Skip to content
OpenAdvisories

Archive

27 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /27 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-43805 Public exploit

    A race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Seq…

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • Critical 9.8
    CVE-2026-43682 Public exploit

    The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8…

    Apple macOS macOS
  • Critical 9.8
    CVE-2026-55579 Public exploit

    Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

    Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on …

    pheditor pheditor pheditor/pheditor Packagist
  • Critical 9.9
    CVE-2026-48030 Public exploit Scanner template

    Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)

    Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shel…

    pheditor pheditor pheditor/pheditor Packagist
  • Critical 9.8
    CVE-2026-63077 Exploited · Ransomware Public exploit Scanner template EPSS 95%

    In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polli…

    JetBrains TeamCity
    KEV Aug 5, 2026
  • Critical 9.3
    CVE-2026-59550 Public exploit

    WordPress AWP Classifieds plugin <= 4.4.7 - SQL Injection vulnerability

    Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions.

    Strategy11 Team AWP Classifieds
  • Critical 9.8
    CVE-2026-61511 Public exploit Scanner template EPSS 74%

    vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php

    vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying craft…

    vBulletin vBulletin
  • Critical 9.8
    CVE-2026-13714 Public exploit

    Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution

    The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shi…

    Web / CMS
  • Critical 9.1
    CVE-2025-50455 Public exploit

    SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyA…