Skip to content
OpenAdvisories

Archive

July 2026

Vulnerabilities first published in this month (UTC), newest first.

← June 2026 2026 / July August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Low 3.3
    CVE-2026-58039 Public exploit

    A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-w…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 3.3
    CVE-2026-56847 Public exploit

    A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 3.7
    CVE-2026-66753 Public exploit

    tiny-http 0.12.0 HTTP Response Splitting via Header Injection

    tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return (0x0D) and line feed (0x0A) bytes into HTTP header values on both request and response sides due to insufficient validation in header pars…

    tiny-http tiny-http rust-tiny-http rust-tiny-http Debian Ubuntu
  • Low 1.8
    CVE-2026-40000 Public exploit

    Path Traversal Vulnerability in ZTE Blade A75 5G

    The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths (e.g., content://zte.com.cn.filer.fileprovide…

    ZTE Blade A75 5G
  • Low 3.7
    CVE-2026-26080 Public exploit

    HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAPr…

    HAProxy HAProxy haproxy Debian
  • Low 3.3
    CVE-2026-50416 Public exploit

    Win32k Information Disclosure Vulnerability

    Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally.

    Microsoft Windows Server 2025 Windows Server 2025 (Server Core installation) Windows 11 Version 24H2 Windows
  • Low 3.3
    CVE-2026-13233 Public exploit

    OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053

    Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows Server Side Request Forgery. This issue affects OpenAI Provider versions: from 0.0.0 to 1.1.1, from 1.2.0 to 1.2.2.

    Drupal OpenAI Provider drupal/ai_provider_openai Packagist
  • Low 2.4
    CVE-2026-55781 Public exploit

    NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fields

    NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's UFS and FFS image handler in NanaZip.Codecs.Archive.Ufs.cpp validates the superblock block size only against the MINBSIZE lower bound and does not valid…

    M2Team NanaZip
  • Low 2.4
    CVE-2026-55780 Public exploit

    NanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry Size

    NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's .NET single-file bundle handler in NanaZip.Codecs.Archive.DotNetSingleFile.cpp sizes its extraction buffer from the bundle entry Size field, which is on…

    M2Team NanaZip
  • Low 2.1
    CVE-2026-58225 Public exploit

    SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service

    SQL Injection vulnerability in elixir-ecto postgrex allows an attacker who can influence a LISTEN channel name to inject SQL into the reconnect replay query, causing a denial of service of the notification connection. Postgrex.Notifications sanitizes channel …

    elixir-ecto postgrex postgrex Hex
  • Low 3.7
    CVE-2026-46584 Public exploit

    Apache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail session properties, allowing an attacker to influence SMTP parameters

    Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component. The camel-mail producer (MailProducer.getSender) scanned the outgoing Exchange for message headers in the mail.smtp. / mail.smt…

    Apache Software Foundation Apache Camel Mail org.apache.camel:camel-mail Maven