Skip to content
OpenAdvisories

Archive

30 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /30 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-66421 Public exploit

    OpenClaw Dashboard Stored XSS via lastMessage Session Field

    OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed throu…

    tugcantopaloglu openclaw-dashboard
  • Critical 9.3
    CVE-2026-66418 Public exploit

    OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field

    OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbati…

    tugcantopaloglu openclaw-dashboard
  • Critical 9.5
    CVE-2026-66066 Public exploit EPSS 33%

    Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

    Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an oper…

    rails rails rails rails Debian Ubuntu RubyGems
  • Critical 9.8
    CVE-2026-12118 Public exploit

    IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data

    IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

    IBM webMethods Integration (on prem)
  • Critical 9.8
    CVE-2026-12940 Public exploit

    Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoints

    IBM Langflow OSS 1.0.0 through 1.10.1  are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Protocol) stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGER…

    IBM Langflow OSS
  • Critical 9.8
    CVE-2026-52680 Public exploit

    Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write

    Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker who can access the REST batch upload endpoint can provide path traversal sequences in the filename an…

    Apache Software Foundation Apache Kyuubi
  • Critical 9.8
    CVE-2026-59310 Exploited · Ransomware Public exploit EPSS 62%

    vCenter directory-traversal vulnerability

    VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

    VMware Cloud Foundation Telco Cloud Platform Telco Cloud Infrastructure Virtualization
    KEV Aug 18, 2026