Skip to content
OpenAdvisories

Archive

31 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /31 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-68771 Public exploit

    ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization

    ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can…

    Comfy-Org ComfyUI
  • Critical 9.4
    CVE-2026-58048 Public exploit

    Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.

    WebPros cPanel WP Squared
  • High 7.5
    CVE-2026-52856 Public exploit

    Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

    Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.

    pterodactyl wings github.com/pterodactyl/wings Go
  • Critical 9.9
    CVE-2026-17566 Public exploit

    pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)

    pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrapper, create…

    pgadmin.org pgAdmin 4
  • Critical 9.8
    CVE-2026-14483 Public exploit Scanner template

    Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' Command

    The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined wit…

    Realtyna Realtyna Organic IDX plugin + WPL Real Estate Web / CMS
  • Critical 9.8
    CVE-2026-63223 Public exploit

    CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules

    CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserve…

    codeigniter4 CodeIgniter4 codeigniter4/framework php-codeigniter-framework Ubuntu Packagist
  • Low 3.3
    CVE-2026-58039 Public exploit

    A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-w…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Critical 9.8
    CVE-2026-52134 Public exploit

    An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass a…