By publication date

Exploited and new serious CVEs: July 2026

1,301 records · 21 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 14

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
30Monitor	CVE-2026-44840Proof of concept	Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Querydgraph-io · dgraph · CWE-943 Pre-auth SQL injection	High7.5	—	0.4%	Jul 8, 2026
37Monitor	CVE-2026-58480Proof of concept	Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachmentscreative themes · blocksy companion · CWE-434 pre-auth RCE File upload	Critical9.2	—	3.5%	Jul 8, 2026
18Monitor	CVE-2026-14361Proof of concept	Consul-template is vulnerable to path redirection in writeToFile through symlink attackhashicorp · tooling · CWE-59	Medium4.7	—	0.1%	Jul 8, 2026
27Monitor	CVE-2026-36027Proof of concept	An issue in Code27 Companion Hub SQ3A.220705.003.A1 allows a physically proximate attacker to execute arbitrary code via the USB debugging (CWE-1313 RCE	Medium6.8	—	0.2%	Jul 8, 2026
65This week	CVE-2026-59822Weaponized	LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallbacklitellm · litellm · CWE-287 Pre-auth Auth bypass	High8.8	KEV	0.8%	Jul 8, 2026
24Monitor	CVE-2026-58191Proof of concept	Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routesappium · appium\/base-driver · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	Jul 8, 2026
30Monitor	CVE-2026-60105Proof of concept	Monsta FTP < 2.14.5 SSRF via IPv4-Mapped IPv6 Address Bypassmonsta limited of new zealand · monsta ftp · CWE-918 Pre-auth SSRF CSRF	High7.7	—	1.5%	Jul 8, 2026
39Monitor	CVE-2026-31309Proof of concept	Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated atCWE-862 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Jul 8, 2026
39Monitor	CVE-2026-44024Proof of concept	Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholderfluentd · fluentd · CWE-22 pre-auth RCE Path traversal	Critical9.8	—	1.0%	Jul 8, 2026
39Monitor	CVE-2026-52200Proof of concept	An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API CWE-94 pre-auth RCE	Critical9.8	—	0.9%	Jul 8, 2026
74This week	CVE-2026-56291Weaponized	Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1balbooa · forms · CWE-434 pre-auth RCE File upload	Critical10.0	KEV	14.8%	Jul 9, 2026
36Monitor	CVE-2026-56292Proof of concept	Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1acymailing · acymailing · CWE-89 Pre-auth SQL injection	Critical9.2	—	1.3%	Jul 9, 2026
21Monitor	CVE-2026-59212No exploit	Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/deleteopenwebui · open webui · CWE-863 Broken access control (IDOR)	Medium5.4	—	0.4%	Jul 9, 2026
32Monitor	CVE-2026-55420No exploit	Discourse: Remote code execution via pdf uploadsdiscourse · discourse · CWE-78 pre-auth RCE Command injection	High8.1	—	0.6%	Jul 9, 2026
41Plan	CVE-2026-59726Proof of concept	Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deploymentruvnet · ruflo · CWE-78 pre-auth RCE Auth bypass Command injection	Critical10.0	—	3.0%	Jul 9, 2026
35Monitor	CVE-2026-59734Proof of concept	Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Executioncoollabsio · coolify · CWE-78 RCE Command injection	High8.8	—	0.8%	Jul 9, 2026
36Monitor	CVE-2026-59827Proof of concept	Metabase: Unsafe Deserialization of H2 Query Resultsmetabase · metabase · CWE-502 Deserialization	High8.8	—	3.7%	Jul 9, 2026
34Monitor	CVE-2026-61343Proof of concept	LibreBooking path traversallibrebooking · librebooking · CWE-23 Path traversal	High8.6	—	1.0%	Jul 9, 2026
38Monitor	CVE-2026-58123Proof of concept	Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal APInesquena · hermes-webui · CWE-306 pre-auth RCE Auth bypass	Critical9.3	—	4.6%	Jul 9, 2026
30Monitor	CVE-2025-63579Proof of concept	Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported.CWE-200 Pre-auth Info leak	High7.5	—	0.2%	Jul 9, 2026
28Monitor	CVE-2026-50181Proof of concept	Langroid: Path traversal in the file tools allows read/write outside configured current directorylangroid · langroid · CWE-22 Path traversal	High7.1	—	0.1%	Jul 9, 2026
32Monitor	CVE-2025-45422Proof of concept	Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictions and make arbitrary changes CWE-284 Broken access control (IDOR)	High8.1	—	0.4%	Jul 9, 2026
41Plan	CVE-2026-14894Proof of concept	Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)webrehab · super forms – drag & drop form builder · CWE-434 pre-auth RCE File upload	Critical9.8	—	5.0%	Jul 10, 2026
39Monitor	CVE-2026-15282Proof of concept	Instant Appointment <= 1.2 - Unauthenticated Arbitrary File Uploadtenteeglobal · instant appointment · CWE-434 pre-auth RCE File upload	Critical9.8	—	1.0%	Jul 10, 2026
33Monitor	CVE-2026-21045Proof of concept	Out-of-bounds write in parsing TIFF format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write samsung mobile · samsung mobile devices · CWE-787 Pre-auth Memory safety	High8.3	—	0.5%	Jul 10, 2026
34Monitor	CVE-2026-21055Proof of concept	Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands wisamsung mobile · bixby · CWE-926 RCE Local privilege escalation	High8.5	—	0.1%	Jul 10, 2026
17Monitor	CVE-2026-12400Proof of concept	FlowForms <= 1.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification via REST API '/flowforms/v1/forms/{id}' Endpoipriyanshuchaudhary · flowforms – conversational form builder · CWE-639 Broken access control (IDOR)	Medium4.3	—	0.3%	Jul 10, 2026
17Monitor	CVE-2026-6440Proof of concept	GoodMeet <= 1.1.8 - Cross-Site Request Forgery to Google Meet Credential Reset via 'goodmeet_reset_google_meet_credential'sovlix · goodmeet – google meet integration for webinar, meeting & video conference · CWE-352 Pre-auth CSRF	Medium4.3	—	0.2%	Jul 10, 2026
25Monitor	CVE-2026-13247Proof of concept	Logo Slider <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lgx_tooltip_position' Parameterlogichunt · logo slider wp – responsive logo carousel, logo gallery & logo showcase · CWE-79 XSS	Medium6.4	—	0.3%	Jul 10, 2026
20Monitor	CVE-2026-14461Proof of concept	Out-of-bound read in mtrbitwizard · mtr · CWE-125 Pre-auth Memory safety	Medium5.1	—	0.3%	Jul 10, 2026
8Monitor	CVE-2026-58225Proof of concept	SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of serviceelixir-ecto · postgrex · CWE-89 SQL injection	Low2.1	—	0.2%	Jul 10, 2026
24Monitor	CVE-2026-29519Proof of concept	Lucee CFML Server Reflected XSS via URL Path Parsinglucee · lucee · CWE-79 pre-auth RCE XSS	Medium6.2	—	0.4%	Jul 10, 2026
36Monitor	CVE-2026-51119Proof of concept	An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser componentsCWE-269 Pre-auth	Critical9.1	—	0.5%	Jul 10, 2026
9Monitor	CVE-2026-55780Proof of concept	NanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry Sizem2team · nanazip · CWE-248	Low2.4	—	0.4%	Jul 10, 2026
9Monitor	CVE-2026-55781Proof of concept	NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fieldsm2team · nanazip · CWE-400 Denial of service	Low2.4	—	0.1%	Jul 10, 2026
38Monitor	CVE-2026-61459Proof of concept	MCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured Toolssuyogs · mcp-server-kubernetes · CWE-88 Pre-auth	Critical9.3	—	2.3%	Jul 10, 2026
34Monitor	CVE-2026-57850Proof of concept	RustDesk Missing Session Scope Enforcement Allows Out-of-Scope Control Message Injectionrustdesk · rustdesk · CWE-862 Broken access control (IDOR)	High8.7	—	0.4%	Jul 10, 2026
30Monitor	CVE-2026-55229Proof of concept	Gotenberg: SSRF via LibreOffice document processinggotenberg · gotenberg · CWE-918 Pre-auth SSRF	High7.5	—	1.5%	Jul 10, 2026
35Monitor	CVE-2026-57219Proof of concept	RabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurationsbroadcom · rabbitmq server · CWE-200 Pre-auth Info leak	High8.7	—	2.8%	Jul 10, 2026
40Plan	CVE-2026-10768Proof of concept	LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039localgovdrupal · localgov workflows · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.8	—	2.1%	Jul 10, 2026
13Monitor	CVE-2026-13233Proof of concept	OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053openai provider project · openai provider · CWE-918 SSRF	Low3.3	—	0.2%	Jul 10, 2026
25Monitor	CVE-2026-49844Proof of concept	Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()apache · log4j · CWE-116 Pre-auth	Medium6.3	—	0.5%	Jul 10, 2026
25Monitor	CVE-2026-15096No exploit	Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Fieldthemifyme · themify builder · CWE-79 XSS	Medium6.4	—	0.3%	Jul 11, 2026
60This week	CVE-2026-3576Weaponized	Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameterxtreeme · planyo online reservation system · CWE-20 Pre-auth SSRF	High7.2	—	8.8%	Jul 11, 2026
31Monitor	CVE-2026-9282Proof of concept	W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameterboldgrid · w3 total cache · CWE-22 Pre-auth Path traversal	High7.5	—	2.8%	Jul 11, 2026
41Plan	CVE-2026-57827Proof of concept	Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12rsjoomla · rsfiles\! · CWE-434 pre-auth RCE File upload	Critical10.0	—	2.3%	Jul 11, 2026
41Plan	CVE-2026-61447Proof of concept	PraisonAI before 1.6.78 Remote Code Execution via CodeAgentmervinpraison · praisonai · CWE-94 pre-auth RCE	Critical10.0	—	2.4%	Jul 11, 2026
37Monitor	CVE-2026-61876Proof of concept	LuCI DHCPv6 Lease Hostname Stored Cross-Site Scriptingopenwrt · luci · CWE-79 Pre-auth XSS	Critical9.4	—	1.2%	Jul 12, 2026
21Monitor	CVE-2026-15502Proof of concept	AojiaoZero Antaris PayPal IPN Payment ipn.php _rewardPurchase sql injectionaojiaozero · antaris · CWE-74 SQL injection	Medium5.3	—	0.3%	Jul 12, 2026
7Monitor	CVE-2026-15520No exploit	GNU LibreDWG R2004 Section Decompression decode.c decompress_R2004_section heap-based overflowgnu · libredwg · CWE-119 Memory safety	Low1.9	—	0.1%	Jul 12, 2026
34Monitor	CVE-2026-57829Proof of concept	Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7ollyo · helix ultimate · CWE-79 Pre-auth XSS	High8.7	—	0.2%	Jul 13, 2026
35Monitor	CVE-2026-57830Proof of concept	Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7ollyo · helix ultimate · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.4%	Jul 13, 2026
40Plan	CVE-2026-57811Proof of concept	WordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerabilityrealtyna · realtyna organic idx plugin · CWE-94 pre-auth RCE	Critical10.0	—	0.5%	Jul 13, 2026
8Monitor	CVE-2026-40468No exploit	Heap buffer overflow in gawkfossies · gawk · CWE-190 Memory safety	Low2.1	—	0.2%	Jul 13, 2026
38Monitor	CVE-2026-60121Proof of concept	Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via ping.phpvitec · flamingo · CWE-78 pre-auth RCE Command injection	Critical9.3	—	3.3%	Jul 13, 2026
22Monitor	CVE-2026-53365Proof of concept	vsock/virtio: fix zerocopy completion for multi-skb sendslinux · linux kernel · CWE-401 Denial of service	Medium5.5	—	0.1%	Jul 13, 2026
37Monitor	CVE-2026-61500Proof of concept	Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Keyrejetto · hfs · CWE-338 pre-auth RCE Weak crypto	Critical9.3	—	0.9%	Jul 13, 2026
38Monitor	CVE-2026-6875Proof of concept	Sandbox Escape in ServiceNow AI Platformservicenow · servicenow ai platform · CWE-94 pre-auth RCE	Critical9.5	—	1.4%	Jul 13, 2026
21Monitor	CVE-2026-15598Proof of concept	antv layout object.js setNestedValue prototype pollutionantv · layout · CWE-94 RCE Prototype pollution	Medium5.3	—	0.4%	Jul 13, 2026
38Monitor	CVE-2026-59801Proof of concept	9Router 0.4.41 - Unauthenticated API Exposure via /api/providersdecolua · 9router · CWE-306 Pre-auth Auth bypass	Critical9.3	—	2.9%	Jul 13, 2026
19Monitor	CVE-2026-12478Proof of concept	Libsoup: incomplete fix for cve-2026-0716: out-of-bounds read in libsoup websocket frame processing (unmasked path)red hat · red hat enterprise linux 10 · CWE-125 Pre-auth Memory safety	Medium4.8	—	0.2%	Jul 14, 2026
17Monitor	CVE-2026-15718Proof of concept	Invalid pointer in the JavaScript: WebAssembly componentmozilla · firefox · CWE-763 Pre-auth	Medium4.3	—	0.4%	Jul 14, 2026
30Monitor	CVE-2026-12523Proof of concept	Resource exhaustion in quiche HTTP/3 and QPACK layerscloudflare · quiche · CWE-400 Pre-auth Denial of service	High7.5	—	0.5%	Jul 14, 2026
26Monitor	CVE-2026-34348Proof of concept	Windows Event Logging Service Information Disclosure Vulnerabilitymicrosoft · windows 10 1809 · CWE-693	Medium6.5	—	0.9%	Jul 14, 2026
25Monitor	CVE-2026-36214Proof of concept	osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip costicket · osticket · CWE-79 RCE XSS	Medium6.4	—	0.3%	Jul 14, 2026
31Monitor	CVE-2026-49176Proof of concept	Windows WalletService Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-59 Local privilege escalation	High7.8	—	0.3%	Jul 14, 2026
32Monitor	CVE-2026-50338Proof of concept	Azure Spring Apps Elevation of Privilege Vulnerabilitymicrosoft · azure spring cloud · CWE-287 Auth bypass	High8.2	—	0.5%	Jul 14, 2026
70This week	CVE-2026-50522Weaponized	Microsoft SharePoint Remote Code Execution Vulnerabilitymicrosoft · sharepoint server · CWE-502 pre-auth RCE Deserialization	Critical9.8	KEV	3.0%	Jul 14, 2026
28Monitor	CVE-2026-54107Proof of concept	Windows Win32k Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-362 Local privilege escalation Race condition	High7.0	—	0.2%	Jul 14, 2026
40Plan	CVE-2026-54433Proof of concept	In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email messageroundcube · webmail · CWE-79 Pre-auth XSS	Critical10.0	—	0.3%	Jul 14, 2026
31Monitor	CVE-2026-54992Proof of concept	Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerabilitymicrosoft · windows 10 1607 · CWE-122 RCE Memory safety	High7.8	—	0.3%	Jul 14, 2026
31Monitor	CVE-2026-55006No exploit	Microsoft Exchange Server Elevation of Privilege Vulnerabilitymicrosoft · exchange server · CWE-1220 Local privilege escalation	High7.8	—	0.2%	Jul 14, 2026
61This week	CVE-2026-56155Weaponized	Active Directory Federation Services Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-1220 Local privilege escalation	High7.8	KEV	0.3%	Jul 14, 2026
69This week	CVE-2026-56164Weaponized	Microsoft SharePoint Server Elevation of Privilege Vulnerabilitymicrosoft · sharepoint server · CWE-306 Pre-auth Auth bypass	Critical9.8	KEV	1.0%	Jul 14, 2026
31Monitor	CVE-2026-58635Proof of concept	Windows Narrator Braille Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1809 · CWE-77 RCE Local privilege escalation Command injection	High7.8	—	0.3%	Jul 14, 2026
74This week	CVE-2026-58644Weaponized	Microsoft SharePoint Remote Code Execution Vulnerabilitymicrosoft · sharepoint server · CWE-502 pre-auth RCE Deserialization	Critical9.8	KEV	15.8%	Jul 14, 2026
38Monitor	CVE-2026-59891Proof of concept	Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registrysigstore · sigstore-js · CWE-522 Pre-auth Info leak	Critical9.6	—	0.4%	Jul 14, 2026
25Monitor	CVE-2026-45067Proof of concept	Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Addresssymfony · symfony · CWE-93 pre-auth RCE Command injection	Medium6.3	—	0.5%	Jul 14, 2026
31Monitor	CVE-2026-50343Proof of concept	Microsoft Install Service Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1809 · CWE-269 Local privilege escalation	High7.8	—	0.2%	Jul 14, 2026
35Monitor	CVE-2026-50369Proof of concept	Windows Remote Desktop Services Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-362 Race condition	High8.8	—	0.7%	Jul 14, 2026
31Monitor	CVE-2026-50402Proof of concept	NTFS Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-126 Local privilege escalation	High7.8	—	0.3%	Jul 14, 2026
13Monitor	CVE-2026-50416Proof of concept	Win32k Information Disclosure Vulnerabilitymicrosoft · windows 11 24h2 · CWE-200 Info leak	Low3.3	—	0.4%	Jul 14, 2026
35Monitor	CVE-2026-50444No exploit	Windows Server Update Service (WSUS) Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-306 Auth bypass	High8.8	—	0.7%	Jul 14, 2026
22Monitor	CVE-2026-50657Proof of concept	Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerabilitymicrosoft · defender for endpoint · CWE-359 Info leak	Medium5.5	—	0.4%	Jul 14, 2026
35Monitor	CVE-2026-54121Proof of concept	Active Directory Certificate Services Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-285 Broken access control (IDOR)	High8.8	—	0.7%	Jul 14, 2026
87Now	CVE-2026-55040Weaponized	Microsoft SharePoint Server Security Feature Bypass Vulnerabilitymicrosoft · sharepoint server · CWE-1390 Pre-auth Auth bypass	Critical9.1	KEV	69.5%	Jul 14, 2026
36Monitor	CVE-2026-10672Proof of concept	Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)zephyrproject · zephyr · CWE-125 Pre-auth Memory safety	Critical9.1	—	0.5%	Jul 14, 2026
35Monitor	CVE-2026-47301Proof of concept	Configuration Manager Elevation of Privilege Vulnerabilitymicrosoft · configuration manager 2503 · CWE-284 Broken access control (IDOR)	High8.8	—	0.7%	Jul 14, 2026
40Plan	CVE-2026-13001Proof of concept	Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parametereteubert · podlove podcast publisher · CWE-20 pre-auth RCE File upload	Critical9.8	—	3.7%	Jul 14, 2026
72This week	CVE-2026-15409Weaponized	A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface.sonicwall · sma6210 firmware · CWE-918 Pre-auth SSRF	Critical10.0	KEV	6.7%	Jul 14, 2026
62This week	CVE-2026-15410Weaponized	Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Mansonicwall · sma6210 firmware · CWE-94 RCE	High7.2	KEV	11.7%	Jul 14, 2026
34Monitor	CVE-2026-45071Proof of concept	Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = truesensiolabs · symfony · CWE-611 Pre-auth XXE	High8.7	—	0.5%	Jul 14, 2026
32Monitor	CVE-2026-47423Proof of concept	DOMPurify XSS via `selectedcontent` re-clonecure53 · dompurify · CWE-79 Pre-auth XSS	High8.2	—	0.4%	Jul 14, 2026
23Monitor	CVE-2026-47429Proof of concept	Vitest: Arbitrary file can be read and executed when Vitest UI server is listeningvitest.dev · vitest · CWE-22 Pre-auth Path traversal	Medium5.9	—	0.8%	Jul 14, 2026
37Monitor	CVE-2026-48356Proof of concept	Adobe Commerce \| Unrestricted Upload of File with Dangerous Type (CWE-434)adobe · commerce · CWE-434 pre-auth RCE File upload	Critical9.3	—	1.0%	Jul 14, 2026
30Monitor	CVE-2026-52100Proof of concept	Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to execute arbitrary codCWE-352 pre-auth RCE CSRF	High7.5	—	0.3%	Jul 14, 2026
32Monitor	CVE-2026-13585Proof of concept	Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Contasus · system control interface v3 · CWE-226	High8.2	—	0.1%	Jul 14, 2026
34Monitor	CVE-2026-15583Proof of concept	SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL headergrafana · grafana mcp server · CWE-610 Pre-auth SSRF	High8.6	—	0.5%	Jul 15, 2026
32Monitor	CVE-2026-57821Proof of concept	Apache Fineract: Office list: SQL Injection via Subquery in orderByapache · fineract · CWE-89 SQL injection	High8.1	—	0.7%	Jul 15, 2026
33Monitor	CVE-2026-61430No exploit	PraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawlmervinpraison · praisonai · CWE-918 SSRF	High8.4	—	0.3%	Jul 15, 2026

CVE-2026-44840
30Monitor
Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
dgraph-io · dgraphJul 8, 2026
CVE-2026-58480
37Monitor
Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachments
CriticalCVSS 9.2Proof of conceptEPSS 3%
- pre-auth RCE
- File upload
creative themes · blocksy companionJul 8, 2026
CVE-2026-14361
18Monitor
Consul-template is vulnerable to path redirection in writeToFile through symlink attack
MediumCVSS 4.7Proof of conceptEPSS 0%
hashicorp · toolingJul 8, 2026
CVE-2026-36027
27Monitor
An issue in Code27 Companion Hub SQ3A.220705.003.A1 allows a physically proximate attacker to execute arbitrary code via the USB debugging (
MediumCVSS 6.8Proof of conceptEPSS 0%
- RCE
Jul 8, 2026
CVE-2026-59822
65This week
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
HighCVSS 8.8KEVWeaponizedEPSS 0%
- Pre-auth
- Auth bypass
litellm · litellmJul 8, 2026
CVE-2026-58191
24Monitor
Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
appium · appium\/base-driverJul 8, 2026
CVE-2026-60105
30Monitor
Monsta FTP < 2.14.5 SSRF via IPv4-Mapped IPv6 Address Bypass
HighCVSS 7.7Proof of conceptEPSS 1%
- Pre-auth
- SSRF
- CSRF
monsta limited of new zealand · monsta ftpJul 8, 2026
CVE-2026-31309
39Monitor
Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated at
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Jul 8, 2026
CVE-2026-44024
39Monitor
Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
- Path traversal
fluentd · fluentdJul 8, 2026
CVE-2026-52200
39Monitor
An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API
CriticalCVSS 9.8Proof of conceptEPSS 0%
- pre-auth RCE
Jul 8, 2026
CVE-2026-56291
74This week
Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1
CriticalCVSS 10.0KEVWeaponizedEPSS 14%
- pre-auth RCE
- File upload
balbooa · formsJul 9, 2026
CVE-2026-56292
36Monitor
Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1
CriticalCVSS 9.2Proof of conceptEPSS 1%
- Pre-auth
- SQL injection
acymailing · acymailingJul 9, 2026
CVE-2026-59212
21Monitor
Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete
MediumCVSS 5.4No exploitEPSS 0%
- Broken access control (IDOR)
openwebui · open webuiJul 9, 2026
CVE-2026-55420
32Monitor
Discourse: Remote code execution via pdf uploads
HighCVSS 8.1No exploitEPSS 0%
- pre-auth RCE
- Command injection
discourse · discourseJul 9, 2026
CVE-2026-59726
41Plan
Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment
CriticalCVSS 10.0Proof of conceptEPSS 3%
- pre-auth RCE
- Auth bypass
- Command injection
ruvnet · rufloJul 9, 2026
CVE-2026-59734
35Monitor
Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution
HighCVSS 8.8Proof of conceptEPSS 0%
- RCE
- Command injection
coollabsio · coolifyJul 9, 2026
CVE-2026-59827
36Monitor
Metabase: Unsafe Deserialization of H2 Query Results
HighCVSS 8.8Proof of conceptEPSS 3%
- Deserialization
metabase · metabaseJul 9, 2026
CVE-2026-61343
34Monitor
LibreBooking path traversal
HighCVSS 8.6Proof of conceptEPSS 1%
- Path traversal
librebooking · librebookingJul 9, 2026
CVE-2026-58123
38Monitor
Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API
CriticalCVSS 9.3Proof of conceptEPSS 4%
- pre-auth RCE
- Auth bypass
nesquena · hermes-webuiJul 9, 2026
CVE-2025-63579
30Monitor
Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported.
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Info leak
Jul 9, 2026
CVE-2026-50181
28Monitor
Langroid: Path traversal in the file tools allows read/write outside configured current directory
HighCVSS 7.1Proof of conceptEPSS 0%
- Path traversal
langroid · langroidJul 9, 2026
CVE-2025-45422
32Monitor
Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictions and make arbitrary changes
HighCVSS 8.1Proof of conceptEPSS 0%
- Broken access control (IDOR)
Jul 9, 2026
CVE-2026-14894
41Plan
Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)
CriticalCVSS 9.8Proof of conceptEPSS 5%
- pre-auth RCE
- File upload
webrehab · super forms – drag & drop form builderJul 10, 2026
CVE-2026-15282
39Monitor
Instant Appointment <= 1.2 - Unauthenticated Arbitrary File Upload
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
- File upload
tenteeglobal · instant appointmentJul 10, 2026
CVE-2026-21045
33Monitor
Out-of-bounds write in parsing TIFF format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write
HighCVSS 8.3Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
samsung mobile · samsung mobile devicesJul 10, 2026
CVE-2026-21055
34Monitor
Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands wi
HighCVSS 8.5Proof of conceptEPSS 0%
- RCE
- Local privilege escalation
samsung mobile · bixbyJul 10, 2026
CVE-2026-12400
17Monitor
FlowForms <= 1.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification via REST API '/flowforms/v1/forms/{id}' Endpoi
MediumCVSS 4.3Proof of conceptEPSS 0%
- Broken access control (IDOR)
priyanshuchaudhary · flowforms – conversational form builderJul 10, 2026
CVE-2026-6440
17Monitor
GoodMeet <= 1.1.8 - Cross-Site Request Forgery to Google Meet Credential Reset via 'goodmeet_reset_google_meet_credential'
MediumCVSS 4.3Proof of conceptEPSS 0%
- Pre-auth
- CSRF
sovlix · goodmeet – google meet integration for webinar, meeting & video conferenceJul 10, 2026
CVE-2026-13247
25Monitor
Logo Slider <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lgx_tooltip_position' Parameter
MediumCVSS 6.4Proof of conceptEPSS 0%
- XSS
logichunt · logo slider wp – responsive logo carousel, logo gallery & logo showcaseJul 10, 2026
CVE-2026-14461
20Monitor
Out-of-bound read in mtr
MediumCVSS 5.1Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
bitwizard · mtrJul 10, 2026
CVE-2026-58225
8Monitor
SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service
LowCVSS 2.1Proof of conceptEPSS 0%
- SQL injection
elixir-ecto · postgrexJul 10, 2026
CVE-2026-29519
24Monitor
Lucee CFML Server Reflected XSS via URL Path Parsing
MediumCVSS 6.2Proof of conceptEPSS 0%
- pre-auth RCE
- XSS
lucee · luceeJul 10, 2026
CVE-2026-51119
36Monitor
An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components
CriticalCVSS 9.1Proof of conceptEPSS 0%
- Pre-auth
Jul 10, 2026
CVE-2026-55780
9Monitor
NanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry Size
LowCVSS 2.4Proof of conceptEPSS 0%
m2team · nanazipJul 10, 2026
CVE-2026-55781
9Monitor
NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fields
LowCVSS 2.4Proof of conceptEPSS 0%
- Denial of service
m2team · nanazipJul 10, 2026
CVE-2026-61459
38Monitor
MCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured Tools
CriticalCVSS 9.3Proof of conceptEPSS 2%
- Pre-auth
suyogs · mcp-server-kubernetesJul 10, 2026
CVE-2026-57850
34Monitor
RustDesk Missing Session Scope Enforcement Allows Out-of-Scope Control Message Injection
HighCVSS 8.7Proof of conceptEPSS 0%
- Broken access control (IDOR)
rustdesk · rustdeskJul 10, 2026
CVE-2026-55229
30Monitor
Gotenberg: SSRF via LibreOffice document processing
HighCVSS 7.5Proof of conceptEPSS 1%
- Pre-auth
- SSRF
gotenberg · gotenbergJul 10, 2026
CVE-2026-57219
35Monitor
RabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurations
HighCVSS 8.7Proof of conceptEPSS 2%
- Pre-auth
- Info leak
broadcom · rabbitmq serverJul 10, 2026
CVE-2026-10768
40Plan
LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039
CriticalCVSS 9.8Proof of conceptEPSS 2%
- Pre-auth
- Broken access control (IDOR)
localgovdrupal · localgov workflowsJul 10, 2026
CVE-2026-13233
13Monitor
OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053
LowCVSS 3.3Proof of conceptEPSS 0%
- SSRF
openai provider project · openai providerJul 10, 2026
CVE-2026-49844
25Monitor
Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()
MediumCVSS 6.3Proof of conceptEPSS 0%
- Pre-auth
apache · log4jJul 10, 2026
CVE-2026-15096
25Monitor
Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field
MediumCVSS 6.4No exploitEPSS 0%
- XSS
themifyme · themify builderJul 11, 2026
CVE-2026-3576
60This week
Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter
HighCVSS 7.2WeaponizedEPSS 8%
- Pre-auth
- SSRF
xtreeme · planyo online reservation systemJul 11, 2026
CVE-2026-9282
31Monitor
W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter
HighCVSS 7.5Proof of conceptEPSS 2%
- Pre-auth
- Path traversal
boldgrid · w3 total cacheJul 11, 2026
CVE-2026-57827
41Plan
Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12
CriticalCVSS 10.0Proof of conceptEPSS 2%
- pre-auth RCE
- File upload
rsjoomla · rsfiles\!Jul 11, 2026
CVE-2026-61447
41Plan
PraisonAI before 1.6.78 Remote Code Execution via CodeAgent
CriticalCVSS 10.0Proof of conceptEPSS 2%
- pre-auth RCE
mervinpraison · praisonaiJul 11, 2026
CVE-2026-61876
37Monitor
LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting
CriticalCVSS 9.4Proof of conceptEPSS 1%
- Pre-auth
- XSS
openwrt · luciJul 12, 2026
CVE-2026-15502
21Monitor
AojiaoZero Antaris PayPal IPN Payment ipn.php _rewardPurchase sql injection
MediumCVSS 5.3Proof of conceptEPSS 0%
- SQL injection
aojiaozero · antarisJul 12, 2026
CVE-2026-15520
7Monitor
GNU LibreDWG R2004 Section Decompression decode.c decompress_R2004_section heap-based overflow
LowCVSS 1.9No exploitEPSS 0%
- Memory safety
gnu · libredwgJul 12, 2026
CVE-2026-57829
34Monitor
Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
- XSS
ollyo · helix ultimateJul 13, 2026
CVE-2026-57830
35Monitor
Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7
HighCVSS 8.8Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
ollyo · helix ultimateJul 13, 2026
CVE-2026-57811
40Plan
WordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerability
CriticalCVSS 10.0Proof of conceptEPSS 0%
- pre-auth RCE
realtyna · realtyna organic idx pluginJul 13, 2026
CVE-2026-40468
8Monitor
Heap buffer overflow in gawk
LowCVSS 2.1No exploitEPSS 0%
- Memory safety
fossies · gawkJul 13, 2026
CVE-2026-60121
38Monitor
Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via ping.php
CriticalCVSS 9.3Proof of conceptEPSS 3%
- pre-auth RCE
- Command injection
vitec · flamingoJul 13, 2026
CVE-2026-53365
22Monitor
vsock/virtio: fix zerocopy completion for multi-skb sends
MediumCVSS 5.5Proof of conceptEPSS 0%
- Denial of service
linux · linux kernelJul 13, 2026
CVE-2026-61500
37Monitor
Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key
CriticalCVSS 9.3Proof of conceptEPSS 0%
- pre-auth RCE
- Weak crypto
rejetto · hfsJul 13, 2026
CVE-2026-6875
38Monitor
Sandbox Escape in ServiceNow AI Platform
CriticalCVSS 9.5Proof of conceptEPSS 1%
- pre-auth RCE
servicenow · servicenow ai platformJul 13, 2026
CVE-2026-15598
21Monitor
antv layout object.js setNestedValue prototype pollution
MediumCVSS 5.3Proof of conceptEPSS 0%
- RCE
- Prototype pollution
antv · layoutJul 13, 2026
CVE-2026-59801
38Monitor
9Router 0.4.41 - Unauthenticated API Exposure via /api/providers
CriticalCVSS 9.3Proof of conceptEPSS 2%
- Pre-auth
- Auth bypass
decolua · 9routerJul 13, 2026
CVE-2026-12478
19Monitor
Libsoup: incomplete fix for cve-2026-0716: out-of-bounds read in libsoup websocket frame processing (unmasked path)
MediumCVSS 4.8Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
red hat · red hat enterprise linux 10Jul 14, 2026
CVE-2026-15718
17Monitor
Invalid pointer in the JavaScript: WebAssembly component
MediumCVSS 4.3Proof of conceptEPSS 0%
- Pre-auth
mozilla · firefoxJul 14, 2026
CVE-2026-12523
30Monitor
Resource exhaustion in quiche HTTP/3 and QPACK layers
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
cloudflare · quicheJul 14, 2026
CVE-2026-34348
26Monitor
Windows Event Logging Service Information Disclosure Vulnerability
MediumCVSS 6.5Proof of conceptEPSS 0%
microsoft · windows 10 1809Jul 14, 2026
CVE-2026-36214
25Monitor
osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip c
MediumCVSS 6.4Proof of conceptEPSS 0%
- RCE
- XSS
osticket · osticketJul 14, 2026
CVE-2026-49176
31Monitor
Windows WalletService Elevation of Privilege Vulnerability
HighCVSS 7.8Proof of conceptEPSS 0%
- Local privilege escalation
microsoft · windows 10 1607Jul 14, 2026
CVE-2026-50338
32Monitor
Azure Spring Apps Elevation of Privilege Vulnerability
HighCVSS 8.2Proof of conceptEPSS 0%
- Auth bypass
microsoft · azure spring cloudJul 14, 2026
CVE-2026-50522
70This week
Microsoft SharePoint Remote Code Execution Vulnerability
CriticalCVSS 9.8KEVWeaponizedEPSS 3%
- pre-auth RCE
- Deserialization
microsoft · sharepoint serverJul 14, 2026
CVE-2026-54107
28Monitor
Windows Win32k Elevation of Privilege Vulnerability
HighCVSS 7.0Proof of conceptEPSS 0%
- Local privilege escalation
- Race condition
microsoft · windows 10 1607Jul 14, 2026
CVE-2026-54433
40Plan
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message
CriticalCVSS 10.0Proof of conceptEPSS 0%
- Pre-auth
- XSS
roundcube · webmailJul 14, 2026
CVE-2026-54992
31Monitor
Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability
HighCVSS 7.8Proof of conceptEPSS 0%
- RCE
- Memory safety
microsoft · windows 10 1607Jul 14, 2026
CVE-2026-55006
31Monitor
Microsoft Exchange Server Elevation of Privilege Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
microsoft · exchange serverJul 14, 2026
CVE-2026-56155
61This week
Active Directory Federation Services Elevation of Privilege Vulnerability
HighCVSS 7.8KEVWeaponizedEPSS 0%
- Local privilege escalation
microsoft · windows 10 1607Jul 14, 2026
CVE-2026-56164
69This week
Microsoft SharePoint Server Elevation of Privilege Vulnerability
CriticalCVSS 9.8KEVWeaponizedEPSS 1%
- Pre-auth
- Auth bypass
microsoft · sharepoint serverJul 14, 2026
CVE-2026-58635
31Monitor
Windows Narrator Braille Elevation of Privilege Vulnerability
HighCVSS 7.8Proof of conceptEPSS 0%
- RCE
- Local privilege escalation
- Command injection
microsoft · windows 10 1809Jul 14, 2026
CVE-2026-58644
74This week
Microsoft SharePoint Remote Code Execution Vulnerability
CriticalCVSS 9.8KEVWeaponizedEPSS 15%
- pre-auth RCE
- Deserialization
microsoft · sharepoint serverJul 14, 2026
CVE-2026-59891
38Monitor
Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
CriticalCVSS 9.6Proof of conceptEPSS 0%
- Pre-auth
- Info leak
sigstore · sigstore-jsJul 14, 2026
CVE-2026-45067
25Monitor
Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
MediumCVSS 6.3Proof of conceptEPSS 0%
- pre-auth RCE
- Command injection
symfony · symfonyJul 14, 2026
CVE-2026-50343
31Monitor
Microsoft Install Service Elevation of Privilege Vulnerability
HighCVSS 7.8Proof of conceptEPSS 0%
- Local privilege escalation
microsoft · windows 10 1809Jul 14, 2026
CVE-2026-50369
35Monitor
Windows Remote Desktop Services Elevation of Privilege Vulnerability
HighCVSS 8.8Proof of conceptEPSS 0%
- Race condition
microsoft · windows 10 1607Jul 14, 2026
CVE-2026-50402
31Monitor
NTFS Elevation of Privilege Vulnerability
HighCVSS 7.8Proof of conceptEPSS 0%
- Local privilege escalation
microsoft · windows 10 1607Jul 14, 2026
CVE-2026-50416
13Monitor
Win32k Information Disclosure Vulnerability
LowCVSS 3.3Proof of conceptEPSS 0%
- Info leak
microsoft · windows 11 24h2Jul 14, 2026
CVE-2026-50444
35Monitor
Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Auth bypass
microsoft · windows 10 1607Jul 14, 2026
CVE-2026-50657
22Monitor
Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability
MediumCVSS 5.5Proof of conceptEPSS 0%
- Info leak
microsoft · defender for endpointJul 14, 2026
CVE-2026-54121
35Monitor
Active Directory Certificate Services Elevation of Privilege Vulnerability
HighCVSS 8.8Proof of conceptEPSS 0%
- Broken access control (IDOR)
microsoft · windows 10 1607Jul 14, 2026
CVE-2026-55040
87Now
Microsoft SharePoint Server Security Feature Bypass Vulnerability
CriticalCVSS 9.1KEVWeaponizedEPSS 69%
- Pre-auth
- Auth bypass
microsoft · sharepoint serverJul 14, 2026
CVE-2026-10672
36Monitor
Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)
CriticalCVSS 9.1Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
zephyrproject · zephyrJul 14, 2026
CVE-2026-47301
35Monitor
Configuration Manager Elevation of Privilege Vulnerability
HighCVSS 8.8Proof of conceptEPSS 0%
- Broken access control (IDOR)
microsoft · configuration manager 2503Jul 14, 2026
CVE-2026-13001
40Plan
Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter
CriticalCVSS 9.8Proof of conceptEPSS 3%
- pre-auth RCE
- File upload
eteubert · podlove podcast publisherJul 14, 2026
CVE-2026-15409
72This week
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface.
CriticalCVSS 10.0KEVWeaponizedEPSS 6%
- Pre-auth
- SSRF
sonicwall · sma6210 firmwareJul 14, 2026
CVE-2026-15410
62This week
Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Man
HighCVSS 7.2KEVWeaponizedEPSS 11%
- RCE
sonicwall · sma6210 firmwareJul 14, 2026
CVE-2026-45071
34Monitor
Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
- XXE
sensiolabs · symfonyJul 14, 2026
CVE-2026-47423
32Monitor
DOMPurify XSS via `selectedcontent` re-clone
HighCVSS 8.2Proof of conceptEPSS 0%
- Pre-auth
- XSS
cure53 · dompurifyJul 14, 2026
CVE-2026-47429
23Monitor
Vitest: Arbitrary file can be read and executed when Vitest UI server is listening
MediumCVSS 5.9Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
vitest.dev · vitestJul 14, 2026
CVE-2026-48356
37Monitor
Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
CriticalCVSS 9.3Proof of conceptEPSS 1%
- pre-auth RCE
- File upload
adobe · commerceJul 14, 2026
CVE-2026-52100
30Monitor
Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to execute arbitrary cod
HighCVSS 7.5Proof of conceptEPSS 0%
- pre-auth RCE
- CSRF
Jul 14, 2026
CVE-2026-13585
32Monitor
Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Cont
HighCVSS 8.2Proof of conceptEPSS 0%
asus · system control interface v3Jul 14, 2026
CVE-2026-15583
34Monitor
SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header
HighCVSS 8.6Proof of conceptEPSS 0%
- Pre-auth
- SSRF
grafana · grafana mcp serverJul 15, 2026
CVE-2026-57821
32Monitor
Apache Fineract: Office list: SQL Injection via Subquery in orderBy
HighCVSS 8.1Proof of conceptEPSS 0%
- SQL injection
apache · fineractJul 15, 2026
CVE-2026-61430
33Monitor
PraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawl
HighCVSS 8.4No exploitEPSS 0%
- SSRF
mervinpraison · praisonaiJul 15, 2026