Archive
July 2026
Vulnerabilities first published in this month (UTC), newest first.
3,541 results · Clear filters · Feed
-
Medium 5.1
The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS sta…
-
Medium 5.3
Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser
A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sql_parse.py component, specifically within the SQL_REGEX used for parsing SQL statements in the sqlparse …
-
Medium 5.3
Apache Superset: Improper Authorization in Chart Update allowing Dashboard Modification
An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own. When updating a chart's properties via the REST API, a user can provide a list of dashboar…
-
Medium 6.5
Apache JSPWiki: Markdown parser allows XSS injection in Markdown error processing
A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the vi…
-
Medium 5.3
Samba: kpasswd service: kpasswd packet that contains malformed asn.1 might cause the server to access 6 bytes of unallocated memory leading server to crash
An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to…
-
Medium 6.5
foreUP customer REST API allows authenticated users to read cleartext payment-processor merchant credentials
A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body.
-
Medium 6.5
Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867
LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped. …
-
Medium 6.5
Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction
LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRealm constructed LDAP search filters without escaping user-controlled input, allowing an authenticated attacker to inject LDAP filter syntax through the user-search endpoint …
-
Medium 6.1CVE-2026-44613 Public exploit
Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling
Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a …
-
Medium 6.2
CSL 1010 M2M 3G WiFi Module 2.2.1.4 Weak Encryption via Router.cfg
CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unauthenticated attackers to recover all stored secrets in plaintext by reversing a single-byte XOR cipher that uses a static key to obfuscate the config…
-
Medium 6.0
Unauthenticated Go pprof exposure in Calico debug server
When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the pr…
-
Medium 6.2
Calico Tier Authorization Bypass via DeleteCollection
Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding t…
-
Medium 6.8
Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update
Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can…
-
Medium 5.4
XSS Security Vulnerability in response header affects IBM Sterling B2B Integrator and IBM Sterling File Gateway
IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.0_1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering…
-
Medium 5.4
Security Vulnerability in Ebics server affects IBM Sterling B2B Integrator and IBM Sterling File Gateway
IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2…
-
Medium 6.9
Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching
Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endp…
-
Medium 5.4
Cross-site Scripting in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager
IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console.
-
Medium 5.3
Samba: dns signing dos via tkey name cache exhaustion
A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests w…
-
Medium 6.5
CentreStack < 17.4 Session Injection via SelectProvider.aspx
CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.a…
-
Medium 4.3
FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle
The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the toggle_sync_status() function. This makes it possible for unauthenticated attackers to…
-
Medium 6.8
Project-koku/koku-metrics-operator: koku-metrics-operator: service-account client credentials sent to user-controlled token_url
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the te…
-
Medium 5.4
Stack overflow in phar with circular symlinks
Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
-
Medium 5.8
Dogtag-pki: pki-core: redhat-pki: pki: acme http-01 validation ssrf via ip literal identifiers and unvalidated redirects
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can …
-
Medium 4.2
DFIR-IRIS Insufficient Logout Implementation
The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time.
-
Medium 5.9
DFIR-IRIS Missing Brute Force Protection in User Authentication
The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks.
-
Medium 5.9
DFIR-IRIS Missing Brute Force Protection in OTP Validation
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks.
-
Medium 6.6
Cleartext password in logs
The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted.
-
Medium 5.3
JupiCore does not perform validation of firmware
An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity…
-
Medium 5.3
OCPP Firmware download is not properly locked
An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file to remain accessible for a short period before it is deleted due to improper locking during the clea…
-
Medium 4.1CVE-2026-56850 Public exploit
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) cl…
-
Medium 5.3
Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows a…
-
Medium 6.3CVE-2026-58040 Public exploit
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across iden…
-
Medium 5.4
Tutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection
The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thread, allowing authenticated users with subscriber-level access and above who can access an…
-
Medium 4.8
Essential Addons for Elementor - Lite < 6.6.10 - Contributor+ Stored XSS via Pricing Table Title Tag
The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed (St…
-
Medium 5.3
Essential Addons for Elementor - Lite < 6.6.10 - Unauthenticated Draft/Private WooCommerce Product Disclosure via Compare Table
The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature, allowing unauthenticated users to disclose the title, price, …
-
Medium 5.3
WP Delicious < 1.10.2 - Unauthenticated Arbitrary Post Meta Update via recipe_likes
The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata (a like counter and an associated identifier list) on arbitrary posts, including…
-
Medium 5.3
WP Travel < 11.8.1 - Unauthenticated Payment Bypass via Forged PayPal IPN
The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid, allowing unauthenticated attackers to forge a notification that flips an arbitrary pending …
-
Medium 6.1
Animation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG Upload
The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing users with the upload_files capability (Author and above) to upload files containing malici…
-
Medium 4.3
WP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDOR
The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking details, including billing address informatio…
-
Medium 6.5
Frontend Admin by DynamiApps < 3.29.7 - Subscriber+ Taxonomy Term Creation/Modification/Deletion via Missing Authorization
The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and deletion operations, allowing authenticated users with low privileges (such as Subscribers) to create, rename, …