| CVE-2026-9066 | The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress plugin before 7.10.04's loader injects script elements pointing to an attacker-controlled origin, which lets the attacker execute arbitrary JavaScript in the visitor's session on the target site. | medium | 2026-07-23 |
| CVE-2026-59676 | A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in the unconfined SELinux domain to delete arbitrary root-owned files, This issue affects policycoreutils through 3.10. | medium | 2026-07-23 |
| CVE-2026-14291 | The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced two-factor authentication for any account, including administrators. The affected two-factor module ships only in the premium build. | high | 2026-07-23 |
| CVE-2026-12082 | The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data. | high | 2026-07-23 |
| CVE-2026-7534 | The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint `/wp-json/wc-srp/v1/earning` in versions up to, and including, 32.7.0. This is due to the `user_has_cap` filter in the `SRP_REST_Earning_Controller` class unconditionally granting the custom `rs_earning_read` capability to all users — including unauthenticated visitors — combined with missing sanitization of the `reason` parameter in the `create_items()` function and missing output escaping in the `column_default()` method of `SRP_Master_Log`. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into the reward points log that will execute whenever an administrator accesses the Master Log or User Reward Points admin pages. | high | 2026-07-23 |
| CVE-2026-7232 | The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[parameter name]' parameter in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit chain combines a server-side gap — where composite matrix sub-field keys such as field2_0 and field2_1 are never passed through the sanitization loop and are stored raw via $wpdb->insert() — with a client-side gap where DOMPurify is only invoked when typeof field.value === 'string', but matrix values arrive from the server as arrays, bypassing the check before being mapped to strings and injected into the DOM. Additionally, the same sink is reachable via a second attack vector: array-typed field values are passed through htmlentities() on submission but later reversed by html_entity_decode() at formcraft-main.php:2608 and :2122, restoring the malicious payload before storage and rendering. | high | 2026-07-23 |
| CVE-2026-64600 | In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence counter changes across the ILOCK cycle. | high | 2026-07-27 |
| CVE-2026-63226 | Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. do not implement restrictions on SSH port forwarding, allowing to connect to arbitrary destinations. When SSH is enabled on an affected product, SSH port forwarding may be leveraged to connect to other node on the LAN. | medium | 2026-07-23 |
| CVE-2026-6390 | A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes. | medium | 2026-07-23 |
| CVE-2026-7120 | @fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent non-canonical pathnames, causing files that were intended to be denied to be served anyway. The bypass does not allow access outside the configured static root by itself, it defeats path-based filtering only. The issue is patched in @fastify/static 10.1.2. | medium | 2026-07-28 |
| CVE-2026-15074 | @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library normalizes dot segments before applying its own path-traversal guard, an unauthenticated attacker can bypass any route-scoped middleware and read files inside the static root that live under the guarded URL prefix. The bypass does not allow access outside the configured static root by itself, it defeats route-guard filtering only. The issue is patched in @fastify/static 10.1.1. | high | 2026-07-28 |
| CVE-2026-21723 | The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled. | medium | 2026-07-23 |
| CVE-2026-16653 | A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function http_sendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | medium | 2026-07-23 |
| CVE-2026-16632 | A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_protocol_error in the library lib/facil/http/parsers/websocket_parser.h of the component WebSocket Frame Parser. This manipulation of the argument on_message causes improper input validation. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. | medium | 2026-07-23 |
| CVE-2026-16631 | A vulnerability was detected in publint up to 0.1.4. This impacts the function child_process.exec of the file src/node/pack.js of the component package-manager Command Handler. The manipulation results in os command injection. Attacking locally is a requirement. The exploit is now public and may be used. The patch is identified as adf2d9a09945fc98c85a2520a89f441d78b2dbd8. It is advisable to implement a patch to correct this issue. The project maintainer explains: "I think it's very rare for someone to use this package with untrusted input". | medium | 2026-07-23 |
| CVE-2026-63452 | The vulnerability exists due to absent rate-limiting infrastructure during the handling of invalid or broken IPsec/ISAKMP security associations. A continuous flood of unauthenticated, garbage key exchange payloads forces Suricata to spend all its processing power generating error alerts, completely blinding the IDS engine.
| high | |
| CVE-2026-63451 | The vulnerability exists due to improper buffer index progression checks inside the SSH protocol version string analyzer. Sending an unauthenticated stream containing millions of trailing null bytes before the version declaration overflows local input tracking variables. | high | |
| CVE-2026-63450 | The vulnerability exists due to incorrect type casting validation inside the FTP application-layer gateway tracker. Intermixing command sequences with unexpected binary payload arguments causes the command processor to read operational memory under an incorrect type structure definition. | critical | |
| CVE-2026-63449 | The vulnerability exists due to missing output encoding and parsing checks within the Eve JSON logging output facility. Malformed network application metadata containing embedded escape characters can break JSON log generation structures, causing log dropouts or processing failures downstream. | medium | |
| CVE-2026-63448 | The vulnerability exists due to improper cleanup of temporary file descriptors used during network payload extraction. When Suricata dumps packet content to disk under heavy traffic conditions, unhandled exceptions can leak open file handlers until the process reaches OS limits and stops. | medium | |
| CVE-2026-63447 | The vulnerability exists due to a null pointer dereference flaw inside the DCERPC protocol parser. The engine fails to verify object creation success when handling uncommon transaction types, causing a direct application crash if a stub reference is called on a failed structure allocation. | high | |
| CVE-2026-63446 | The vulnerability exists due to inefficient processing complexity inside the QUIC and HTTP/3 header validation engine. Crafting specialized packet sequences with massive arrays of pseudo-headers causes the regex or tokenization loops to experience exponential compute slowdowns. | high | |
| CVE-2026-62944 | The vulnerability exists due to a missing output encoding call within the Word export component. The application fails to properly sanitize the filename of uploaded image attachments. This flaw allows an authenticated user to inject arbitrary HTML payloads into an image tag's alternative text attribute, leading to Stored Cross-Site Scripting (XSS) when another user exports or views the affected bug tracking page. | high | |
| CVE-2026-57229 | The vulnerability exists due to improper state isolation inside the multi-threaded flow tracking worker queues. High-velocity concurrent network streams can cause worker threads to race when updating global flow indices, resulting in unexpected pointer dereferences and kernel-level thread crashes. | high | |
| CVE-2026-57228 | The vulnerability exists due to missing boundary constraints inside the SMB/CIFS protocol inspection pipeline. Malformed file-sharing transaction packets with mismatched header lengths allow incoming data to spill out of designated network buffers, risking localized memory corruption. | critical | |
| CVE-2026-57227 | The vulnerability exists due to uncontrolled resource consumption within the DNS parser logic. The system struggles to process anomalous, looping compressed pointer loops inside specific domain query responses, driving localized CPU core utilization to maximum limits and dropping network visibility. | high | |
| CVE-2026-57226 | The vulnerability exists due to a use-after-free (UAF) condition inside the TCP stream reassembly layer. When a connection undergoes abrupt termination sequences (such as an interleaving flood of RST and FIN packets), the flow tracking engine frees network payload metadata objects prematurely while active parsing references are still attached. | critical | |
| CVE-2026-57225 | The vulnerability exists due to flawed recursion tracking during the disassembly of heavily nested ASN.1 structures used in cryptographic handshakes. By flooding the network monitor with complex, multi-layered identity fields, an attacker can intentionally exhaust the execution stack frame. | critical | |
| CVE-2026-57224 | The vulnerability exists due to inadequate validation of content lengths within the centralized HTTP compression module. The application passes nested, malformed zip or gzip headers directly to the decompressor without an effective upper bound, triggering extreme memory exhaustion that forces the operating system to kill the Suricata process. | high | |
| CVE-2026-57223 | The vulnerability exists due to an integer overflow condition inside the TLS certificate parsing engine. An unauthenticated remote attacker can send an excessively long or malformed Extensions field within a Client Hello packet, forcing an incorrect memory allocation size that results in a process-terminating Denial of Service (DoS). | high | |
| CVE-2026-57222 | The vulnerability exists due to improper memory boundary checks within the newly optimized HTTP/2 state tracker. When handling highly fragmented or out-of-order network traffic, the parser fails to properly calculate segment offsets, leading to a heap-based out-of-bounds read and an engine crash. | high | |
| CVE-2026-52881 | The vulnerability exists due to missing output escaping on unauthenticated web parameters. Within the setup script /admin/install.php, user-controlled request inputs are echoed straight back into the resulting HTML page layout via an unescaped printtestresult() or printf call. Because the code does not pass these parameters through a strict encoding layer like htmlspecialchars(), attackers can force a browser to inject unauthorized HTML syntax—such as fake credential-phishing forms or malicious layout overrides—bypassing standard CSP boundary rules. | critical | |
| CVE-2026-52847 | The vulnerability exists due to missing output escaping on unauthenticated web parameters. Within the setup script /admin/install.php, user-controlled request inputs are echoed straight back into the resulting HTML page layout via an unescaped printtestresult() or printf call. Because the code does not pass these parameters through a strict encoding layer like htmlspecialchars(), attackers can force a browser to inject unauthorized HTML syntax—such as fake credential-phishing forms or malicious layout overrides—bypassing standard CSP boundary rules. | critical | |
| CVE-2026-50055 | The vulnerability exists due to a security filtering flaw within the mail compliance validation engine, allowing authenticated email accounts to bypass active administrator configured external forwarding rules and exfiltrate mailbox data. | medium | |
| CVE-2026-50054 | The vulnerability exists due to an authorization validation loophole inside the mailbox delegation processing subsystem, allowing a delegated account profile to bypass boundary checks and perform actions outside its explicitly granted system scope. | high | |
| CVE-2026-47156 | The vulnerability exists due to flawed login logic in the SOAP API's mci_check_login() function. The code improperly evaluates client-supplied data by validating a user's own session cookie string against an entirely separate target username provided in the SOAP request. This logic error allows an attacker to supply their own valid cookie_string along with a target username (such as administrator) to gain complete unauthenticated access and escalate privileges. | critical | |
| CVE-2026-47142 | The vulnerability exists due to insecure concatenation of configuration data directly into raw SQL strings. Specifically, the history_order configuration value is parsed in core/history_api.php and injected directly into an ORDER BY clause. Because the application applies zero sanitization, string parameterization, or whitelist validation against this configuration value before running the query, an administrator can store a malicious SQL payload that persistently executes when users view bug history. | high | |
| CVE-2026-10631 | The vulnerability exists due to an access control verification defect within the Exchange Web Services extension component, which enables authenticated software users to exceed their intended operational privileges and access restricted server management modules. | high | |
| CVE-2026-61246 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). | high | 2026-07-24 |
| CVE-2026-60455 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). | high | 2026-07-24 |
| CVE-2026-60439 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). | high | 2026-07-24 |
| CVE-2026-60373 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). | high | 2026-07-24 |
| CVE-2026-60372 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). | critical | 2026-07-24 |
| CVE-2026-60371 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Platform Security for Java executes to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Security for Java, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). | high | 2026-07-24 |
| CVE-2026-60370 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). | high | 2026-07-24 |
| CVE-2026-60369 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Security for Java, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). | critical | 2026-07-24 |
| CVE-2026-60368 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). | high | 2026-07-24 |
| CVE-2026-60367 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). | critical | 2026-07-24 |
| CVE-2026-60366 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Security for Java, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). | critical | 2026-07-23 |
| CVE-2026-38766 | An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the sub_186f4 function | high | 2026-07-24 |
