Skip to content
OpenAdvisories

Archive

29 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /29 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-65883 Public exploit

    Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0

    Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution.

    aimy-extensions.com Aimy Captcha-Less Form Guard plugin for Joomla Web / CMS
  • Critical 9.8
    CVE-2026-14900 Public exploit

    Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter

    The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js_to_php function. This is due to insufficient sanitization of the orderDetails[*].originalValue field, which is i…

    StylemixThemes Cost Calculator Builder PRO Web / CMS
  • Critical 9.8
    CVE-2026-59243 Public exploit

    Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)

    The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callback could bypass authentication and log in as an arbitrary u…

    Apache Software Foundation Apache Airflow FAB provider
  • Critical 10.0
    CVE-2026-33267 Public exploit

    Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata

    Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.

    Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu