Skip to content
OpenAdvisories

Archive

July 2026

Vulnerabilities first published in this month (UTC), newest first.

← June 2026 2026 / July August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

3,541 results · Clear filters · Feed

  • Medium 5.2
    CVE-2026-17574

    NULL Pointer Dereference in HDF5 via Invalid Variable-Length Datatype Type Tag

    HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read.

    The HDF Group HDF5 hdf5 hdf5 Debian Ubuntu Azure Linux
  • Medium 4.0
    CVE-2026-17573

    Double Free in H5D__chunk_copy() in HDF5 via a Crafted Chunk-Index Size Field

    A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free.

    The HDF Group HDF5 hdf5 hdf5 Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2026-17572

    HDF5 SOHM List Index Heap Buffer Overflow

    Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (crash) via a crafted HDF5 file whose shared-message list index declares a num_messages count exceeding…

    The HDF Group HDF5 hdf5 hdf5 Debian Ubuntu Azure Linux
  • Medium 4.8
    CVE-2026-47078

    Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass

    Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check_dir_level/2, which tracks …

    Erlang Project OTP erlang erlang Debian Ubuntu
  • Medium 6.3
    CVE-2026-42792

    epmd permanent DoS via EMFILE on accept(2) in erts

    Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion. The do_accept function in erts/epmd/src…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • Medium 4.8
    CVE-2025-59181

    Path traversal Vulnerability

    Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a directory traversal vulnerability in Configuration Management that could allow an attacker to change directory permissions, denying access to legitimate users.

    Ericsson Packet Core Controller (PCC)
  • Medium 5.1
    CVE-2025-59180

    Use of Hard-coded Credentials Vulnerability

    Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster with knowledge of the hardcoded credential can read alarm and alert information.

    Ericsson Packet Core Controller (PCC)
  • Medium 4.8
    CVE-2025-59178

    Exposure of Sensitive System Information to an Unauthorized Control Sphere Vulnerability

    Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain an Exposure of Sensitive System Information vulnerability in Configuration Management allowing an attacker to enumerate other users on the system.

    Ericsson Packet Core Controller (PCC)
  • Medium 6.5
    CVE-2026-10819

    Mattermost Server Denial of Service via Animated GIF Emoji Upload

    Mattermost versions 11.6.x <= 11.6.5, 10.11.x <= 10.11.20, 11.8.x <= 11.8.1, 11.7.x <= 11.7.4 fail to limit the number of frames and enforce the file size cap on animated GIF uploads, which allows an authenticated attacker to cause a denial of service via a c…

    Mattermost Mattermost
  • Medium 4.3
    CVE-2026-10600

    Denial of service via unbounded document content extraction in Mattermost Server

    Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to bound the time and resource consumption of server-side document content extraction which allows an authenticated user with file-upload permission to degrade …

    Mattermost Mattermost
  • Medium 6.8
    CVE-2025-59177

    Generation of Error Message Containing Sensitive Information Vulnerability

    Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to execute specifically crafted commands to reveal system secret through error messages.

    Ericsson Ericsson Packet Core Controller (PCC)
  • Medium 5.3
    CVE-2026-66477

    WordPress Gillion theme <= 4.13 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Gillion <= 4.13 versions.

    shufflehound Gillion
  • Medium 4.9
    CVE-2026-66476

    WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability

    Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.

    Syed Balkhi Easy Digital Downloads
  • Medium 5.9
    CVE-2026-66475

    WordPress Checkout Field Editor for WooCommerce &#8211; Checkout Manager plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

    Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce &#8211; Checkout Manager <= 3.0.5 versions.

    acowebs Checkout Field Editor for WooCommerce &#8211; Checkout Manager Web / CMS
  • Medium 4.3
    CVE-2026-66474

    WordPress Insert Headers and Footers Code – HT Script plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= 1.1.8 versions.

    HT Plugins Insert Headers and Footers Code – HT Script
  • Medium 6.5
    CVE-2026-66448

    WordPress Gallery PhotoBlocks plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.

    WP Chill Gallery PhotoBlocks
  • Medium 6.5
    CVE-2026-66445

    WordPress Open User Map plugin <= 1.4.46 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions.

    100plugins Open User Map
  • Medium 5.4
    CVE-2026-66442

    WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability

    Subscriber Broken Access Control in YayPricing <= 3.5.6 versions.

    YayCommerce YayPricing
  • Medium 4.9
    CVE-2026-66437

    WordPress Feedzy plugin <= 5.2.4 - Server Side Request Forgery (SSRF) vulnerability

    Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions.

    themeisle Feedzy
  • Medium 5.3
    CVE-2026-66438

    WordPress Exclusive Addons Elementor plugin <= 2.8.0 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor <= 2.8.0 versions.

    Tim Strifler Exclusive Addons Elementor
  • Medium 6.5
    CVE-2026-66434

    WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.33 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions.

    Sayontan Sinha Photonic Gallery & Lightbox for Flickr, SmugMug & Others
  • Medium 4.3
    CVE-2026-66428

    WordPress WP Google Review Slider plugin <= 18.4 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.

    jgwhite33 WP Google Review Slider
  • Medium 6.5
    CVE-2026-66433

    WordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions.

    ShapedPlugin Location Weather
  • Medium 5.3
    CVE-2026-65567

    WordPress Event Tickets plugin <= 5.29.0.1 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.

    Nexcess Event Tickets
  • Medium 5.0
    CVE-2026-65568

    WordPress Visual Composer Website Builder plugin <= 45.15.0 - Broken Access Control vulnerability

    Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.

    Visual Composer Visual Composer Website Builder
  • Medium 5.3
    CVE-2026-65564

    WordPress MapPress Maps for WordPress plugin <= 2.97.6 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions.

    chrisvrichardson MapPress Maps for WordPress Web / CMS
  • Medium 5.9
    CVE-2026-65563

    WordPress Orbit Fox by ThemeIsle plugin <= 3.0.7 - Cross Site Scripting (XSS) vulnerability

    Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle <= 3.0.7 versions.

    themeisle Orbit Fox by ThemeIsle
  • Medium 6.5
    CVE-2026-65562

    WordPress BetterDocs plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in BetterDocs <= 4.6.2 versions.

    WPDeveloper BetterDocs
  • Medium 5.4
    CVE-2026-65558

    WordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability

    Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions.

    WPCenter AffiliateX
  • Medium 6.5
    CVE-2026-65561

    WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.

    miniOrange WordPress Social Login and Register Web / CMS
  • Medium 5.9
    CVE-2026-65557

    WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Scripting (XSS) vulnerability

    Shop manager Cross Site Scripting (XSS) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.

    Tyche Softwares Abandoned Cart Lite for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-65435

    WordPress Thrive Leads Version plugin <= 10.9.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions.

    Thrive Themes Coupon Thrive Leads Version
  • Medium 6.8
    CVE-2026-65436

    WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerability

    Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.

    Themeum Kirki
  • Medium 6.5
    CVE-2026-65434

    WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Sensitive Data Exposure vulnerability

    Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions.

    yoomoney ЮKassa для WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-59560

    WordPress FundEngine plugin <= 1.7.8 - Broken Access Control vulnerability

    Subscriber Broken Access Control in FundEngine <= 1.7.8 versions.

    roxnor FundEngine
  • Medium 6.5
    CVE-2026-65433

    WordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Broken Access Control vulnerability

    Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor &amp; Gutenberg <= 1.5.1 versions.

    themewant RT Mega Menu – Mega Menu Builder for Elementor &amp; Gutenberg
  • Medium 6.5
    CVE-2026-59559

    WordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor &amp; Gutenberg <= 1.5.1 versions.

    themewant RT Mega Menu – Mega Menu Builder for Elementor &amp; Gutenberg
  • Medium 6.5
    CVE-2026-59557

    WordPress Events Made Easy plugin <= 3.1.3 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions.

    Franky Events Made Easy
  • Medium 5.6
    CVE-2026-15003

    Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service

    A flaw was found in the GNU Binutils (Binary Utilities) linker. This vulnerability, a heap-buffer-overflow read (CWE-125), occurs when the linker processes a specially crafted 32-bit XCOFF (Extended Common Object File Format) object file. An attacker could ex…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2026-17514

    ZJONSSON node-unzipper extract.js Extract path traversal

    A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation causes path traversal. The attack requires local access. The exploit has been publicly …

    ZJONSSON node-unzipper