Skip to content
OpenAdvisories

Archive

28 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /28 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-59941 Public exploit

    Dompdf: Uncontrolled resource consumption based on declared BMP dimensions

    Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whos…

    dompdf dompdf dompdf/dompdf php-dompdf Debian Ubuntu Packagist
  • Medium 5.4
    CVE-2026-67181 Public exploit

    Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding Header

    Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the cli…

    tomaka rouille rust-rouille Debian
  • Medium 5.4
    CVE-2026-66746 Public exploit

    Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection

    Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return (0x0D) or line feed (0x0A) bytes into attacker-controlled input. Attackers can exploit…

    tomaka rouille rust-rouille Debian
  • Medium 5.9
    CVE-2026-66754 Public exploit

    Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encoding

    Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decod…

    tomaka rouille rust-rouille Debian
  • Medium 5.4
    CVE-2026-66752 Public exploit

    tiny-http 0.12.0 HTTP Request Smuggling via Transfer-Encoding Handling

    tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-Encoding header with any value, including non-chunked codings, which causes the library to unconditio…

    tiny-http tiny-http rust-tiny-http rust-tiny-http Debian Ubuntu
  • Medium 5.4
    CVE-2026-66751 Public exploit

    Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room

    Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room …

    sdelements lets-chat
  • Medium 4.3
    CVE-2026-66750 Public exploit

    Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route

    Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in t…

    sdelements lets-chat
  • Medium 6.5
    CVE-2026-66749 Public exploit

    Let's Chat 0.4.0 - 0.4.8 Denial of Service via Null Dereference in Room Lookup

    Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted…

    sdelements lets-chat