Archive
July 2026
Vulnerabilities first published in this month (UTC), newest first.
4,198 results · Clear filters · Feed
-
High 7.5
IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path traversal vulnerability.
-
High 7.5
IBM Enterprise Build of Quarkus is affected by a DoS vulnerability
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes.
-
High 8.8
Serendipity < 2.6.1 Authentication Bypass via Username Collision
Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without ensuring both use the same user record. An authenticated Editor can create a username collision wit…
-
High 8.3
CSRF in Softtr's E-Commerce Pack
Cross-Site request forgery (CSRF) vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery. This issue affects E-Commerce Pack: before 5.03.01.49.
-
High 7.5
Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time
Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. _parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timer…
-
High 7.5
Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check
Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes capture year, month and day with the `\d` shorthand, which on a character string matches the whole Uni…
-
High 7.5
e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()
e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the user_prefs column. The …
-
High 8.2
Authentication Bypass in FTC Software's E-Commerce Management Panel
Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management Panel allows Authentication Bypass. This issue affects FTC E-Commerce Management Panel: before 1.0.2.
-
High 8.1
The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperl…
-
High 7.6
Out-of-bounds read vulnerability
VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) condit…
-
High 8.8
CentreStack < 17.4 SQL Injection via x-glad-filter Header
CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API en…
-
High 8.6
CentreStack < 17.2 Unauthenticated API Authorization Bypass
CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid…
-
High 7.5
CentreStack < 17.4 XXE via SharePoint Storage Configuration
CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafte…
-
High 7.5
CentreStack < 17.3 Unauthenticated User Creation via Deserialization in GSNamespace.dll
CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. At…
-
High 7.6
Project-koku/koku-metrics-operator: koku-metrics-operator: cluster pull-secret token exfiltration via user-controlled api_url (ssrf / confused deputy)
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (the default), the cluster-global Red Hat Cloud …
-
High 7.6
Project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service_address
A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bear…
-
High 8.1CVE-2026-17544 Public exploit
Out-of-bounds write in bccomp() via crafted operand and scale
Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.
-
High 8.1CVE-2026-17543 Public exploit
SQL injection in ext-pgsql via E'...' backslash breakout
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
-
High 7.2
Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action
The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action via the wps_sfw_install_…
-
High 8.8
Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could a…
-
High 8.3
Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could a…
-
High 8.6
Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an una…
-
High 7.6
DFIR-IRIS Stored XSS in Datastore Upload
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function.
-
High 7.6
DFIR-IRIS Stored XSS in Custom Attributes
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function.
-
High 7.6
DFIR-IRIS Stored XSS in Assets
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function.
-
High 8.8
Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass
PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlparse` before performing OIDC discovery with `requests`. Because `urlparse` and `requests`/`urllib3` parse an a…
-
High 7.5
Exposed Reboot via Modbus
A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the port that CharxModbusServer is listening, an unauthenticated attacker can perform a Denial-of-Servic…
-
High 7.8
Local Privilege Escalation vulnerability in /etc/init.d/user-applications via customer website file
A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
-
High 7.8
Local Privilege Escalation via pppd password injection
A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
-
High 8.6
OS Command Injection in OCPP Agent via charge_box_id
This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupte…
-
High 7.1
File Upload vulnerability
A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Deni…
-
High 7.8
udhcpc Privilege Escalation
A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise.
-
High 7.8
Local Privilege Escalation via Network scripts
A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
-
High 8.6
Fallback to second RAUC slot with default credentials
An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Cha…
-
High 7.8
Local Privilege Escalation vulnerability in /etc/init.d/user-applications via user-application start script
A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
-
High 7.1
Information tampering and Denial-of-service (DoS) vulnerability in CC-Link IE TSN communication protocol
Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX-R model, MELSEC MX Controller MX-F model, Master/local module, CC-Link IE TSN interface board, Motion module,…
-
High 7.5CVE-2026-58043 Public exploit
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Un…
-
High 8.6
Bookly < 27.8 - Unauthenticated SQL Injection via staff_id
The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attacke…
-
High 7.1
Tourmaster < 5.4.8 - Stored XSS via CSRF
The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to tri…
-
High 7.5
Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment.