Skip to content
OpenAdvisories

Archive

27 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /27 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

168 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-13390

    The Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status Manipulation

    The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing …

    Web / CMS
  • Medium 6.1
    CVE-2026-12982

    Document Gallery < 5.1.1 - Reflected XSS via dg_generate_gallery

    The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited a…

    Web / CMS
  • Medium 6.1
    CVE-2026-10082

    Advanced Ads – Ad Manager & AdSense < 2.0.23 - Contributor+ Stored XSS via the_ad Shortcode 'ad_args' Parameter

    The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the affected content is v…

    Web / CMS
  • Medium 6.5
    CVE-2026-66412

    Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC

    Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. A…

    Leantime Leantime
  • Medium 5.3
    CVE-2026-17501

    ggml-org llama.cpp JSON-Schema-to-GBNF Conversion json-schema-to-grammar.cpp transform recursion

    A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes uncontrolled recursion. The attack m…

    ggml-org llama.cpp llama.cpp llama.cpp Debian Ubuntu
  • Medium 5.3
    CVE-2026-17500

    ggml-org llama.cpp json-schema-to-grammar.cpp _visit_pattern null pointer dereference

    A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function _visit_pattern of the file common/json-schema-to-grammar.cpp. The manipulation results in null pointer dereference. The attack can be launched remotely. The pull req…

    ggml-org llama.cpp llama.cpp llama.cpp Debian Ubuntu
  • Medium 4.9
    CVE-2026-51564 Public exploit

    An issue in the redirect parameter in Milk admin <=0.9.8 allows remote attackers to redirect users to arbitrary externa…

  • Medium 6.1
    CVE-2026-51565 Public exploit

    Cross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php in Milk admin <=0.9.8 allows remote attacke…