Archive
July 2026
Vulnerabilities first published in this month (UTC), newest first.
336 results · Clear filters · Feed
-
High 8.1CVE-2026-42533 Public exploit
NGINX Map directive and Regex matching vulnerability
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achiev…
-
Critical 9.1CVE-2026-43637 Public exploit
Cornac < 2.6.0 Path Traversal via _extract_archive() in download.py
Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allows attackers to write arbitrary files outside the intended cache directory by supplying a crafted TAR archive containing ../ sequences, absolute paths, or symlink/hardlink entries…
-
High 8.1CVE-2026-57821 Public exploit
Apache Fineract: Office list: SQL Injection via Subquery in orderBy
A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated u…
-
High 8.6CVE-2026-15583 Public exploit
SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header
A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrar…
-
High 8.2CVE-2026-13585 Public exploit
Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in…
-
High 7.5CVE-2026-36590 Public exploit
An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function i…
-
Critical 9.8
LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The applicatio…
-
Medium 6.1CVE-2026-26719 Public exploit
Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a cr…
-
Critical 9.1CVE-2026-26718 Public exploit
A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an at…
-
High 8.2CVE-2026-47423 Public exploit
DOMPurify XSS via `selectedcontent` re-clone
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re-clone an XSS payload after sanitization so that unsanitized markup inside <selectedcontent> is re…
-
Critical 9.3
Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or sessio…
KEV Oct 27, 2026 -
High 7.2
Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the …
KEV Jul 14, 2026 -
Critical 10.0
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A…
KEV Jul 14, 2026 -
Critical 9.8
Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter
The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'podlove_handle_cache_files' function in all versions up to, and including, 4.5.1. This makes it possible for unauthenticated…
-
Critical 9.8CVE-2026-47429 Public exploit
Vitest: Arbitrary file can be read and executed when Vitest UI server is listening
Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API wri…
-
High 8.7CVE-2026-45071 Public exploit
Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() set DOMDocument::$validateOnParse = true before loadXML(), re-enabling external entity reso…
-
High 8.8CVE-2026-47301 Public exploit
Configuration Manager Elevation of Privilege Vulnerability
Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.
-
Medium 6.3CVE-2026-45067 Public exploit
Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
### Description `Symfony\Component\Mime\Address` is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a secur…
-
Medium 6.3CVE-2026-57973 Public exploit
Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability
Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to perform tampering locally.
-
Critical 9.8CVE-2026-56190 Public exploit
Remote Desktop Protocol Remote Code Execution Vulnerability
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network.
-
Critical 9.8CVE-2026-55944 Public exploit
Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network.
-
Critical 9.1
Microsoft SharePoint Server Security Feature Bypass Vulnerability
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
KEV Aug 18, 2026 -
High 8.8CVE-2026-54121 Public exploit
Active Directory Certificate Services Elevation of Privilege Vulnerability
Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.
-
High 7.8CVE-2026-50679 Public exploit
Windows Search Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
-
Medium 4.7CVE-2026-50657 Public exploit
Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability
Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to disclose information locally.
-
High 7.8CVE-2026-50402 Public exploit
NTFS Elevation of Privilege Vulnerability
Incorrect conversion between numeric types in Windows NTFS allows an authorized attacker to elevate privileges locally.
-
High 8.8CVE-2026-50369 Public exploit
Windows Remote Desktop Services Elevation of Privilege Vulnerability
Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network.
-
Low 3.3CVE-2026-50416 Public exploit
Win32k Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally.
-
High 7.8CVE-2026-50343 Public exploit
Microsoft Install Service Elevation of Privilege Vulnerability
Improper privilege management in Microsoft Install Service allows an authorized attacker to elevate privileges locally.
-
Medium 6.5CVE-2026-34348 Public exploit
Windows Event Logging Service Information Disclosure Vulnerability
Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network.
-
High 7.8CVE-2026-58635 Public exploit
Windows Narrator Braille Elevation of Privilege Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.
-
Critical 9.8
Microsoft SharePoint Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
KEV Jul 22, 2026 -
Medium 5.3
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
KEV Jul 14, 2026 -
High 8.2CVE-2026-50338 Public exploit
Azure Spring Apps Elevation of Privilege Vulnerability
Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network.
-
High 8.4CVE-2026-54992 Public exploit
Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code locally.
-
High 8.8CVE-2026-54107 Public exploit
Windows Win32k Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.
-
High 7.8CVE-2026-49176 Public exploit
Windows WalletService Elevation of Privilege Vulnerability
Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally.
-
Critical 9.6CVE-2026-59891 Public exploit
Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target regis…
-
High 7.2CVE-2026-54433 Public exploit
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted pla…
-
High 7.5CVE-2026-12523 Public exploit
Resource exhaustion in quiche HTTP/3 and QPACK layers
Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames. Impact HTTP/3 defines multiple frame types to support HTTP message exchanges and connection management.…