Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: July 2026

836 records · 21 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 3 of 9

  • CVE-2026-47429
    23Monitor

    Vitest: Arbitrary file can be read and executed when Vitest UI server is listening

    MediumCVSS 5.9Proof of conceptEPSS 0%

    vitest.dev · vitestJul 14, 2026

  • CVE-2026-13585
    32Monitor

    Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Cont

    HighCVSS 8.2Proof of conceptEPSS 0%

    asus · system control interface v3Jul 14, 2026

  • CVE-2026-15583
    34Monitor

    SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header

    HighCVSS 8.6Proof of conceptEPSS 0%

    grafana · grafana mcp serverJul 15, 2026

  • CVE-2026-57821
    32Monitor

    Apache Fineract: Office list: SQL Injection via Subquery in orderBy

    HighCVSS 8.1Proof of conceptEPSS 0%

    apache · fineractJul 15, 2026

  • CVE-2026-42533
    36Monitor

    NGINX Map directive and Regex matching vulnerability

    CriticalCVSS 9.2Proof of conceptEPSS 0%

    f5 · nginx gateway fabricJul 15, 2026

  • CVE-2026-56434
    33Monitor

    NGINX ngx_http_ssi_module vulnerability

    HighCVSS 8.3No exploitEPSS 0%

    f5 · nginx gateway fabricJul 15, 2026

  • CVE-2026-45805
    35Monitor

    Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

    HighCVSS 8.8Proof of conceptEPSS 0%

    penpot · penpotJul 15, 2026

  • CVE-2026-45806
    30Monitor

    Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-url

    HighCVSS 7.7Proof of conceptEPSS 0%

    penpot · penpotJul 15, 2026

  • CVE-2026-61430
    33Monitor

    PraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawl

    HighCVSS 8.4No exploitEPSS 0%

    mervinpraison · praisonaiJul 15, 2026

  • CVE-2026-43637
    35Monitor

    Cornac < 2.6.0 Path Traversal via _extract_archive() in download.py

    HighCVSS 8.8Proof of conceptEPSS 0%

    preferredai · cornacJul 15, 2026

  • CVE-2026-61736
    37Monitor

    LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests

    CriticalCVSS 9.3Proof of conceptEPSS 1%

    hkuds · lightragJul 15, 2026

  • CVE-2026-52887
    40Plan

    NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE

    CriticalCVSS 10.0Proof of conceptEPSS 0%

    nocobase · nocobaseJul 15, 2026

  • CVE-2026-14960
    39Monitor

    Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface.

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    pegatron corp. · tdelo64.sysJul 15, 2026

  • CVE-2026-26718
    36Monitor

    A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform una

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    Jul 15, 2026

  • CVE-2026-26719
    24Monitor

    Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET reques

    MediumCVSS 6.1Proof of conceptEPSS 0%

    Jul 15, 2026

  • CVE-2026-30623
    40Plan

    LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality.

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    Jul 15, 2026

  • CVE-2026-46339
    41Plan

    9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes

    CriticalCVSS 10.0Proof of conceptEPSS 2%

    decolua · 9routerJul 15, 2026

  • CVE-2026-49352
    39Monitor

    9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    decolua · 9routerJul 15, 2026

  • CVE-2026-36590
    30Monitor

    An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c compon

    HighCVSS 7.5Proof of conceptEPSS 0%

    emqx · nanomqJul 15, 2026

  • CVE-2026-15013
    40Plan

    SAML Single Sign On <= 5.4.3 - Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    cyberlord92 · saml single sign on – sso loginJul 16, 2026

  • CVE-2026-12684
    26Monitor

    Customer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_media

    MediumCVSS 6.5Proof of conceptEPSS 0%

    unknown · customer reviews for woocommerceJul 16, 2026

  • CVE-2026-15925
    36Monitor

    Improper TLS Hostname Verification in Snowflake Connector for Python

    CriticalCVSS 9.2No exploitEPSS 0%

    snowflake · snowflake connector for pythonJul 16, 2026

  • CVE-2026-45695
    39Monitor

    Kopia: Unauthenticated RCE via SSH ProxyCommand Injection when --insecure --without-password is used

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    kopia · kopiaJul 16, 2026

  • CVE-2026-44595
    17Monitor

    Yamcs: Unauthorized user enumeration via IAM API endpoints

    MediumCVSS 4.3Proof of conceptEPSS 1%

    spaceapplications · yamcsJul 16, 2026

  • CVE-2026-44596
    40Plan

    Yamcs: No Rate Limiting on Authentication Endpoint

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    spaceapplications · yamcsJul 16, 2026

  • CVE-2021-27137
    63This week

    An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724.

    HighCVSS 8.1KEVWeaponizedEPSS 3%

    dd-wrt · dd-wrtJul 16, 2026

  • CVE-2026-47729
    26Monitor

    Squid: Memory disclosure in FTP gateway

    MediumCVSS 6.5Proof of conceptEPSS 1%

    squid-cache · squidJul 16, 2026

  • CVE-2026-36425
    26Monitor

    An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031.

    MediumCVSS 6.5Proof of conceptEPSS 0%

    Jul 16, 2026

  • CVE-2026-44177
    36Monitor

    Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup

    HighCVSS 8.8Proof of conceptEPSS 1%

    getkirby · kirbyJul 16, 2026

  • CVE-2026-15094
    24Monitor

    WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter

    MediumCVSS 6.1Proof of conceptEPSS 0%

    thimpress · wp hotel bookingJul 17, 2026

  • CVE-2026-62201
    19Monitor

    OpenClaw < 2026.6.6 Network Policy Bypass via exec-server

    MediumCVSS 4.9Proof of conceptEPSS 0%

    openclaw · openclawJul 17, 2026

  • CVE-2026-62216
    9Monitor

    OpenClaw 2026.4.20 < 2026.5.28 Policy Bypass via Media Upload

    LowCVSS 2.3No exploitEPSS 0%

    openclaw · openclawJul 17, 2026

  • CVE-2026-62227
    19Monitor

    OpenClaw 2026.4.14 < 2026.5.26 SSRF via Browser Snapshot

    MediumCVSS 4.9No exploitEPSS 0%

    openclaw · openclawJul 17, 2026

  • CVE-2026-62229
    30Monitor

    OpenClaw < 2026.5.18 Authorization Bypass via Glob Matching

    HighCVSS 7.7No exploitEPSS 0%

    openclaw · openclawJul 17, 2026

  • CVE-2026-10525
    24Monitor

    NEX-Forms < 9.2.3 - Unauthenticated Stored XSS via Form Submission

    MediumCVSS 6.1Proof of conceptEPSS 0%

    unknown · nex-formsJul 17, 2026

  • CVE-2026-11961
    32Monitor

    User Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound members_data Membership ID

    HighCVSS 8.1Proof of conceptEPSS 0%

    unknown · user registration & membershipJul 17, 2026

  • CVE-2026-14871
    28Monitor

    osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure

    HighCVSS 7.1Proof of conceptEPSS 0%

    osticket · osticketJul 17, 2026

  • CVE-2025-60357
    32Monitor

    AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentEvent/list endpoint.

    HighCVSS 8.1Proof of conceptEPSS 0%

    ahnlab · epp managementJul 17, 2026

  • CVE-2026-51833
    30Monitor

    Xenforo 2.3.8 is vulnerable to SSRF.

    HighCVSS 7.5Proof of conceptEPSS 0%

    Jul 17, 2026

  • CVE-2026-9586
    73This week

    Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB

    CriticalCVSS 9.3KEVWeaponizedEPSS 18%

    sangoma · switchvoxJul 17, 2026

  • CVE-2026-9198
    78This week

    Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

    CriticalCVSS 9.8KEVWeaponizedEPSS 28%

    langflow · langflowJul 17, 2026

  • CVE-2026-9103
    40Plan

    Unauthenticated Superuser Token Issuance via Auto-Login Endpoint

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    langflow · langflowJul 17, 2026

  • CVE-2026-36669
    39Monitor

    An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11.13.11 allows remote attackers to upload

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    Jul 17, 2026

  • CVE-2026-46420
    40Plan

    setup-php: Command Injection in Repository-Derived PHP Version Resolution

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    shivammathur · setup phpJul 17, 2026

  • CVE-2026-52199
    36Monitor

    An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    Jul 17, 2026

  • CVE-2026-60137
    60This week

    WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

    MediumCVSS 5.9KEVWeaponizedEPSS 5%

    wordpress · wordpressJul 17, 2026

  • CVE-2026-63030
    72This week

    WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

    CriticalCVSS 9.8KEVWeaponizedEPSS 10%

    wordpress · wordpressJul 17, 2026

  • CVE-2026-9147
    34Monitor

    uproot 5.7.4 and prior Code Injection via TStreamerInfo Metadata

    HighCVSS 8.5Proof of conceptEPSS 0%

    scikit-hep · uprootJul 18, 2026

  • CVE-2026-16219
    8Monitor

    Croogo CMS Admin File Manager FileManager.php isEditable path traversal

    LowCVSS 2.1Proof of conceptEPSS 0%

    croogo · cmsJul 19, 2026

  • CVE-2026-63828
    33Monitor

    apparmor: mediate the implicit connect of TCP fast open sendmsg

    HighCVSS 8.4Proof of conceptEPSS 0%

    linux · linuxJul 19, 2026

  • CVE-2026-11349
    34Monitor

    Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more

    HighCVSS 8.6Proof of conceptEPSS 0%

    unknown · modern event calendar proJul 20, 2026

  • CVE-2026-12898
    26Monitor

    All-in-One WP Migration and Backup < 7.106 - Unauthenticated Arbitrary-Location Log File Write via Path Traversal

    MediumCVSS 6.5Proof of conceptEPSS 1%

    unknown · all-in-one wp migration and backupJul 20, 2026

  • CVE-2026-13147
    36Monitor

    Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis

    CriticalCVSS 9.1Proof of conceptEPSS 1%

    unknown · kirkiJul 20, 2026

  • CVE-2026-13156
    21Monitor

    MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF

    MediumCVSS 5.4Proof of conceptEPSS 0%

    unknown · mailersendJul 20, 2026

  • CVE-2026-9833
    28Monitor

    Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Parameter

    HighCVSS 7.1Proof of conceptEPSS 0%

    unknown · tag groups is the advanced way to display your taxonomy termsJul 20, 2026

  • CVE-2026-63090
    34Monitor

    ProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet Reassembly

    HighCVSS 8.7No exploitEPSS 0%

    proftpd · proftpdJul 20, 2026

  • CVE-2026-12080
    29Monitor

    Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys

    HighCVSS 7.3Proof of conceptEPSS 0%

    red hat · red hat enterprise linux 10Jul 20, 2026

  • CVE-2026-62183
    39Monitor

    Apache Syncope: User self-service privilege escalation

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    apache · syncopeJul 20, 2026

  • CVE-2026-63071
    39Monitor

    Apache Syncope: RCE via Groovy Sandbox bypass

    CriticalCVSS 9.8No exploitEPSS 0%

    apache · syncopeJul 20, 2026

  • CVE-2026-51031
    30Monitor

    FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint.

    HighCVSS 7.5Proof of conceptEPSS 0%

    Jul 20, 2026

  • CVE-2026-61424
    40Plan

    Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2

    CriticalCVSS 10.0Proof of conceptEPSS 0%

    dj-extensions.com · dj-classifieds extension for joomlaJul 20, 2026

  • CVE-2026-63766
    38Monitor

    GPT-SoVITS 20250606v2pro OS Command Injection via webui.py

    CriticalCVSS 9.3Proof of conceptEPSS 2%

    rvc-boss · gpt-sovitsJul 20, 2026

  • CVE-2026-53595
    38Monitor

    FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL

    CriticalCVSS 9.4Proof of conceptEPSS 1%

    freescout-help-desk · freescoutJul 20, 2026

  • CVE-2026-51385
    27Monitor

    An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code via the validate_url,

    MediumCVSS 6.9Proof of conceptEPSS 0%

    Jul 20, 2026

  • CVE-2026-52656
    39Monitor

    An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute a

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    Jul 20, 2026

  • CVE-2026-16445
    31Monitor

    Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module

    HighCVSS 7.5No exploitEPSS 3%

    red hat · red hat enterprise linux 8Jul 21, 2026

  • CVE-2026-8933
    31Monitor

    snap-confine Local Privilege Escalation via Capabilities Misconfiguration or Flaw in Execution Environment Setup

    HighCVSS 7.8Proof of conceptEPSS 0%

    canonical · ubuntu 26.04 ltsJul 21, 2026

  • CVE-2026-65008
    38Monitor

    Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData

    CriticalCVSS 9.3Proof of conceptEPSS 2%

    getgrav · gravJul 21, 2026

  • CVE-2025-66390
    39Monitor

    In Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password Basic Authentication) is enabled in Tenant

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    Jul 21, 2026

  • CVE-2026-64824
    37Monitor

    Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    home-assistant · home assistant coreJul 21, 2026

  • CVE-2026-63358
    33Monitor

    FileGator privilege escalation

    HighCVSS 8.4Proof of conceptEPSS 0%

    filegator · filegatorJul 21, 2026

  • CVE-2026-15789
    27Monitor

    Malicious client can bypass destination directory validation on local sources upload

    MediumCVSS 6.9No exploitEPSS 0%

    mobyproject · buildkitJul 21, 2026

  • CVE-2026-62574
    31Monitor

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install

    HighCVSS 7.8No exploitEPSS 0%

    oracle · jreJul 21, 2026

  • CVE-2026-56819
    30Monitor

    Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)

    HighCVSS 7.5Proof of conceptEPSS 0%

    netty · nettyJul 21, 2026

  • CVE-2026-56852
    30Monitor

    Infinite loop on invalid input in golang.org/x/text

    HighCVSS 7.5Proof of conceptEPSS 0%

    golang.org/x/text · golang.org/x/text/unicode/normJul 21, 2026

  • CVE-2026-60206
    39Monitor

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

    CriticalCVSS 9.9Proof of conceptEPSS 0%

    oracle · weblogic serverJul 21, 2026

  • CVE-2026-60217
    40Plan

    Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).

    CriticalCVSS 10.0No exploitEPSS 0%

    oracle · coherenceJul 21, 2026

  • CVE-2026-60357
    14Monitor

    Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Siebel Server Sync for Exchange).

    LowCVSS 3.7No exploitEPSS 0%

    oracle · siebel crmJul 21, 2026

  • CVE-2026-2406
    26Monitor

    IDOR in Universe Software's Online Registration and Workflow Management System

    MediumCVSS 6.5Proof of conceptEPSS 0%

    universe software computer marketing trade and industry inc. · online registration and workflow management systemJul 22, 2026

  • CVE-2026-65591
    35Monitor

    n8n before 1.123.64 Sanitizer Bypass Remote Code Execution

    HighCVSS 8.9Proof of conceptEPSS 0%

    n8n · n8nJul 22, 2026

  • CVE-2026-65650
    17Monitor

    Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.

    MediumCVSS 4.3Proof of conceptEPSS 0%

    elgg · elggJul 22, 2026

  • CVE-2026-13181
    32Monitor

    RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX

    HighCVSS 8.1Proof of conceptEPSS 0%

    progress · telerik ui for asp.net ajaxJul 22, 2026

  • CVE-2026-16232
    68This week

    Authentication Bypass in the SmartConsole Login Process Using an Application Token

    CriticalCVSS 9.3KEVWeaponizedEPSS 3%

    checkpoint · multi-domain security managementJul 22, 2026

  • CVE-2026-2395
    39Monitor

    SQLi in Xpoda Türkiye Informatics Technology's No Code Platform

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    xpoda türkiye informatics technology inc. · no code platformJul 22, 2026

  • CVE-2026-65013
    34Monitor

    Onlook tRPC Insecure Direct Object Reference via multiple procedures

    HighCVSS 8.7Proof of conceptEPSS 0%

    onlook · repoJul 22, 2026

  • CVE-2026-38763
    22Monitor

    An issue in Unistal Systems Pvt.

    MediumCVSS 5.5Proof of conceptEPSS 0%

    Jul 22, 2026

  • CVE-2026-38765
    31Monitor

    An issue in Unistal Systems Pvt.

    HighCVSS 7.8Proof of conceptEPSS 0%

    Jul 22, 2026

  • CVE-2026-38766
    31Monitor

    An issue in Unistal Systems Pvt.

    HighCVSS 7.8Proof of conceptEPSS 0%

    Jul 22, 2026

  • CVE-2026-13078
    25Monitor

    Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader

    MediumCVSS 6.3Proof of conceptEPSS 0%

    mongodb · mongodbJul 22, 2026

  • CVE-2026-14282
    39Monitor

    GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    rtcamp · godam – organize wordpress media library & file manager with unlimited folders for images, videos & moreJul 23, 2026

  • CVE-2026-15015
    40Plan

    MountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpoint

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    cascadiawebservices · mountdev ai mcp connector for wordpressJul 23, 2026

  • CVE-2026-64600
    31Monitor

    xfs: resample the data fork mapping after cycling ILOCK

    HighCVSS 7.8Proof of conceptEPSS 0%

    linux · linux kernelJul 23, 2026

  • CVE-2026-16723
    36Monitor

    Remote Code Execution in fastjson 1.2.68–1.2.83

    CriticalCVSS 9.0Proof of conceptEPSS 0%

    alibaba · fastjsonJul 23, 2026

  • CVE-2026-61946
    26Monitor

    WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability

    MediumCVSS 6.5Proof of conceptEPSS 0%

    easy appointments · easy appointmentsJul 23, 2026

  • CVE-2026-65496
    17Monitor

    WordPress Complianz plugin <= 7.5.0 - Server Side Request Forgery (SSRF) vulnerability

    MediumCVSS 4.4No exploitEPSS 0%

    complianz · complianzJul 23, 2026

  • CVE-2026-65510
    28Monitor

    WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    pepro dev. group · peprodev ultimate invoiceJul 23, 2026

  • CVE-2026-65540
    28Monitor

    WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability

    HighCVSS 7.1Proof of conceptEPSS 0%

    metin saraç · popup for cf7 with sweet alertJul 23, 2026

  • CVE-2026-47668
    41Plan

    DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

    CriticalCVSS 10.0Proof of conceptEPSS 3%

    dbgate · dbgateJul 23, 2026

  • CVE-2026-65919
    35Monitor

    Meshery < 1.0.57 Unauthenticated Arbitrary File Read via fileView and fileDownload

    HighCVSS 8.7Proof of conceptEPSS 2%

    meshery · mesheryJul 23, 2026

  • CVE-2026-47670
    38Monitor

    DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection

    CriticalCVSS 9.4Proof of conceptEPSS 1%

    dbgate · dbgateJul 23, 2026