Archive
July 2026
Vulnerabilities first published in this month (UTC), newest first.
146 results · Clear filters · Feed
-
High 7.8CVE-2026-64600 Public exploit
xfs: resample the data fork mapping after cycling ILOCK
In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, thes…
-
High 7.8CVE-2026-38764 Public exploit
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kern…
-
High 7.7CVE-2026-13078 Public exploit
Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges…
-
High 8.8CVE-2026-65013 Public exploit
Onlook tRPC Insecure Direct Object Reference via multiple procedures
Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including …
-
High 8.1CVE-2026-13181 Public exploit
RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX
In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-controlled type resolution, enabling remote code execution in affected deployments.
-
High 7.8CVE-2026-65600 Public exploit
Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex
Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments wi…
-
High 8.9CVE-2026-65591 Public exploit
n8n before 1.123.64 Sanitizer Bypass Remote Code Execution
n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code e…
-
High 7.8CVE-2026-38765 Public exploit
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kern…
-
High 7.8CVE-2026-38766 Public exploit
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the sub_…
-
High 7.5CVE-2026-56819 Public exploit
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame i…
-
High 7.1CVE-2026-60623 Public exploit
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are aff…
-
High 7.7CVE-2026-60586 Public exploit
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are aff…
-
High 7.5CVE-2026-56852 Public exploit
Infinite loop on invalid input in golang.org/x/text
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
-
High 8.4CVE-2026-64824 Public exploit
Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore
Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign …
-
High 7.8CVE-2026-8933 Public exploit
snap-confine Local Privilege Escalation via Capabilities Misconfiguration or Flaw in Execution Environment Setup
A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-c…
-
High 7.2CVE-2026-6952 Public exploit
A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-…
-
High 7.3CVE-2026-12080 Public exploit
Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys
A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass o…
-
High 7.1
Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Parameter
The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers …
-
High 8.6CVE-2026-11349 Public exploit
Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more
The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated use…
-
High 7.5CVE-2026-51031 Public exploit
FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint. …
-
High 8.4CVE-2026-63828 Public exploit
apparmor: mediate the implicit connect of TCP fast open sendmsg
In the Linux kernel, the following vulnerability has been resolved: apparmor: mediate the implicit connect of TCP fast open sendmsg sendmsg()/sendto() with MSG_FASTOPEN is a combination of connect(2) and write(2): it opens the connection in the SYN. apparmor_…
-
High 7.8CVE-2026-9147 Public exploit
uproot 5.7.4 and prior Code Injection via TStreamerInfo Metadata
uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields (for example, streamer element names) are interpolated into the generated Python source w…
-
High 7.1CVE-2026-14871 Public exploit
osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure
osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Object Reference (IDOR) in the AJAX ticket-management subsystem.
-
High 7.7CVE-2026-62201 Public exploit
OpenClaw < 2026.6.6 Network Policy Bypass via exec-server
OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust callers to reach internal network destinations blocked by OpenClaw policy. Attackers can send HTTP requests through the exec-ser…
-
High 8.1CVE-2025-60357 Public exploit
AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentE…
-
High 7.5CVE-2026-51833 Public exploit
Xenforo 2.3.8 is vulnerable to SSRF. Attackers that have administrator privileges or are able to add/save RSS feeds can…
-
High 8.8CVE-2026-45805 Public exploit
Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE
Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP's mcp/packages/server/src/ReplServer.ts bound the ReplServer to 0.0.0.0:4403 and exposed an unauthenticated /execute endpoint that passed the code field to Plu…
-
High 7.7CVE-2026-45806 Public exploit
Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-url
Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot's remote image import passed the user-controlled url from frontend/src/app/main/data/workspace/media.cljs into the backend RPC method :create-file-media-object-fro…
-
High 8.1CVE-2026-42533 Public exploit
NGINX Map directive and Regex matching vulnerability
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achiev…
-
High 8.1CVE-2026-57821 Public exploit
Apache Fineract: Office list: SQL Injection via Subquery in orderBy
A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated u…
-
High 8.6CVE-2026-15583 Public exploit
SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header
A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrar…
-
High 8.2CVE-2026-13585 Public exploit
Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in…
-
High 7.5CVE-2026-36590 Public exploit
An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function i…
-
High 8.2CVE-2026-47423 Public exploit
DOMPurify XSS via `selectedcontent` re-clone
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re-clone an XSS payload after sanitization so that unsanitized markup inside <selectedcontent> is re…
-
High 7.2
Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the …
KEV Jul 14, 2026 -
High 8.7CVE-2026-45071 Public exploit
Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() set DOMDocument::$validateOnParse = true before loadXML(), re-enabling external entity reso…
-
High 8.8CVE-2026-47301 Public exploit
Configuration Manager Elevation of Privilege Vulnerability
Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.
-
High 8.8CVE-2026-54121 Public exploit
Active Directory Certificate Services Elevation of Privilege Vulnerability
Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.
-
High 7.8CVE-2026-50679 Public exploit
Windows Search Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
-
High 7.8CVE-2026-50402 Public exploit
NTFS Elevation of Privilege Vulnerability
Incorrect conversion between numeric types in Windows NTFS allows an authorized attacker to elevate privileges locally.