Archive
23 July 2026
Vulnerabilities first published on this day (UTC), newest first.
56 results · Clear filters · Feed
-
Critical 9.1
Azure Red Hat OpenShift (ARO) Elevation of Privilege Vulnerability
Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network.
-
Critical 9.9
Microsoft Surface Remote Code Execution Vulnerability
Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network.
-
Critical 9.8
Microsoft Account Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network.
-
Critical 10.0
Unintended Proxy or Intermediary in Panduit IntraVUE by Pronetiqs
Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, which would bypass OT segmentation.
-
Critical 9.9
9router before 0.4.60 Remote Code Execution via default password
9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) that authenticates any fresh installation, a bypass of the LOCAL_ONLY network gate via a spoofed Host header, and unvalidated arguments passed to child…
-
Critical 10.0CVE-2025-71389 Public exploit
Cal.com before 5.9.9 Remote Code Execution via RSC
Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a craf…
-
Critical 9.9
cal.com Repository Takeover via pull_request_target Workflow
cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pull_request_target trigger with the repository's default write permissions and passes them dow…
-
Critical 9.8CVE-2026-15981 Public exploit
SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer…
-
Critical 9.9
nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at `internal/api…
-
Critical 9.9
CVE-2026-15630
A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).
-
Critical 9.3
DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE
DbGate is cross-platform database manager. In versions 7.1.8 and prior, the `unzipDirectory()` function in `packages/api/src/shell/unzipDirectory.js` (line 27) does not validate that extracted file paths stay within the output directory. A malicious ZIP with …
-
Critical 9.4
DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection
DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized `functionName` param…
-
Critical 9.8
Appriss Insights VINE SQLI
The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an unauthenticated attacker to send a specially-crafted request to bypass the login page, access other users' credentials, take over other user accounts, access …
-
Critical 10.0
DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` va…
-
Critical 10.0CVE-2026-6516 Public exploit
Remote Code Execution
Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.
-
Critical 9.1
SoftVC VITS Singing Voice Conversion Path Traversal via /wav2wav Flask Route
SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inference server that allows unauthenticated remote attackers to read and exfiltrate arbitrary files by supplying attacker-controlled filesyst…
-
Critical 9.8
h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API
h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the be…
-
Critical 9.9
Tugtainer has Server-Side Template Injection in notification templates that leads to Remote Code Execution
Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection (SSTI) in the notification template feature. The `title_template` and `body_template` fields are rendered usi…
-
Critical 9.3
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessi…
-
Critical 9.2
Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1
Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system.
-
Critical 9.1
Unverified email-based SSO account linking
Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.
-
Critical 9.1
LOIDC nonce validation bypass
Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding.
-
Critical 9.1
Local MFA not enforced during SSO sign-in
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.
-
Critical 9.1
Principal/domain lookup without case normalization
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities.
-
Critical 9.8
Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Database Download
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted reques…
-
Critical 9.8
Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Font Processing
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request.…
-
Critical 9.8
Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via SVG Processing
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. …
-
Critical 9.1
In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible
-
Critical 9.6
SiYuan before v3.7.2 Cross-Site Scripting to RCE
SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon paramet…
-
Critical 9.6
SiYuan before v3.7.2 Stored XSS to RCE via Attribute View
SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag …
-
Critical 10.0
In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session
-
Critical 10.0
In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session
-
Critical 9.6
WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions.
-
Critical 9.1
WordPress Really Simple CSV Importer plugin <= 1.3 - Arbitrary File Upload vulnerability
Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.
-
Critical 9.1
WordPress MapSVG plugin <= 8.14.0 - Arbitrary File Upload vulnerability
Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.
-
Critical 9.8
WordPress TrueBooker plugin <= 1.2.3 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions.
-
Critical 9.3
WordPress TrueBooker plugin <= 1.2.3 - SQL Injection vulnerability
Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions.
-
Critical 9.3
WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bookly Bookly bookly-responsive-appointment-booking-tool allows Blind SQL Injection.This issue affects Bookly: from n/a through 27.7.
-
Critical 9.3
WordPress WPDM – Premium Packages plugin <= 6.2.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.
-
Critical 10.0
WordPress Participants Database plugin <= 2.7.8.3 - Arbitrary File Deletion vulnerability
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.