Skip to content
OpenAdvisories

Archive

26 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /26 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.4
    CVE-2026-57990

    Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

    Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

    Microsoft Microsoft Edge (Chromium-based) Browsers
  • High 7.4
    CVE-2026-57989

    Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

    Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

    Microsoft Microsoft Edge (Chromium-based) Browsers
  • High 8.3
    CVE-2026-17497

    NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python

    NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|exec…

    codexu NoteGen
  • High 8.1
    CVE-2026-17496

    NoteGen chat preview XSS via unsanitized AI/skill HTML rendering

    NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that re…

    codexu NoteGen
  • High 7.5
    GHSA-xg7c-246g-6qpv

    Remote Denial of Service via malformed NIP-04 IV

    The `nostr` crate did not validate the length of the initialization vector decoded from the `?iv=` portion of a NIP-04 encrypted message. The decoded IV was converted from a byte slice to the 16-byte AES-CBC IV type using a conversion that asserts the slice l…

    nostr crates.io
  • High 7.8
    CVE-2024-14040

    net: nexthop: Increase weight to u16

    In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Increase weight to u16 In CLOS networks, as link failures occur at various points in the network, ECMP weights of the involved nodes are adjusted to compensate. With high fan-ou…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-63720 Public exploit

    datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field

    datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free…

    koxudaxi datamodel-code-generator
  • High 8.8
    CVE-2026-15962

    Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field

    The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access an…

    techjewel Fluent Forms Pro Add On Pack Web / CMS