the file /web/function/save_ajax.php. Such manipulation of the argument Malicious Handler leads to unrestricted upload. The attack can be executed remotely…

    D-Link DNS-320 Network devices
  • High 7.3
    CVE-2026-16330

    D-Link DNS-320 uploadify.php unrestricted upload

    A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function of the file /web/jquery/uploader/uploadify.php. This manipulation of the argument https:/ucn9h68n9289.feishu.cn/wiki/JJcTwHz7aiKeq6kSItMcoeSUnMc?from=from_copy…

    D-Link DNS-320 Network devices
  • High 7.3
    CVE-2026-16329

    D-Link DNS-320 uploadify.php unrestricted upload

    A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /photo_center/php/uploadify.php. The manipulation of the argument Malicious Handler leads to unrestricted upload. The attack may be initiated remotely. The exp…

    D-Link DNS-320 Network devices
  • High 8.1
    CVE-2026-50758

    Cross Site Scripting vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to execute arbitrary …

  • High 7.8
    CVE-2026-50757

    Directory Traversal vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allowsa remote attacker to execute arbitrary co…

  • High 7.5
    CVE-2026-50759

    An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /insta…

  • High 7.5
    CVE-2026-50756

    An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the x-ai-pr…

  • High 7.5
    CVE-2026-30632

    Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to the create_doc tool.

  • High 7.5
    CVE-2026-30633

    Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the get_doc and update_doc tool…

  • High 7.5
    CVE-2026-52474

    An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.

  • High 7.5
    CVE-2026-52476

    SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPag…