Skip to content
OpenAdvisories

Archive

27 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /27 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

443 results · Feed

  • High 7.1
    CVE-2026-65447

    WordPress Contest Gallery plugin <= 30.0.6 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.

    Wasiliy Strecker / ContestGallery developer Contest Gallery
  • Medium 6.5
    CVE-2026-65448

    WordPress Anti Spam and list cleaner – AcyChecker plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleaner &#8211; AcyChecker <= 1.8.1 versions.

    AcyMailing Newsletter Team Anti Spam and list cleaner &#8211; AcyChecker
  • High 7.1
    CVE-2026-65446

    WordPress Kali Forms plugin <= 2.4.18 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions.

    WP Chill Kali Forms
  • Medium 6.5
    CVE-2026-65445

    WordPress Ad Invalid Click Protector (AICP) plugin <= 1.3.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions.

    iSaumya Ad Invalid Click Protector (AICP)
  • High 7.1
    CVE-2026-65443

    WordPress BackWPup plugin <= 5.7.4 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions.

    WP Media BackWPup
  • High 7.2
    CVE-2026-65442 Scanner template

    WordPress FormCraft plugin <= 3.9.15 - Server Side Request Forgery (SSRF) vulnerability

    Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions.

    Subtle Web FormCraft
  • High 7.1
    CVE-2026-65440

    WordPress GetGenie plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions.

    roxnor GetGenie
  • High 7.1
    CVE-2026-65441

    WordPress GiveWP plugin <= 4.16.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.

    Nexcess GiveWP
  • High 7.1
    CVE-2026-65439

    WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <=3.5.45 versions.

    themefic Ultimate Addons for Contact Form 7
  • High 7.1
    CVE-2026-65438

    WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.9 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 <= 1.6.3.9 versions.

    Kofi Mokome Message Filter for Contact Form 7
  • High 7.1
    CVE-2026-65437

    WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 6.82 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 versions.

    cleantalk Spam protection, AntiSpam, FireWall by CleanTalk
  • High 7.1
    CVE-2026-61957

    WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions.

    miniOrange miniorange otp verification
  • High 7.2
    CVE-2026-61953

    WordPress Simple Link Directory Pro plugin <= 15.0.6 - Server Side Request Forgery (SSRF) vulnerability

    Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions.

    Quantum Cloud Simple Link Directory Pro
  • High 7.5
    CVE-2026-66473

    WordPress Xendit Payment plugin <= 7.1.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions.

    Xendit Xendit Payment
  • Medium 5.1
    CVE-2026-53669

    React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

    React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in <Link> and useNavigate. This issue is a follow up to CVE-2025-68470 and has been fixed in version 7.18.0.

    remix-run react-router keycloak-26.5 keycloak-26.5-iamguarded-compat Wolfi npm
  • High 8.7
    CVE-2026-55685

    React Router: Unauthenticated Denial of Service via Inefficient Route Matching

    React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-423…

    remix-run react-router vitess-24 vitess-24-compat Wolfi npm
  • Medium 6.9
    CVE-2026-53668

    React Router: Open redirect can lead to XSS

    React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that …

    remix-run react-router keycloak-26.5 keycloak-26.5-iamguarded-compat Wolfi npm
  • Medium 6.9
    CVE-2026-59240

    IDOR in Prospero Flow CRM allows deletion of other users' notifications

    The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` method at endpoint `GET /notification/delete/{id}`. The flaw allows any authenticated user, regardless of company or permissions, to delete n…

    Roskus Prospero Flow CRM
  • Medium 6.9
    CVE-2026-53667

    React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667)

    React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if t…

    remix-run react-router vitess-24 vitess-24-compat Wolfi npm
  • Medium 6.1
    CVE-2026-53666

    React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

    React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigge…

    remix-run react-router keycloak-26.5 keycloak-26.5-iamguarded-compat Wolfi npm
  • Medium 6.9
    CVE-2026-66825

    Cross-Site Scripting via Unsafe URL Schemes in Pivotick Property Links

    Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with link-like properties, such as url, uri, href, link, website, or homepage, were rendered as hyperlinks without validating their URL scheme. An…

    pivotick pivotick
  • Critical 9.8
    CVE-2026-43757

    An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.1…

    Apple macOS iOS and iPadOS macOS iOS
  • High 8.2
    CVE-2026-64737

    An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS…

    Apple macOS macOS
  • Medium 5.5
    CVE-2026-43782

    This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS …

    Apple macOS macOS
  • Critical 9.8
    CVE-2026-43805 Public exploit

    A race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Seq…

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • Critical 9.8
    CVE-2026-39873

    The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8…

    Apple macOS macOS
  • Medium 5.5
    CVE-2026-64776

    The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, …

    Apple macOS macOS
  • Medium 5.5
    CVE-2026-64721

    This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS …

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • High 7.1
    CVE-2026-43813 Public exploit

    A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, mac…

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • Medium 5.5
    CVE-2026-20672

    An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.7…

    Apple macOS macOS
  • Critical 9.3
    CVE-2026-64740

    A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in …

    Apple macOS iOS and iPadOS tvOS macOS iOS
  • Critical 9.8
    CVE-2026-64691

    A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Tahoe 26.6. An app may be a…

    Apple macOS macOS
  • High 7.8
    CVE-2026-43673

    The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 …

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • High 8.8
    CVE-2026-64783

    A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, iOS 26.6 and …

    Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  • Medium 5.5
    CVE-2026-43665

    This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma …

    Apple macOS macOS
  • Critical 9.8
    CVE-2026-43809

    An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.1…

    Apple macOS iOS and iPadOS macOS iOS
  • High 7.5
    CVE-2026-43777

    This issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8…

    Apple macOS macOS
  • Critical 9.8
    CVE-2026-43799

    A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.10 and iPadOS 18.…

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • Medium 5.5
    CVE-2026-28900

    A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonom…

    Apple macOS macOS
  • High 7.8
    CVE-2026-43776

    A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, i…

    Apple macOS iOS and iPadOS macOS iOS