Skip to content
OpenAdvisories

Archive

28 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /28 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 8.1
    CVE-2026-48060 Public exploit

    Litestar: HTML Injection Through CSRF Token

    Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting …

    litestar-org litestar litestar PyPI
  • High 7.8
    CVE-2026-18107 Public exploit

    Criu: criu: container escape via rseq critical section hijack during checkpoint/restore

    A flaw was found in CRIU's handling of restartable sequences (rseq) during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection during checkpoint, allowing it to spoof the…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-67185 Public exploit

    TinyWeb 0.0.8 Path Traversal via URL Path Component

    TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse()…

    GeneralSandman TinyWeb
  • High 7.5
    CVE-2026-67184 Public exploit

    TinyWeb 0.0.8 Null Pointer Dereference DoS via Malformed HTTP Request

    TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute() function fails to…

    GeneralSandman TinyWeb
  • High 7.5
    CVE-2026-67183 Public exploit

    TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling

    TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute() to allocate Url objects, HttpHeaders objects,…

    GeneralSandman TinyWeb
  • High 7.5
    CVE-2026-67182 Public exploit

    Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Header Injection

    Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied request header values that are copied verbatim to upstream c…

    tomaka rouille rust-rouille Debian
  • High 8.8
    CVE-2026-66748 Public exploit

    Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field

    Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with custom_fields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the select_eval custom fi…

    owen2345 Camaleon CMS
  • High 8.7
    CVE-2026-59248 Public exploit

    Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS

    Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service. The HPACK and QPACK prefixed-integer decoder …

    ninenines cowlib rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux Hex