By publication date

Exploited and new serious CVEs: July 2026

941 records · 21 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 4 of 10

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
31Monitor	CVE-2026-38764Proof of concept	An issue in Unistal Systems Pvt.CWE-269 Local privilege escalation	High7.8	—	0.1%	Jul 23, 2026
35Monitor	CVE-2026-65694Proof of concept	Microweber CMS 2.0.20 Path Traversal via ServeStaticFileControllermicroweber · microweber · CWE-22 Pre-auth Path traversal	High8.7	—	3.3%	Jul 23, 2026
40Plan	CVE-2025-71389Proof of concept	Cal.com before 5.9.9 Remote Code Execution via RSCcalcom · cal.diy · CWE-94 pre-auth RCE Auth bypass Deserialization	Critical10.0	—	1.3%	Jul 23, 2026
8Monitor	CVE-2026-16764Proof of concept	OWASP DefectDojo API/Web serializers.py UserSerializer privileges managementowasp · defectdojo · CWE-266	Low2.1	—	0.4%	Jul 23, 2026
32Monitor	CVE-2026-66374Proof of concept	Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path.nic · knot resolver · CWE-1284 pre-auth RCE	High8.1	—	0.6%	Jul 25, 2026
33Monitor	CVE-2026-10818Proof of concept	WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Orderingwpforms · wpforms pro · CWE-434 pre-auth RCE File upload	High8.1	—	2.4%	Jul 25, 2026
31Monitor	CVE-2026-64468Proof of concept	binder: fix UAF in binder_free_transaction()linux · linux	High7.8	—	0.1%	Jul 25, 2026
0Monitor	CVE-2026-64507Proof of concept	x86/bugs: Enable IBPB flush on BPF JIT allocationlinux · linux	—	—	0.2%	Jul 25, 2026
40Plan	CVE-2026-66012Proof of concept	SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCPsiyuan-note · siyuan · CWE-862 Pre-auth Broken access control (IDOR)	Critical10.0	—	0.7%	Jul 25, 2026
30Monitor	CVE-2026-63720Proof of concept	datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Fieldkoxudaxi · datamodel-code-generator · CWE-94 pre-auth RCE	High7.5	—	0.7%	Jul 26, 2026
40Plan	CVE-2026-12394Proof of concept	MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation to Administratorunknown · memberglut · CWE-269 Pre-auth	Critical9.8	—	2.0%	Jul 27, 2026
32Monitor	CVE-2026-13152Proof of concept	Custom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege Escalationunknown · custom fields account registration for woocommerce · CWE-269 Pre-auth	High8.1	—	0.4%	Jul 27, 2026
39Monitor	CVE-2026-13714Proof of concept	Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Executionunknown · realtyna organic idx plugin + wpl real estate · CWE-434 pre-auth RCE File upload Hard-coded credentials	Critical9.8	—	0.8%	Jul 27, 2026
32Monitor	CVE-2026-9830Proof of concept	BookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bugunknown · bookingpress-appointment-booking-pro · CWE-287 Pre-auth Auth bypass	High8.2	—	0.4%	Jul 27, 2026
31Monitor	CVE-2026-64531Proof of concept	net: openvswitch: reject oversized nested action attrslinux · linux · CWE-190 Memory safety	High7.8	—	0.3%	Jul 27, 2026
28Monitor	CVE-2026-65893Proof of concept	Arbitrary Code Execution Vulnerability in CP PLUS EZ-P21 IP Cameracp-plus · ez-p21 ip camera · CWE-489 RCE	High7.0	—	0.2%	Jul 27, 2026
7Monitor	CVE-2026-40000Proof of concept	Path Traversal Vulnerability in ZTE Blade A75 5Gzte · blade a75 5g · CWE-22 Path traversal	Low1.8	—	0.2%	Jul 27, 2026
25Monitor	CVE-2026-14856Proof of concept	Stored Cross-Site Scripting (XSS) in TastyIgniter Media Managermedia manager · tastyigniter · CWE-79 XSS CSRF	Medium6.3	—	0.3%	Jul 27, 2026
39Monitor	CVE-2026-55579Proof of concept	Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromisepheditor · pheditor · CWE-798 pre-auth RCE Hard-coded credentials	Critical9.8	—	0.7%	Jul 27, 2026
39Monitor	CVE-2026-61511Proof of concept	vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.phpvbulletin · vbulletin · CWE-95 pre-auth RCE	Critical9.3	—	5.6%	Jul 27, 2026
37Monitor	CVE-2026-59550Proof of concept	WordPress AWP Classifieds plugin <= 4.4.7 - SQL Injection vulnerabilitystrategy11 team · awp classifieds · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.4%	Jul 27, 2026
36Monitor	CVE-2025-50455Proof of concept	SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1.CWE-89 pre-auth RCE SQL injection	Critical9.1	—	1.1%	Jul 27, 2026
70This week	CVE-2026-16812Weaponized	VeloCloud Orchestrator OS Command Injectionarista · velocloud orchestrator · CWE-78 pre-auth RCE Command injection	Critical10.0	KEV	1.0%	Jul 27, 2026
97Now	CVE-2026-63077Weaponized	In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocoljetbrains · teamcity · CWE-502 pre-auth RCE Deserialization	Critical9.8	KEV	93.5%	Jul 27, 2026
34Monitor	CVE-2026-66729Proof of concept	facil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body Parserboazsegev · facil.io · CWE-125 Pre-auth Memory safety	High8.7	—	0.7%	Jul 27, 2026
34Monitor	CVE-2026-66730Proof of concept	facil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body Parserboazsegev · facil.io · CWE-835 Pre-auth Denial of service	High8.7	—	0.7%	Jul 27, 2026
34Monitor	CVE-2026-66731Proof of concept	facil.io 0.7.5 - 0.7.6 HTTP/1.1 Chunked Transfer Encoding Parser Crash DoSboazsegev · facil.io · CWE-125 Pre-auth Memory safety	High8.7	—	0.7%	Jul 27, 2026
39Monitor	CVE-2026-43805Proof of concept	A race condition was addressed with improved state handling.apple · ipados · CWE-362 Pre-auth Race condition	Critical9.8	—	0.4%	Jul 27, 2026
28Monitor	CVE-2026-43813Proof of concept	A validation issue was addressed with improved input sanitization.apple · ipados · CWE-20	High7.1	—	0.1%	Jul 27, 2026
28Monitor	CVE-2026-64725Proof of concept	An out-of-bounds write issue was addressed with improved bounds checking.apple · ipados · CWE-787 Memory safety	High7.1	—	0.1%	Jul 27, 2026
31Monitor	CVE-2026-64747Proof of concept	A buffer overflow was addressed with improved size validation.apple · ipados · CWE-120 RCE Local privilege escalation Memory safety	High7.8	—	0.1%	Jul 27, 2026
41Plan	CVE-2026-48030Proof of concept	Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)pheditor · pheditor · CWE-78 RCE Command injection	Critical9.9	—	7.5%	Jul 27, 2026
19Monitor	CVE-2026-51564Proof of concept	An issue in the redirect parameter in Milk admin <=0.9.8 allows remote attackers to redirect users to arbitrary external URLs via a crafted CWE-601 Open redirect Denial of service	Medium4.9	—	0.6%	Jul 27, 2026
24Monitor	CVE-2026-51565Proof of concept	Cross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php in Milk admin <=0.9.8 allows remote attackers to inject arbitrarCWE-79 Pre-auth XSS	Medium6.1	—	0.4%	Jul 27, 2026
68This week	CVE-2026-42016Weaponized	Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalationjfrog · artifactory · CWE-863 Broken access control (IDOR)	High8.8	KEV	8.6%	Jul 27, 2026
24Monitor	CVE-2026-64648No exploit	Next.js: Response Body Cache Confusion for Requests Containing Bodiesvercel · next.js · CWE-524 Pre-auth	Medium6.0	—	0.3%	Jul 27, 2026
35Monitor	CVE-2026-65616Proof of concept	Potential privilege escalation to JFrog administrator privilegesjfrog · artifactory · CWE-347 Weak crypto	High8.8	—	0.3%	Jul 27, 2026
35Monitor	CVE-2026-65617No exploit	Potential remote code execution on an Artifactory package service container.jfrog · artifactory · CWE-502 RCE Deserialization	High8.8	—	0.6%	Jul 27, 2026
31Monitor	CVE-2026-28912Proof of concept	A logic issue was addressed with improved restrictions.apple · macos · CWE-693 Local privilege escalation	High7.8	—	0.1%	Jul 27, 2026
31Monitor	CVE-2026-39875Proof of concept	A permissions issue was addressed with additional restrictions.apple · macos · CWE-276 Local privilege escalation	High7.8	—	0.1%	Jul 27, 2026
39Monitor	CVE-2026-43682Proof of concept	The issue was addressed with improved memory handling.apple · macos · CWE-119 Pre-auth Memory safety	Critical9.8	—	0.7%	Jul 27, 2026
28Monitor	CVE-2026-65442Proof of concept	WordPress FormCraft plugin <= 3.9.15 - Server Side Request Forgery (SSRF) vulnerabilitysubtle web inc · formcraft · CWE-918 Pre-auth SSRF	High7.2	—	0.5%	Jul 27, 2026
28Monitor	CVE-2026-14870Proof of concept	Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_idunknown · database for contact form 7, wpforms, elementor forms · CWE-79 Pre-auth XSS	High7.1	—	0.4%	Jul 28, 2026
30Monitor	CVE-2026-12741Proof of concept	WP Fast Total Search <= 1.80.280 - Unauthenticated SQL Injectionepsiloncool · wp fast total search – the power of indexed search · CWE-89 Pre-auth SQL injection	High7.5	—	1.5%	Jul 28, 2026
30Monitor	CVE-2026-12800Proof of concept	Premium Packages <= 6.2.0 - Unauthenticated SQL Injectioncodename065 · premium packages – sell digital products securely · CWE-89 Pre-auth SQL injection	High7.5	—	1.5%	Jul 28, 2026
34Monitor	CVE-2026-59248Proof of concept	Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoSninenines · cowlib · CWE-770 Pre-auth Denial of service	High8.7	—	0.2%	Jul 28, 2026
25Monitor	CVE-2026-66752Proof of concept	tiny-http 0.12.0 HTTP Request Smuggling via Transfer-Encoding Handlingtiny-http · tiny-http · CWE-444 Pre-auth	Medium6.3	—	0.3%	Jul 28, 2026
25Monitor	CVE-2026-66753Proof of concept	tiny-http 0.12.0 HTTP Response Splitting via Header Injectiontiny-http · tiny-http · CWE-113 Pre-auth	Medium6.3	—	0.3%	Jul 28, 2026
31Monitor	CVE-2026-18107Proof of concept	Criu: criu: container escape via rseq critical section hijack during checkpoint/restorered hat · red hat enterprise linux 10 · CWE-269 RCE Local privilege escalation	High7.8	—	0.1%	Jul 28, 2026
21Monitor	CVE-2026-66746Proof of concept	Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injectiontomaka · rouille · CWE-113 Pre-auth	Medium5.3	—	0.3%	Jul 28, 2026
34Monitor	CVE-2026-66748Proof of concept	Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Fieldowen2345 · camaleon-cms · CWE-94 RCE	High8.7	—	1.1%	Jul 28, 2026
28Monitor	CVE-2026-66749Proof of concept	Let's Chat 0.4.0 - 0.4.8 Denial of Service via Null Dereference in Room Lookupsdelements · lets-chat · CWE-476 Memory safety	High7.1	—	0.4%	Jul 28, 2026
21Monitor	CVE-2026-66750Proof of concept	Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files routesdelements · lets-chat · CWE-862 Broken access control (IDOR)	Medium5.3	—	0.3%	Jul 28, 2026
21Monitor	CVE-2026-66751Proof of concept	Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:roomsdelements · lets-chat · CWE-862 Broken access control (IDOR)	Medium5.3	—	0.2%	Jul 28, 2026
32Monitor	CVE-2026-66754Proof of concept	Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encodingtomaka · rouille · CWE-617 Pre-auth	High8.2	—	0.5%	Jul 28, 2026
25Monitor	CVE-2026-67181Proof of concept	Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding Headertomaka · rouille · CWE-444 Pre-auth	Medium6.3	—	0.4%	Jul 28, 2026
27Monitor	CVE-2026-67182Proof of concept	Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Header Injectiontomaka · rouille · CWE-444 Pre-auth	Medium6.9	—	0.6%	Jul 28, 2026
34Monitor	CVE-2026-67183Proof of concept	TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handlinggeneralsandman · tinyweb · CWE-401 Pre-auth Denial of service	High8.7	—	0.5%	Jul 28, 2026
34Monitor	CVE-2026-67184Proof of concept	TinyWeb 0.0.8 Null Pointer Dereference DoS via Malformed HTTP Requestgeneralsandman · tinyweb · CWE-476 Pre-auth Memory safety	High8.7	—	0.6%	Jul 28, 2026
34Monitor	CVE-2026-67185Proof of concept	TinyWeb 0.0.8 Path Traversal via URL Path Componentgeneralsandman · tinyweb · CWE-22 Pre-auth Path traversal	High8.7	—	0.5%	Jul 28, 2026
25Monitor	CVE-2026-59941Proof of concept	Dompdf: Uncontrolled resource consumption based on declared BMP dimensionsdompdf project · dompdf · CWE-400 Pre-auth Denial of service	Medium6.3	—	0.6%	Jul 28, 2026
32Monitor	CVE-2026-48060Proof of concept	Litestar: HTML Injection Through CSRF Tokenlitestar-org · litestar · CWE-79 Pre-auth XSS CSRF	High8.1	—	0.3%	Jul 28, 2026
28Monitor	CVE-2026-12476No exploit	Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parametersmub · easy digital downloads – ecommerce payments and subscriptions made easy · CWE-434 RCE File upload	High7.2	—	1.1%	Jul 29, 2026
40Plan	CVE-2026-18072Proof of concept	Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wploginnico23 · advanced responsive video embedder for rumble, odysee, youtube, vimeo, kick … · CWE-506 Pre-auth Auth bypass	Critical9.8	—	2.9%	Jul 29, 2026
34Monitor	CVE-2026-11974No exploit	Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Downloadunknown · wp-media-folder-addon · CWE-22 Pre-auth SSRF Path traversal	High8.6	—	0.7%	Jul 29, 2026
39Monitor	CVE-2026-13423No exploit	Streamit <= 4.5.0 - Unauthenticated Remote Code Execution via Arbitrary Function Callunknown · streamit · CWE-94 pre-auth RCE	Critical9.8	—	0.9%	Jul 29, 2026
29Monitor	CVE-2026-13690No exploit	UsersWP < 1.2.67 - Two-Factor Authentication Bypassunknown · userswp · CWE-287 Pre-auth Auth bypass	High7.4	—	0.4%	Jul 29, 2026
28Monitor	CVE-2026-14234No exploit	WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRFunknown · wolf · CWE-79 Pre-auth XSS CSRF	High7.1	—	0.1%	Jul 29, 2026
32Monitor	CVE-2026-14300No exploit	miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeoverunknown · miniorange social login and register (discord, google, twitter, linkedin) · CWE-287 Pre-auth Auth bypass	High8.1	—	0.3%	Jul 29, 2026
39Monitor	CVE-2026-63227No exploit	Unrestricted SCORM file upload vulnerabilityan unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execu · koollab lms · CWE-434 RCE File upload	Critical9.9	—	0.5%	Jul 29, 2026
28Monitor	CVE-2026-13425No exploit	Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Valuescode4life · database for cf7 · CWE-79 Pre-auth XSS	High7.2	—	0.4%	Jul 29, 2026
36Monitor	CVE-2026-63229No exploit	Pre-authentication blind SQL injection vulnerabilitythree learning · koollab lms · CWE-89 Pre-auth SQL injection	Critical9.1	—	0.5%	Jul 29, 2026
36Monitor	CVE-2026-63230No exploit	Pre-authentication error-based SQL injection vulnerabilitythree learning · koollab lms · CWE-89 Pre-auth SQL injection	Critical9.1	—	0.5%	Jul 29, 2026
32Monitor	CVE-2026-63231No exploit	Post-authentication SQL injection vulnerabilitythree learning · koollab lms · CWE-89 SQL injection	High8.1	—	0.4%	Jul 29, 2026
39Monitor	CVE-2026-63232No exploit	SQL injection and unsafe deserialisation vulnerabilitythree learning · koollab lms · CWE-89 RCE SQL injection	Critical9.9	—	0.5%	Jul 29, 2026
39Monitor	CVE-2026-63233No exploit	SQL injection and unsafe deserialisation vulnerabilitythree learning · koollab lms · CWE-89 RCE SQL injection	Critical9.9	—	0.5%	Jul 29, 2026
39Monitor	CVE-2026-63234No exploit	SQL injection and unsafe deserialisation vulnerabilitythree learning · koollab lms · CWE-89 RCE SQL injection	Critical9.9	—	0.5%	Jul 29, 2026
39Monitor	CVE-2026-14900No exploit	Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameterstylemixthemes · cost calculator builder pro · CWE-94 pre-auth RCE	Critical9.8	—	1.2%	Jul 29, 2026
28Monitor	CVE-2026-16597No exploit	GTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fieldsduracelltomi · gtm4wp – a google tag manager (gtm) plugin for wordpress · CWE-79 Pre-auth XSS	High7.2	—	0.4%	Jul 29, 2026
28Monitor	CVE-2026-16655No exploit	Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Memberwpmanageninja · fluent forms – customizable contact forms, survey, quiz, & conversational form builder · CWE-79 Pre-auth XSS	High7.2	—	0.5%	Jul 29, 2026
31Monitor	CVE-2026-18220Proof of concept	Binutils: binutils: out-of-bounds write in bfd dlx elf backend relocation processingred hat · red hat enterprise linux 10 · CWE-787 Memory safety	High7.8	—	0.1%	Jul 29, 2026
37Monitor	CVE-2026-18191No exploit	Vacron｜IP Camera - Hidden Functionalityvacron · vin-ds783e-e6 · CWE-912 Pre-auth	Critical9.3	—	0.6%	Jul 29, 2026
28Monitor	CVE-2026-18192No exploit	Vacron｜IP Camera - Arbitrary File Readvacron · vin-ds783e-e6 · CWE-23 Path traversal	High7.1	—	0.5%	Jul 29, 2026
30Monitor	CVE-2026-33267Proof of concept	Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadataapache · traffic server · CWE-20 Pre-auth	High7.7	—	0.6%	Jul 29, 2026
32Monitor	CVE-2026-33930No exploit	Apache Traffic Server: Buffer overflow via Host field that has a long string valueapache · traffic server · CWE-121 Pre-auth Memory safety	High8.2	—	0.5%	Jul 29, 2026
28Monitor	CVE-2026-35226No exploit	Out-of-bounds Write in CODESYS PROFINET Controllercodesys · codesys profinet · CWE-787 Pre-auth Memory safety	High7.1	—	0.2%	Jul 29, 2026
28Monitor	CVE-2026-41920No exploit	Apache Traffic Server: SNI to Host header matching policy is not properly enforcedapache · traffic server · CWE-284 Pre-auth Broken access control (IDOR)	High7.0	—	0.5%	Jul 29, 2026
28Monitor	CVE-2026-57834No exploit	Apache Traffic Server: Malformed chunked message body allows request smugglingapache · traffic server · CWE-444 Pre-auth	High7.0	—	0.6%	Jul 29, 2026
31Monitor	CVE-2026-58150No exploit	Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smugglingapache · traffic server · CWE-444 Pre-auth	High7.8	—	0.5%	Jul 29, 2026
34Monitor	CVE-2026-58151No exploit	Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the serverapache · traffic server · CWE-400 Pre-auth Denial of service	High8.7	—	0.6%	Jul 29, 2026
36Monitor	CVE-2026-58154No exploit	Apache Traffic Server: Memory-safety errors in MIME and header parsingapache · traffic server · CWE-787 Pre-auth Memory safety	Critical9.2	—	0.5%	Jul 29, 2026
36Monitor	CVE-2026-58155No exploit	Apache Traffic Server: Header-name length truncation enables header aliasing and request smugglingapache · traffic server · CWE-444 Pre-auth	Critical9.2	—	0.5%	Jul 29, 2026
31Monitor	CVE-2026-64556No exploit	perf/core: Detach event groups during remove_on_execlinux · linux · CWE-662	High7.8	—	0.1%	Jul 29, 2026
35Monitor	CVE-2026-64557No exploit	Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()linux · linux · CWE-416 Pre-auth Memory safety	High8.8	—	0.2%	Jul 29, 2026
32Monitor	CVE-2026-65324No exploit	Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustionapache · traffic server · CWE-400 Pre-auth Denial of service	High8.2	—	0.6%	Jul 29, 2026
37Monitor	CVE-2026-0667No exploit	CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service andschneider electric · scadapack 47x · CWE-754 pre-auth RCE	Critical9.3	—	0.5%	Jul 29, 2026
34Monitor	CVE-2026-44944No exploit	iscsiuio control-socket authentication bypass in open-iscsiopen-iscsi · open-iscsi · CWE-863 Auth bypass Broken access control (IDOR)	High8.5	—	0.0%	Jul 29, 2026
39Monitor	CVE-2025-10656No exploit	Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account holest · spreadsheet price changer for woocommerce and wp e-commerce – light · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.5%	Jul 29, 2026
34Monitor	CVE-2026-55995No exploit	Double-free in the iSNS attribute decoder in open-iscsiopen-iscsi · open-iscsi · CWE-415 Pre-auth Memory safety	High8.7	—	0.2%	Jul 29, 2026
29Monitor	CVE-2026-23904No exploit	Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxyapache · kyuubi · CWE-923 Pre-auth SSRF	High7.3	—	0.8%	Jul 29, 2026

CVE-2026-38764
31Monitor
An issue in Unistal Systems Pvt.
HighCVSS 7.8Proof of conceptEPSS 0%
- Local privilege escalation
Jul 23, 2026
CVE-2026-65694
35Monitor
Microweber CMS 2.0.20 Path Traversal via ServeStaticFileController
HighCVSS 8.7Proof of conceptEPSS 3%
- Pre-auth
- Path traversal
microweber · microweberJul 23, 2026
CVE-2025-71389
40Plan
Cal.com before 5.9.9 Remote Code Execution via RSC
CriticalCVSS 10.0Proof of conceptEPSS 1%
- pre-auth RCE
- Auth bypass
- Deserialization
calcom · cal.diyJul 23, 2026
CVE-2026-16764
8Monitor
OWASP DefectDojo API/Web serializers.py UserSerializer privileges management
LowCVSS 2.1Proof of conceptEPSS 0%
owasp · defectdojoJul 23, 2026
CVE-2026-66374
32Monitor
Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path.
HighCVSS 8.1Proof of conceptEPSS 0%
- pre-auth RCE
nic · knot resolverJul 25, 2026
CVE-2026-10818
33Monitor
WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering
HighCVSS 8.1Proof of conceptEPSS 2%
- pre-auth RCE
- File upload
wpforms · wpforms proJul 25, 2026
CVE-2026-64468
31Monitor
binder: fix UAF in binder_free_transaction()
HighCVSS 7.8Proof of conceptEPSS 0%
linux · linuxJul 25, 2026
CVE-2026-64507
0Monitor
x86/bugs: Enable IBPB flush on BPF JIT allocation
Proof of conceptEPSS 0%
linux · linuxJul 25, 2026
CVE-2026-66012
40Plan
SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP
CriticalCVSS 10.0Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
siyuan-note · siyuanJul 25, 2026
CVE-2026-63720
30Monitor
datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field
HighCVSS 7.5Proof of conceptEPSS 0%
- pre-auth RCE
koxudaxi · datamodel-code-generatorJul 26, 2026
CVE-2026-12394
40Plan
MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation to Administrator
CriticalCVSS 9.8Proof of conceptEPSS 2%
- Pre-auth
unknown · memberglutJul 27, 2026
CVE-2026-13152
32Monitor
Custom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege Escalation
HighCVSS 8.1Proof of conceptEPSS 0%
- Pre-auth
unknown · custom fields account registration for woocommerceJul 27, 2026
CVE-2026-13714
39Monitor
Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
CriticalCVSS 9.8Proof of conceptEPSS 0%
- pre-auth RCE
- File upload
- Hard-coded credentials
unknown · realtyna organic idx plugin + wpl real estateJul 27, 2026
CVE-2026-9830
32Monitor
BookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug
HighCVSS 8.2Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
unknown · bookingpress-appointment-booking-proJul 27, 2026
CVE-2026-64531
31Monitor
net: openvswitch: reject oversized nested action attrs
HighCVSS 7.8Proof of conceptEPSS 0%
- Memory safety
linux · linuxJul 27, 2026
CVE-2026-65893
28Monitor
Arbitrary Code Execution Vulnerability in CP PLUS EZ-P21 IP Camera
HighCVSS 7.0Proof of conceptEPSS 0%
- RCE
cp-plus · ez-p21 ip cameraJul 27, 2026
CVE-2026-40000
7Monitor
Path Traversal Vulnerability in ZTE Blade A75 5G
LowCVSS 1.8Proof of conceptEPSS 0%
- Path traversal
zte · blade a75 5gJul 27, 2026
CVE-2026-14856
25Monitor
Stored Cross-Site Scripting (XSS) in TastyIgniter Media Manager
MediumCVSS 6.3Proof of conceptEPSS 0%
- XSS
- CSRF
media manager · tastyigniterJul 27, 2026
CVE-2026-55579
39Monitor
Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise
CriticalCVSS 9.8Proof of conceptEPSS 0%
- pre-auth RCE
- Hard-coded credentials
pheditor · pheditorJul 27, 2026
CVE-2026-61511
39Monitor
vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php
CriticalCVSS 9.3Proof of conceptEPSS 5%
- pre-auth RCE
vbulletin · vbulletinJul 27, 2026
CVE-2026-59550
37Monitor
WordPress AWP Classifieds plugin <= 4.4.7 - SQL Injection vulnerability
CriticalCVSS 9.3Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
strategy11 team · awp classifiedsJul 27, 2026
CVE-2025-50455
36Monitor
SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1.
CriticalCVSS 9.1Proof of conceptEPSS 1%
- pre-auth RCE
- SQL injection
Jul 27, 2026
CVE-2026-16812
70This week
VeloCloud Orchestrator OS Command Injection
CriticalCVSS 10.0KEVWeaponizedEPSS 1%
- pre-auth RCE
- Command injection
arista · velocloud orchestratorJul 27, 2026
CVE-2026-63077
97Now
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
CriticalCVSS 9.8KEVWeaponizedEPSS 93%
- pre-auth RCE
- Deserialization
jetbrains · teamcityJul 27, 2026
CVE-2026-66729
34Monitor
facil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body Parser
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
boazsegev · facil.ioJul 27, 2026
CVE-2026-66730
34Monitor
facil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body Parser
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
boazsegev · facil.ioJul 27, 2026
CVE-2026-66731
34Monitor
facil.io 0.7.5 - 0.7.6 HTTP/1.1 Chunked Transfer Encoding Parser Crash DoS
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
boazsegev · facil.ioJul 27, 2026
CVE-2026-43805
39Monitor
A race condition was addressed with improved state handling.
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Race condition
apple · ipadosJul 27, 2026
CVE-2026-43813
28Monitor
A validation issue was addressed with improved input sanitization.
HighCVSS 7.1Proof of conceptEPSS 0%
apple · ipadosJul 27, 2026
CVE-2026-64725
28Monitor
An out-of-bounds write issue was addressed with improved bounds checking.
HighCVSS 7.1Proof of conceptEPSS 0%
- Memory safety
apple · ipadosJul 27, 2026
CVE-2026-64747
31Monitor
A buffer overflow was addressed with improved size validation.
HighCVSS 7.8Proof of conceptEPSS 0%
- RCE
- Local privilege escalation
- Memory safety
apple · ipadosJul 27, 2026
CVE-2026-48030
41Plan
Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)
CriticalCVSS 9.9Proof of conceptEPSS 7%
- RCE
- Command injection
pheditor · pheditorJul 27, 2026
CVE-2026-51564
19Monitor
An issue in the redirect parameter in Milk admin <=0.9.8 allows remote attackers to redirect users to arbitrary external URLs via a crafted
MediumCVSS 4.9Proof of conceptEPSS 0%
- Open redirect
- Denial of service
Jul 27, 2026
CVE-2026-51565
24Monitor
Cross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php in Milk admin <=0.9.8 allows remote attackers to inject arbitrar
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
Jul 27, 2026
CVE-2026-42016
68This week
Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation
HighCVSS 8.8KEVWeaponizedEPSS 8%
- Broken access control (IDOR)
jfrog · artifactoryJul 27, 2026
CVE-2026-64648
24Monitor
Next.js: Response Body Cache Confusion for Requests Containing Bodies
MediumCVSS 6.0No exploitEPSS 0%
- Pre-auth
vercel · next.jsJul 27, 2026
CVE-2026-65616
35Monitor
Potential privilege escalation to JFrog administrator privileges
HighCVSS 8.8Proof of conceptEPSS 0%
- Weak crypto
jfrog · artifactoryJul 27, 2026
CVE-2026-65617
35Monitor
Potential remote code execution on an Artifactory package service container.
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Deserialization
jfrog · artifactoryJul 27, 2026
CVE-2026-28912
31Monitor
A logic issue was addressed with improved restrictions.
HighCVSS 7.8Proof of conceptEPSS 0%
- Local privilege escalation
apple · macosJul 27, 2026
CVE-2026-39875
31Monitor
A permissions issue was addressed with additional restrictions.
HighCVSS 7.8Proof of conceptEPSS 0%
- Local privilege escalation
apple · macosJul 27, 2026
CVE-2026-43682
39Monitor
The issue was addressed with improved memory handling.
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
apple · macosJul 27, 2026
CVE-2026-65442
28Monitor
WordPress FormCraft plugin <= 3.9.15 - Server Side Request Forgery (SSRF) vulnerability
HighCVSS 7.2Proof of conceptEPSS 0%
- Pre-auth
- SSRF
subtle web inc · formcraftJul 27, 2026
CVE-2026-14870
28Monitor
Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id
HighCVSS 7.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
unknown · database for contact form 7, wpforms, elementor formsJul 28, 2026
CVE-2026-12741
30Monitor
WP Fast Total Search <= 1.80.280 - Unauthenticated SQL Injection
HighCVSS 7.5Proof of conceptEPSS 1%
- Pre-auth
- SQL injection
epsiloncool · wp fast total search – the power of indexed searchJul 28, 2026
CVE-2026-12800
30Monitor
Premium Packages <= 6.2.0 - Unauthenticated SQL Injection
HighCVSS 7.5Proof of conceptEPSS 1%
- Pre-auth
- SQL injection
codename065 · premium packages – sell digital products securelyJul 28, 2026
CVE-2026-59248
34Monitor
Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
ninenines · cowlibJul 28, 2026
CVE-2026-66752
25Monitor
tiny-http 0.12.0 HTTP Request Smuggling via Transfer-Encoding Handling
MediumCVSS 6.3Proof of conceptEPSS 0%
- Pre-auth
tiny-http · tiny-httpJul 28, 2026
CVE-2026-66753
25Monitor
tiny-http 0.12.0 HTTP Response Splitting via Header Injection
MediumCVSS 6.3Proof of conceptEPSS 0%
- Pre-auth
tiny-http · tiny-httpJul 28, 2026
CVE-2026-18107
31Monitor
Criu: criu: container escape via rseq critical section hijack during checkpoint/restore
HighCVSS 7.8Proof of conceptEPSS 0%
- RCE
- Local privilege escalation
red hat · red hat enterprise linux 10Jul 28, 2026
CVE-2026-66746
21Monitor
Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
tomaka · rouilleJul 28, 2026
CVE-2026-66748
34Monitor
Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field
HighCVSS 8.7Proof of conceptEPSS 1%
- RCE
owen2345 · camaleon-cmsJul 28, 2026
CVE-2026-66749
28Monitor
Let's Chat 0.4.0 - 0.4.8 Denial of Service via Null Dereference in Room Lookup
HighCVSS 7.1Proof of conceptEPSS 0%
- Memory safety
sdelements · lets-chatJul 28, 2026
CVE-2026-66750
21Monitor
Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route
MediumCVSS 5.3Proof of conceptEPSS 0%
- Broken access control (IDOR)
sdelements · lets-chatJul 28, 2026
CVE-2026-66751
21Monitor
Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room
MediumCVSS 5.3Proof of conceptEPSS 0%
- Broken access control (IDOR)
sdelements · lets-chatJul 28, 2026
CVE-2026-66754
32Monitor
Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encoding
HighCVSS 8.2Proof of conceptEPSS 0%
- Pre-auth
tomaka · rouilleJul 28, 2026
CVE-2026-67181
25Monitor
Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding Header
MediumCVSS 6.3Proof of conceptEPSS 0%
- Pre-auth
tomaka · rouilleJul 28, 2026
CVE-2026-67182
27Monitor
Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Header Injection
MediumCVSS 6.9Proof of conceptEPSS 0%
- Pre-auth
tomaka · rouilleJul 28, 2026
CVE-2026-67183
34Monitor
TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
generalsandman · tinywebJul 28, 2026
CVE-2026-67184
34Monitor
TinyWeb 0.0.8 Null Pointer Dereference DoS via Malformed HTTP Request
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
generalsandman · tinywebJul 28, 2026
CVE-2026-67185
34Monitor
TinyWeb 0.0.8 Path Traversal via URL Path Component
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
generalsandman · tinywebJul 28, 2026
CVE-2026-59941
25Monitor
Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
MediumCVSS 6.3Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
dompdf project · dompdfJul 28, 2026
CVE-2026-48060
32Monitor
Litestar: HTML Injection Through CSRF Token
HighCVSS 8.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
- CSRF
litestar-org · litestarJul 28, 2026
CVE-2026-12476
28Monitor
Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter
HighCVSS 7.2No exploitEPSS 1%
- RCE
- File upload
smub · easy digital downloads – ecommerce payments and subscriptions made easyJul 29, 2026
CVE-2026-18072
40Plan
Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin
CriticalCVSS 9.8Proof of conceptEPSS 2%
- Pre-auth
- Auth bypass
nico23 · advanced responsive video embedder for rumble, odysee, youtube, vimeo, kick …Jul 29, 2026
CVE-2026-11974
34Monitor
Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Download
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SSRF
- Path traversal
unknown · wp-media-folder-addonJul 29, 2026
CVE-2026-13423
39Monitor
Streamit <= 4.5.0 - Unauthenticated Remote Code Execution via Arbitrary Function Call
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
unknown · streamitJul 29, 2026
CVE-2026-13690
29Monitor
UsersWP < 1.2.67 - Two-Factor Authentication Bypass
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Auth bypass
unknown · userswpJul 29, 2026
CVE-2026-14234
28Monitor
WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
- CSRF
unknown · wolfJul 29, 2026
CVE-2026-14300
32Monitor
miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
unknown · miniorange social login and register (discord, google, twitter, linkedin)Jul 29, 2026
CVE-2026-63227
39Monitor
Unrestricted SCORM file upload vulnerability
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
- File upload
an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execu · koollab lmsJul 29, 2026
CVE-2026-13425
28Monitor
Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Values
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
code4life · database for cf7Jul 29, 2026
CVE-2026-63229
36Monitor
Pre-authentication blind SQL injection vulnerability
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- SQL injection
three learning · koollab lmsJul 29, 2026
CVE-2026-63230
36Monitor
Pre-authentication error-based SQL injection vulnerability
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- SQL injection
three learning · koollab lmsJul 29, 2026
CVE-2026-63231
32Monitor
Post-authentication SQL injection vulnerability
HighCVSS 8.1No exploitEPSS 0%
- SQL injection
three learning · koollab lmsJul 29, 2026
CVE-2026-63232
39Monitor
SQL injection and unsafe deserialisation vulnerability
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
- SQL injection
three learning · koollab lmsJul 29, 2026
CVE-2026-63233
39Monitor
SQL injection and unsafe deserialisation vulnerability
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
- SQL injection
three learning · koollab lmsJul 29, 2026
CVE-2026-63234
39Monitor
SQL injection and unsafe deserialisation vulnerability
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
- SQL injection
three learning · koollab lmsJul 29, 2026
CVE-2026-14900
39Monitor
Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
stylemixthemes · cost calculator builder proJul 29, 2026
CVE-2026-16597
28Monitor
GTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
duracelltomi · gtm4wp – a google tag manager (gtm) plugin for wordpressJul 29, 2026
CVE-2026-16655
28Monitor
Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
wpmanageninja · fluent forms – customizable contact forms, survey, quiz, & conversational form builderJul 29, 2026
CVE-2026-18220
31Monitor
Binutils: binutils: out-of-bounds write in bfd dlx elf backend relocation processing
HighCVSS 7.8Proof of conceptEPSS 0%
- Memory safety
red hat · red hat enterprise linux 10Jul 29, 2026
CVE-2026-18191
37Monitor
Vacron｜IP Camera - Hidden Functionality
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
vacron · vin-ds783e-e6Jul 29, 2026
CVE-2026-18192
28Monitor
Vacron｜IP Camera - Arbitrary File Read
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
vacron · vin-ds783e-e6Jul 29, 2026
CVE-2026-33267
30Monitor
Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata
HighCVSS 7.7Proof of conceptEPSS 0%
- Pre-auth
apache · traffic serverJul 29, 2026
CVE-2026-33930
32Monitor
Apache Traffic Server: Buffer overflow via Host field that has a long string value
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Memory safety
apache · traffic serverJul 29, 2026
CVE-2026-35226
28Monitor
Out-of-bounds Write in CODESYS PROFINET Controller
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
codesys · codesys profinetJul 29, 2026
CVE-2026-41920
28Monitor
Apache Traffic Server: SNI to Host header matching policy is not properly enforced
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
apache · traffic serverJul 29, 2026
CVE-2026-57834
28Monitor
Apache Traffic Server: Malformed chunked message body allows request smuggling
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
apache · traffic serverJul 29, 2026
CVE-2026-58150
31Monitor
Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling
HighCVSS 7.8No exploitEPSS 0%
- Pre-auth
apache · traffic serverJul 29, 2026
CVE-2026-58151
34Monitor
Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · traffic serverJul 29, 2026
CVE-2026-58154
36Monitor
Apache Traffic Server: Memory-safety errors in MIME and header parsing
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Memory safety
apache · traffic serverJul 29, 2026
CVE-2026-58155
36Monitor
Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
apache · traffic serverJul 29, 2026
CVE-2026-64556
31Monitor
perf/core: Detach event groups during remove_on_exec
HighCVSS 7.8No exploitEPSS 0%
linux · linuxJul 29, 2026
CVE-2026-64557
35Monitor
Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
linux · linuxJul 29, 2026
CVE-2026-65324
32Monitor
Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · traffic serverJul 29, 2026
CVE-2026-0667
37Monitor
CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
schneider electric · scadapack 47xJul 29, 2026
CVE-2026-44944
34Monitor
iscsiuio control-socket authentication bypass in open-iscsi
HighCVSS 8.5No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
open-iscsi · open-iscsiJul 29, 2026
CVE-2025-10656
39Monitor
Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
holest · spreadsheet price changer for woocommerce and wp e-commerce – lightJul 29, 2026
CVE-2026-55995
34Monitor
Double-free in the iSNS attribute decoder in open-iscsi
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
open-iscsi · open-iscsiJul 29, 2026
CVE-2026-23904
29Monitor
Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
- SSRF
apache · kyuubiJul 29, 2026