По дате публикации
Эксплуатируемые и новые серьёзные CVE: июль 2026 г.
1 764 записей · 21 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 1 из 18
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
31Наблюдать | CVE-2026-14191Proof of concept | WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeaderrarlab · winrar · CWE-129 | Высокая7,8 | — | 0,4 % | 1 июл. 2026 г. |
28Наблюдать | CVE-2026-13731Proof of concept | WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameterquantumcloud · wpbot – ai chatbot for live support, lead generation, ai services · CWE-79 | Высокая7,2 | — | 0,8 % | 1 июл. 2026 г. |
28Наблюдать | CVE-2026-7829Эксплойта нет | UltraVNC repeater authenticated out-of-bounds write in rule parser via oversized tokenuvnc · ultravnc · CWE-787 | Высокая7,2 | — | 0,8 % | 1 июл. 2026 г. |
35Наблюдать | CVE-2026-7838Эксплойта нет | UltraVNC viewer heap buffer overflow via integer overflow in RFB connection-failure reason lengthuvnc · ultravnc · CWE-190 | Высокая8,7 | — | 1,8 % | 1 июл. 2026 г. |
32Наблюдать | CVE-2026-11794Эксплойта нет | Advanced Form Integration < 2.1.1 - Unauthenticated Privilege Escalation via Breakdance Form Role Mappingunknown · advanced form integration — connect forms to 200+ apps · CWE-269 | Высокая8,1 | — | 0,3 % | 1 июл. 2026 г. |
40В плане | CVE-2026-11387Proof of concept | SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Resetcozyvision1 · sms alert – sms & otp for woocommerce, order notifications & abandoned cart recovery · CWE-287 | Критическая9,8 | — | 2,2 % | 1 июл. 2026 г. |
37Наблюдать | CVE-2026-57517Proof of concept | Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parametercontrol web panel · control web panel · CWE-89 | Критическая9,3 | — | 0,9 % | 1 июл. 2026 г. |
23Наблюдать | CVE-2026-58025Proof of concept | Remote Code Execution via Unsafe Deserialization in LogItem Importmediawiki · mediawiki · CWE-94 | Средняя5,9 | — | 0,5 % | 1 июл. 2026 г. |
1Наблюдать | CVE-2026-8857Proof of concept | Full RCE using EasyTimeline Extensionmediawiki · mediawiki · CWE-94 | —0,0 | — | 2,0 % | 1 июл. 2026 г. |
30Наблюдать | CVE-2026-20217Proof of concept | ClamAV PESpin File Format Processing Out-of-Bounds Memory Corruption Vulnerabilityclamav · clamav · CWE-120 | Высокая7,5 | — | 0,5 % | 1 июл. 2026 г. |
29Наблюдать | CVE-2026-46680Proof of concept | containerd user ID handling bypass allows runAsNonRoot evasionlinuxfoundation · containerd · CWE-269 | Высокая7,3 | — | 0,1 % | 1 июл. 2026 г. |
29Наблюдать | CVE-2026-57736Эксплойта нет | WordPress HubSpot plugin <= 11.3.51 - Sensitive Data Exposure vulnerabilityhubspot · hubspot · CWE-201 | Высокая7,4 | — | 0,2 % | 1 июл. 2026 г. |
34Наблюдать | CVE-2026-49119Эксплойта нет | Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess()gradio project · gradio · CWE-22 | Высокая8,7 | — | 0,6 % | 1 июл. 2026 г. |
41В плане | CVE-2026-50160Proof of concept | Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwritehoppscotch · hoppscotch · CWE-915 | Критическая10,0 | — | 1,7 % | 1 июл. 2026 г. |
39Наблюдать | CVE-2026-51947Proof of concept | An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pivotal CRM 6.6.5.10 and Patch_CWE502_2026CWE-502 | Критическая9,8 | — | 1,0 % | 1 июл. 2026 г. |
38Наблюдать | CVE-2026-58457Proof of concept | Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.cspshenzhen aitemi e commerce co. ltd. · m300 wi-fi repeater · CWE-78 | Критическая9,3 | — | 2,9 % | 1 июл. 2026 г. |
38Наблюдать | CVE-2026-14382Proof of concept | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially performgoogle · chrome · CWE-20 | Критическая9,6 | — | 0,2 % | 1 июл. 2026 г. |
35Наблюдать | CVE-2026-14431Proof of concept | Type Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafgoogle · chrome · CWE-843 | Высокая8,8 | — | 0,4 % | 1 июл. 2026 г. |
34Наблюдать | CVE-2026-55794Proof of concept | Craft CMS: Potential authenticated Remote Code Execution via referrer redirectcraftcms · cms · CWE-94 | Высокая8,7 | — | 0,4 % | 1 июл. 2026 г. |
17Наблюдать | CVE-2026-10104Proof of concept | Product Video Gallery for Woocommerce <= 1.5.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via custom_thumbnail Parameternikhilgadhiya · product video gallery for woocommerce · CWE-79 | Средняя4,4 | — | 0,3 % | 2 июл. 2026 г. |
21Наблюдать | CVE-2026-13459Эксплойта нет | JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameterjetmonsters · jetformbuilder — dynamic blocks form builder · CWE-862 | Средняя5,3 | — | 0,5 % | 2 июл. 2026 г. |
40В плане | CVE-2026-5524Proof of concept | Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameterdivi engine · divi form builder · CWE-434 | Критическая9,8 | — | 3,4 % | 2 июл. 2026 г. |
22Наблюдать | CVE-2026-12166Proof of concept | A NULL pointer dereference vulnerability for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to cause a denial of serlittle orbit · gamefirst anti-cheat · CWE-476 | Средняя5,5 | — | 0,1 % | 2 июл. 2026 г. |
41В плане | CVE-2026-50746Proof of concept | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to exui · unifi connect application · CWE-284 | Критическая10,0 | — | 1,6 % | 2 июл. 2026 г. |
38Наблюдать | CVE-2026-58455Proof of concept | Dockwatch 0.6.567 Unauthenticated OS Command Injection via ajax/compose.phpnotifiarr · dockwatch · CWE-78 | Критическая9,2 | — | 8,0 % | 2 июл. 2026 г. |
33Наблюдать | CVE-2026-58467Proof of concept | Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.phpcockpit-hq · cockpit · CWE-22 | Высокая8,2 | — | 1,7 % | 2 июл. 2026 г. |
37Наблюдать | CVE-2026-59099Эксплойта нет | Apereo CAS 7.3.0 < 8.0.0-RC6 - AES-GCM Nonce Reuse Information Disclosureapereo · cas · CWE-323 | Критическая9,3 | — | 0,5 % | 2 июл. 2026 г. |
35Наблюдать | CVE-2026-54998Proof of concept | Microsoft Exchange Online Elevation of Privilege Vulnerabilitymicrosoft · exchange online · CWE-863 | Высокая8,8 | — | 0,7 % | 2 июл. 2026 г. |
38Наблюдать | CVE-2026-13768Proof of concept | Gardyn IoT Hub Use of Hard-coded Credentialsgardyn · gardyn home firmware · CWE-798 | Критическая9,5 | — | 0,6 % | 2 июл. 2026 г. |
20Наблюдать | CVE-2026-54477Proof of concept | Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntaxgardyn · gardyn home firmware · CWE-644 | Средняя5,1 | — | 0,3 % | 2 июл. 2026 г. |
27Наблюдать | CVE-2026-55726Proof of concept | Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control Spheregardyn · gardyn home firmware · CWE-497 | Средняя6,9 | — | 0,4 % | 2 июл. 2026 г. |
24Наблюдать | CVE-2026-12960Proof of concept | An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device toasus · router app · CWE-926 | Средняя6,0 | — | 0,1 % | 2 июл. 2026 г. |
30Наблюдать | CVE-2026-8932Proof of concept | incomplete mTLS config matching in conn reusehaxx · curl · CWE-305 | Высокая7,5 | — | 0,3 % | 3 июл. 2026 г. |
35Наблюдать | CVE-2026-14459Proof of concept | Argument Injection in TUBITAK BILGEM's pardus-softwaretubitak bilgem software technologies research institute · pardus-software · CWE-88 | Высокая8,8 | — | 0,2 % | 3 июл. 2026 г. |
18Наблюдать | CVE-2026-14620Proof of concept | webpack-dev-server vulnerable to cross-site request forgery via internal developer endpointswebpack.js · webpack-dev-server · CWE-352 | Средняя4,7 | — | 0,5 % | 3 июл. 2026 г. |
40В плане | CVE-2026-20896Proof of concept | Gitea Docker image trusts spoofable reverse-proxy headers by defaultgitea · gitea open source git server · CWE-284 | Критическая9,8 | — | 2,7 % | 3 июл. 2026 г. |
38Наблюдать | CVE-2026-22874Proof of concept | Gitea webhook and migration allow-list filtering permits SSRFgitea · gitea open source git server · CWE-918 | Критическая9,6 | — | 0,4 % | 3 июл. 2026 г. |
32Наблюдать | CVE-2026-27771Proof of concept | Gitea Composer package source links use insufficient permission checksgitea · gitea open source git server · CWE-862 | Высокая8,2 | — | 1,3 % | 3 июл. 2026 г. |
32Наблюдать | CVE-2026-28699Proof of concept | Gitea Basic Auth bypasses OAuth2 access token scopesgitea · gitea open source git server · CWE-284 | Высокая8,1 | — | 0,5 % | 3 июл. 2026 г. |
34Наблюдать | CVE-2026-58289Proof of concept | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerabilitymicrosoft · edge chromium · CWE-843 | Высокая8,3 | — | 1,9 % | 3 июл. 2026 г. |
35Наблюдать | CVE-2026-58424Proof of concept | Permanent Fork PR Workflow Approval Gate Bypassgitea · gitea open source git server · CWE-285 | Высокая8,9 | — | 0,3 % | 3 июл. 2026 г. |
33Наблюдать | CVE-2026-54424Proof of concept | An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege.unity · parsec · CWE-648 | Высокая8,4 | — | 0,1 % | 3 июл. 2026 г. |
22Наблюдать | CVE-2026-14628Proof of concept | NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversalnousresearch · hermes-agent · CWE-22 | Средняя5,5 | — | 0,7 % | 4 июл. 2026 г. |
35Наблюдать | CVE-2026-53359Proof of concept | KVM: x86: Fix shadow paging use-after-free due to unexpected rolelinux · linux kernel · CWE-416 | Высокая8,8 | — | 0,9 % | 4 июл. 2026 г. |
35Наблюдать | CVE-2026-53360Proof of concept | KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in uselinux · linux kernel · CWE-125 | Высокая8,8 | — | 0,2 % | 4 июл. 2026 г. |
28Наблюдать | CVE-2026-53361Proof of concept | af_unix: Set gc_in_progress to true in unix_gc().linux · linux kernel · CWE-362 | Высокая7,1 | — | 0,2 % | 4 июл. 2026 г. |
61На этой неделе | CVE-2026-53362Готовый эксплойт | ipv6: account for fraggap on the paged allocation pathlinux · linux kernel · CWE-787 | Высокая7,8 | KEV | 0,7 % | 4 июл. 2026 г. |
36Наблюдать | CVE-2026-59509Proof of concept | Unauthenticated arbitrary MongoDB collection read in cve-searchcve-search · cve-search · CWE-20 | Критическая9,2 | — | 1,4 % | 5 июл. 2026 г. |
22Наблюдать | CVE-2026-14762Proof of concept | code-projects Hotel and Tourism Reservation Room Management rooms.php sql injectioncode-projects · hotel and tourism reservation · CWE-74 | Средняя5,5 | — | 0,4 % | 5 июл. 2026 г. |
23Наблюдать | CVE-2026-14802Proof of concept | react create-react-app react-dev-utils openBrowser.js startBrowserProcess os command injectionreact · create-react-app · CWE-77 | Средняя5,5 | — | 2,1 % | 6 июл. 2026 г. |
37Наблюдать | CVE-2026-40047Proof of concept | Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducerapache · camel · CWE-88 | Критическая9,1 | — | 2,4 % | 6 июл. 2026 г. |
32Наблюдать | CVE-2026-40859Proof of concept | Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabledapache · camel · CWE-502 | Высокая8,1 | — | 0,8 % | 6 июл. 2026 г. |
32Наблюдать | CVE-2026-42527Proof of concept | Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosureapache · camel · CWE-502 | Высокая8,1 | — | 0,6 % | 6 июл. 2026 г. |
32Наблюдать | CVE-2026-43865Proof of concept | Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code executionapache · camel · CWE-502 | Высокая8,1 | — | 0,9 % | 6 июл. 2026 г. |
29Наблюдать | CVE-2026-43866Proof of concept | Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolderapache · camel · CWE-502 | Высокая7,3 | — | 0,6 % | 6 июл. 2026 г. |
39Наблюдать | CVE-2026-43867Proof of concept | Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFiltapache · camel · CWE-502 | Критическая9,8 | — | 0,9 % | 6 июл. 2026 г. |
21Наблюдать | CVE-2026-46453Proof of concept | Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clienapache · camel · CWE-20 | Средняя5,3 | — | 0,5 % | 6 июл. 2026 г. |
39Наблюдать | CVE-2026-46454Proof of concept | Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to injeapache · camel · CWE-20 | Критическая9,8 | — | 0,8 % | 6 июл. 2026 г. |
39Наблюдать | CVE-2026-46455Proof of concept | Apache Camel: Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tapache · camel · CWE-613 | Критическая9,8 | — | 0,6 % | 6 июл. 2026 г. |
39Наблюдать | CVE-2026-46456Proof of concept | Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to injeapache · camel · CWE-20 | Критическая9,8 | — | 0,7 % | 6 июл. 2026 г. |
30Наблюдать | CVE-2026-46457Proof of concept | Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publisapache · camel · CWE-20 | Высокая7,5 | — | 0,6 % | 6 июл. 2026 г. |
14Наблюдать | CVE-2026-46584Proof of concept | Apache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail session properties, allowing an attacker to influence SMTP parametersapache · camel · CWE-20 | Низкая3,7 | — | 0,5 % | 6 июл. 2026 г. |
30Наблюдать | CVE-2026-46585Proof of concept | Apache Camel Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP clapache · camel · CWE-20 | Высокая7,5 | — | 0,6 % | 6 июл. 2026 г. |
35Наблюдать | CVE-2026-46590Proof of concept | Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream anapache · camel · CWE-502 | Высокая8,8 | — | 0,8 % | 6 июл. 2026 г. |
32Наблюдать | CVE-2026-46591Proof of concept | Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowapache · camel · CWE-943 | Высокая8,2 | — | 0,5 % | 6 июл. 2026 г. |
30Наблюдать | CVE-2026-46592Proof of concept | Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filtapache · camel · CWE-20 | Высокая7,5 | — | 0,6 % | 6 июл. 2026 г. |
30Наблюдать | CVE-2026-46726Proof of concept | Apache Camel Vertx Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategyapache · camel · CWE-20 | Высокая7,5 | — | 0,8 % | 6 июл. 2026 г. |
36Наблюдать | CVE-2026-48203Proof of concept | Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an Hapache · camel · CWE-20 | Критическая9,1 | — | 0,6 % | 6 июл. 2026 г. |
39Наблюдать | CVE-2026-48204Proof of concept | Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to swapache · camel · CWE-20 | Критическая9,8 | — | 0,7 % | 6 июл. 2026 г. |
36Наблюдать | CVE-2026-48205Proof of concept | Apache Camel DNS: The dns.* and term Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inflapache · camel · CWE-20 | Критическая9,1 | — | 0,6 % | 6 июл. 2026 г. |
21Наблюдать | CVE-2026-48206Proof of concept | Apache Camel JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to drive arbitrary JIRA issue opapache · camel · CWE-20 | Средняя5,3 | — | 0,5 % | 6 июл. 2026 г. |
26Наблюдать | CVE-2026-49086Proof of concept | Apache Camel Dapr: Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers, allowing an actor who can puapache · camel · CWE-20 | Средняя6,5 | — | 0,6 % | 6 июл. 2026 г. |
26Наблюдать | CVE-2026-49097Proof of concept | Apache Camel: Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing aapache · camel · CWE-20 | Средняя6,5 | — | 0,6 % | 6 июл. 2026 г. |
21Наблюдать | CVE-2026-49098Proof of concept | Apache Camel: Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP heapache · camel · CWE-20 | Средняя5,3 | — | 0,6 % | 6 июл. 2026 г. |
21Наблюдать | CVE-2026-49099Proof of concept | Apache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to influence internal behaviourapache · camel · CWE-74 | Средняя5,3 | — | 0,5 % | 6 июл. 2026 г. |
21Наблюдать | CVE-2026-49365Proof of concept | Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP respoapache · camel · CWE-209 | Средняя5,3 | — | 0,5 % | 6 июл. 2026 г. |
39Наблюдать | CVE-2026-53913Proof of concept | Apache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the tapache · camel · CWE-287 | Критическая9,8 | — | 1,0 % | 6 июл. 2026 г. |
30Наблюдать | CVE-2026-55993Proof of concept | Apache Camel Atmosphere Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy, alapache · camel · CWE-20 | Высокая7,5 | — | 0,8 % | 6 июл. 2026 г. |
30Наблюдать | CVE-2026-55994Proof of concept | Apache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection apache · camel · CWE-20 | Высокая7,5 | — | 0,6 % | 6 июл. 2026 г. |
21Наблюдать | CVE-2026-56139Proof of concept | Apache Camel Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body,apache · camel · CWE-209 | Средняя5,3 | — | 0,5 % | 6 июл. 2026 г. |
29Наблюдать | CVE-2026-46587Proof of concept | Apache Camel: Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted inputapache · camel · CWE-20 | Высокая7,3 | — | 0,6 % | 6 июл. 2026 г. |
29Наблюдать | CVE-2026-46588Proof of concept | Apache Camel: CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted inputapache · camel · CWE-20 | Высокая7,3 | — | 0,6 % | 6 июл. 2026 г. |
29Наблюдать | CVE-2026-49042Proof of concept | Apache Camel: langchain4j-tools: filter tool argument headers against declared parametersapache · camel · CWE-20 | Высокая7,3 | — | 0,6 % | 6 июл. 2026 г. |
33Наблюдать | CVE-2026-43825Эксплойта нет | Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModelapache · opennlp · CWE-502 | Высокая7,3 | — | 13,9 % | 6 июл. 2026 г. |
30Наблюдать | CVE-2026-13753Proof of concept | Certain HP DeskJet All in One – Potential Information Disclosurehp inc · hp deskjet 2820 aio printer · CWE-703 | Высокая7,5 | — | 0,4 % | 6 июл. 2026 г. |
39Наблюдать | CVE-2026-11405Proof of concept | Hidden backdoor authentication mechanism in multiple versions of Tenda firmware allows admin access to web management interfacetenda · firmware · CWE-912 | Критическая9,8 | — | 0,7 % | 6 июл. 2026 г. |
40В плане | CVE-2026-34038Proof of concept | Coolify authenticated remote command injection leading to RCE and secret exfiltrationcoollabsio · coolify · CWE-78 | Критическая9,9 | — | 2,5 % | 6 июл. 2026 г. |
27Наблюдать | CVE-2026-53647Proof of concept | FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpointfossbilling · fossbilling · CWE-200 | Средняя6,9 | — | 0,5 % | 6 июл. 2026 г. |
39Наблюдать | CVE-2026-34048Proof of concept | Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team serverscoollabsio · coolify · CWE-285 | Критическая9,9 | — | 0,7 % | 7 июл. 2026 г. |
34Наблюдать | CVE-2026-12277Proof of concept | Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Deletion via Saved File Metadata Path Traversalunknown · frontend file manager plugin · CWE-73 | Высокая8,7 | — | 0,3 % | 7 июл. 2026 г. |
39Наблюдать | CVE-2026-33264Эксплойта нет | Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()apache · airflow · CWE-502 | Критическая9,8 | — | 1,6 % | 7 июл. 2026 г. |
23Наблюдать | CVE-2026-12352Proof of concept | Incorrect Authorizationdigi international · portserver ts 1/2/4 · CWE-863 | Средняя5,9 | — | 0,4 % | 7 июл. 2026 г. |
19Наблюдать | CVE-2026-12948Proof of concept | Stored Cross-Site Scripting (XSS)digi international · digi portserver ts · CWE-79 | Средняя4,8 | — | 0,4 % | 7 июл. 2026 г. |
34Наблюдать | CVE-2026-23697Proof of concept | Vtiger CRM < 8.4.0 Authenticated File Upload RCE via Documents Modulevtiger · vtiger crm · CWE-434 | Высокая8,7 | — | 0,9 % | 7 июл. 2026 г. |
34Наблюдать | CVE-2026-23698Proof of concept | Vtiger CRM 8.4.0 Authenticated RCE via Module Import File Uploadvtiger · vtiger crm · CWE-434 | Высокая8,6 | — | 1,2 % | 7 июл. 2026 г. |
34Наблюдать | CVE-2026-57851Proof of concept | MSI KernCoreLib64.sys Privilege Escalation via IOCTL Handlersmicro-star international (msi) · kerncorelib64.sys · CWE-782 | Высокая8,5 | — | 0,1 % | 7 июл. 2026 г. |
15Наблюдать | CVE-2026-55592Proof of concept | Dashy: XSS in workspace url parameterlissy93 · dashy · CWE-79 | Низкая3,9 | — | 0,2 % | 7 июл. 2026 г. |
31Наблюдать | CVE-2026-57239Proof of concept | Foxit PDF Editor/Reader Local Privilege Escalationfoxit · pdf editor · CWE-427 | Высокая7,8 | — | 0,1 % | 8 июл. 2026 г. |
36Наблюдать | CVE-2026-41042Proof of concept | Apache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server viapache software foundation · apache gravitino · CWE-20 | Критическая9,1 | — | 1,5 % | 8 июл. 2026 г. |
30Наблюдать | CVE-2026-6854Proof of concept | My Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parametersjoedolson · my calendar – accessible event manager · CWE-89 | Высокая7,5 | — | 1,5 % | 8 июл. 2026 г. |
- CVE-2026-1419131Наблюдать
WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeader
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %rarlab · winrar1 июл. 2026 г.
- CVE-2026-1373128Наблюдать
WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter
ВысокаяCVSS 7,2Proof of conceptEPSS 0 %quantumcloud · wpbot – ai chatbot for live support, lead generation, ai services1 июл. 2026 г.
- CVE-2026-782928Наблюдать
UltraVNC repeater authenticated out-of-bounds write in rule parser via oversized token
ВысокаяCVSS 7,2Эксплойта нетEPSS 0 %uvnc · ultravnc1 июл. 2026 г.
- CVE-2026-783835Наблюдать
UltraVNC viewer heap buffer overflow via integer overflow in RFB connection-failure reason length
ВысокаяCVSS 8,7Эксплойта нетEPSS 1 %uvnc · ultravnc1 июл. 2026 г.
- CVE-2026-1179432Наблюдать
Advanced Form Integration < 2.1.1 - Unauthenticated Privilege Escalation via Breakdance Form Role Mapping
ВысокаяCVSS 8,1Эксплойта нетEPSS 0 %unknown · advanced form integration — connect forms to 200+ apps1 июл. 2026 г.
- CVE-2026-1138740В плане
SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset
КритическаяCVSS 9,8Proof of conceptEPSS 2 %cozyvision1 · sms alert – sms & otp for woocommerce, order notifications & abandoned cart recovery1 июл. 2026 г.
- CVE-2026-5751737Наблюдать
Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter
КритическаяCVSS 9,3Proof of conceptEPSS 0 %control web panel · control web panel1 июл. 2026 г.
- CVE-2026-5802523Наблюдать
Remote Code Execution via Unsafe Deserialization in LogItem Import
СредняяCVSS 5,9Proof of conceptEPSS 0 %mediawiki · mediawiki1 июл. 2026 г.
- CVE-2026-88571Наблюдать
Full RCE using EasyTimeline Extension
CVSS 0,0Proof of conceptEPSS 2 %mediawiki · mediawiki1 июл. 2026 г.
- CVE-2026-2021730Наблюдать
ClamAV PESpin File Format Processing Out-of-Bounds Memory Corruption Vulnerability
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %clamav · clamav1 июл. 2026 г.
- CVE-2026-4668029Наблюдать
containerd user ID handling bypass allows runAsNonRoot evasion
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %linuxfoundation · containerd1 июл. 2026 г.
- CVE-2026-5773629Наблюдать
WordPress HubSpot plugin <= 11.3.51 - Sensitive Data Exposure vulnerability
ВысокаяCVSS 7,4Эксплойта нетEPSS 0 %hubspot · hubspot1 июл. 2026 г.
- CVE-2026-4911934Наблюдать
Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess()
ВысокаяCVSS 8,7Эксплойта нетEPSS 0 %gradio project · gradio1 июл. 2026 г.
- CVE-2026-5016041В плане
Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite
КритическаяCVSS 10,0Proof of conceptEPSS 1 %hoppscotch · hoppscotch1 июл. 2026 г.
- CVE-2026-5194739Наблюдать
An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pivotal CRM 6.6.5.10 and Patch_CWE502_2026
КритическаяCVSS 9,8Proof of conceptEPSS 1 %1 июл. 2026 г.
- CVE-2026-5845738Наблюдать
Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp
КритическаяCVSS 9,3Proof of conceptEPSS 2 %shenzhen aitemi e commerce co. ltd. · m300 wi-fi repeater1 июл. 2026 г.
- CVE-2026-1438238Наблюдать
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform
КритическаяCVSS 9,6Proof of conceptEPSS 0 %google · chrome1 июл. 2026 г.
- CVE-2026-1443135Наблюдать
Type Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %google · chrome1 июл. 2026 г.
- CVE-2026-5579434Наблюдать
Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
ВысокаяCVSS 8,7Proof of conceptEPSS 0 %craftcms · cms1 июл. 2026 г.
- CVE-2026-1010417Наблюдать
Product Video Gallery for Woocommerce <= 1.5.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via custom_thumbnail Parameter
СредняяCVSS 4,4Proof of conceptEPSS 0 %nikhilgadhiya · product video gallery for woocommerce2 июл. 2026 г.
- CVE-2026-1345921Наблюдать
JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
СредняяCVSS 5,3Эксплойта нетEPSS 0 %jetmonsters · jetformbuilder — dynamic blocks form builder2 июл. 2026 г.
- CVE-2026-552440В плане
Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter
КритическаяCVSS 9,8Proof of conceptEPSS 3 %divi engine · divi form builder2 июл. 2026 г.
- CVE-2026-1216622Наблюдать
A NULL pointer dereference vulnerability for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to cause a denial of ser
СредняяCVSS 5,5Proof of conceptEPSS 0 %little orbit · gamefirst anti-cheat2 июл. 2026 г.
- CVE-2026-5074641В плане
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to ex
КритическаяCVSS 10,0Proof of conceptEPSS 1 %ui · unifi connect application2 июл. 2026 г.
- CVE-2026-5845538Наблюдать
Dockwatch 0.6.567 Unauthenticated OS Command Injection via ajax/compose.php
КритическаяCVSS 9,2Proof of conceptEPSS 8 %notifiarr · dockwatch2 июл. 2026 г.
- CVE-2026-5846733Наблюдать
Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.php
ВысокаяCVSS 8,2Proof of conceptEPSS 1 %cockpit-hq · cockpit2 июл. 2026 г.
- CVE-2026-5909937Наблюдать
Apereo CAS 7.3.0 < 8.0.0-RC6 - AES-GCM Nonce Reuse Information Disclosure
КритическаяCVSS 9,3Эксплойта нетEPSS 0 %apereo · cas2 июл. 2026 г.
- CVE-2026-5499835Наблюдать
Microsoft Exchange Online Elevation of Privilege Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %microsoft · exchange online2 июл. 2026 г.
- CVE-2026-1376838Наблюдать
Gardyn IoT Hub Use of Hard-coded Credentials
КритическаяCVSS 9,5Proof of conceptEPSS 0 %gardyn · gardyn home firmware2 июл. 2026 г.
- CVE-2026-5447720Наблюдать
Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax
СредняяCVSS 5,1Proof of conceptEPSS 0 %gardyn · gardyn home firmware2 июл. 2026 г.
- CVE-2026-5572627Наблюдать
Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control Sphere
СредняяCVSS 6,9Proof of conceptEPSS 0 %gardyn · gardyn home firmware2 июл. 2026 г.
- CVE-2026-1296024Наблюдать
An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to
СредняяCVSS 6,0Proof of conceptEPSS 0 %asus · router app2 июл. 2026 г.
- CVE-2026-893230Наблюдать
incomplete mTLS config matching in conn reuse
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %haxx · curl3 июл. 2026 г.
- CVE-2026-1445935Наблюдать
Argument Injection in TUBITAK BILGEM's pardus-software
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %tubitak bilgem software technologies research institute · pardus-software3 июл. 2026 г.
- CVE-2026-1462018Наблюдать
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
СредняяCVSS 4,7Proof of conceptEPSS 0 %webpack.js · webpack-dev-server3 июл. 2026 г.
- CVE-2026-2089640В плане
Gitea Docker image trusts spoofable reverse-proxy headers by default
КритическаяCVSS 9,8Proof of conceptEPSS 2 %gitea · gitea open source git server3 июл. 2026 г.
- CVE-2026-2287438Наблюдать
Gitea webhook and migration allow-list filtering permits SSRF
КритическаяCVSS 9,6Proof of conceptEPSS 0 %gitea · gitea open source git server3 июл. 2026 г.
- CVE-2026-2777132Наблюдать
Gitea Composer package source links use insufficient permission checks
ВысокаяCVSS 8,2Proof of conceptEPSS 1 %gitea · gitea open source git server3 июл. 2026 г.
- CVE-2026-2869932Наблюдать
Gitea Basic Auth bypasses OAuth2 access token scopes
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %gitea · gitea open source git server3 июл. 2026 г.
- CVE-2026-5828934Наблюдать
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
ВысокаяCVSS 8,3Proof of conceptEPSS 1 %microsoft · edge chromium3 июл. 2026 г.
- CVE-2026-5842435Наблюдать
Permanent Fork PR Workflow Approval Gate Bypass
ВысокаяCVSS 8,9Proof of conceptEPSS 0 %gitea · gitea open source git server3 июл. 2026 г.
- CVE-2026-5442433Наблюдать
An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege.
ВысокаяCVSS 8,4Proof of conceptEPSS 0 %unity · parsec3 июл. 2026 г.
- CVE-2026-1462822Наблюдать
NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal
СредняяCVSS 5,5Proof of conceptEPSS 0 %nousresearch · hermes-agent4 июл. 2026 г.
- CVE-2026-5335935Наблюдать
KVM: x86: Fix shadow paging use-after-free due to unexpected role
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %linux · linux kernel4 июл. 2026 г.
- CVE-2026-5336035Наблюдать
KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %linux · linux kernel4 июл. 2026 г.
- CVE-2026-5336128Наблюдать
af_unix: Set gc_in_progress to true in unix_gc().
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %linux · linux kernel4 июл. 2026 г.
- CVE-2026-5336261На этой неделе
ipv6: account for fraggap on the paged allocation path
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 0 %linux · linux kernel4 июл. 2026 г.
- CVE-2026-5950936Наблюдать
Unauthenticated arbitrary MongoDB collection read in cve-search
КритическаяCVSS 9,2Proof of conceptEPSS 1 %cve-search · cve-search5 июл. 2026 г.
- CVE-2026-1476222Наблюдать
code-projects Hotel and Tourism Reservation Room Management rooms.php sql injection
СредняяCVSS 5,5Proof of conceptEPSS 0 %code-projects · hotel and tourism reservation5 июл. 2026 г.
- CVE-2026-1480223Наблюдать
react create-react-app react-dev-utils openBrowser.js startBrowserProcess os command injection
СредняяCVSS 5,5Proof of conceptEPSS 2 %react · create-react-app6 июл. 2026 г.
- CVE-2026-4004737Наблюдать
Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer
КритическаяCVSS 9,1Proof of conceptEPSS 2 %apache · camel6 июл. 2026 г.
- CVE-2026-4085932Наблюдать
Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4252732Наблюдать
Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4386532Наблюдать
Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4386629Наблюдать
Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4386739Наблюдать
Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilt
КритическаяCVSS 9,8Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4645321Наблюдать
Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clien
СредняяCVSS 5,3Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4645439Наблюдать
Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inje
КритическаяCVSS 9,8Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4645539Наблюдать
Apache Camel: Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired t
КритическаяCVSS 9,8Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4645639Наблюдать
Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inje
КритическаяCVSS 9,8Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4645730Наблюдать
Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publis
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4658414Наблюдать
Apache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail session properties, allowing an attacker to influence SMTP parameters
НизкаяCVSS 3,7Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4658530Наблюдать
Apache Camel Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP cl
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4659035Наблюдать
Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream an
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4659132Наблюдать
Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allow
ВысокаяCVSS 8,2Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4659230Наблюдать
Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filt
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4672630Наблюдать
Apache Camel Vertx Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4820336Наблюдать
Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an H
КритическаяCVSS 9,1Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4820439Наблюдать
Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to sw
КритическаяCVSS 9,8Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4820536Наблюдать
Apache Camel DNS: The dns.* and term Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to infl
КритическаяCVSS 9,1Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4820621Наблюдать
Apache Camel JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to drive arbitrary JIRA issue op
СредняяCVSS 5,3Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4908626Наблюдать
Apache Camel Dapr: Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers, allowing an actor who can pu
СредняяCVSS 6,5Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4909726Наблюдать
Apache Camel: Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing a
СредняяCVSS 6,5Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4909821Наблюдать
Apache Camel: Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP he
СредняяCVSS 5,3Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4909921Наблюдать
Apache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour
СредняяCVSS 5,3Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4936521Наблюдать
Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP respo
СредняяCVSS 5,3Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-5391339Наблюдать
Apache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the t
КритическаяCVSS 9,8Proof of conceptEPSS 1 %apache · camel6 июл. 2026 г.
- CVE-2026-5599330Наблюдать
Apache Camel Atmosphere Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy, al
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-5599430Наблюдать
Apache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-5613921Наблюдать
Apache Camel Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body,
СредняяCVSS 5,3Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4658729Наблюдать
Apache Camel: Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4658829Наблюдать
Apache Camel: CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4904229Наблюдать
Apache Camel: langchain4j-tools: filter tool argument headers against declared parameters
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %apache · camel6 июл. 2026 г.
- CVE-2026-4382533Наблюдать
Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModel
ВысокаяCVSS 7,3Эксплойта нетEPSS 13 %apache · opennlp6 июл. 2026 г.
- CVE-2026-1375330Наблюдать
Certain HP DeskJet All in One – Potential Information Disclosure
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %hp inc · hp deskjet 2820 aio printer6 июл. 2026 г.
- CVE-2026-1140539Наблюдать
Hidden backdoor authentication mechanism in multiple versions of Tenda firmware allows admin access to web management interface
КритическаяCVSS 9,8Proof of conceptEPSS 0 %tenda · firmware6 июл. 2026 г.
- CVE-2026-3403840В плане
Coolify authenticated remote command injection leading to RCE and secret exfiltration
КритическаяCVSS 9,9Proof of conceptEPSS 2 %coollabsio · coolify6 июл. 2026 г.
- CVE-2026-5364727Наблюдать
FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpoint
СредняяCVSS 6,9Proof of conceptEPSS 0 %fossbilling · fossbilling6 июл. 2026 г.
- CVE-2026-3404839Наблюдать
Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers
КритическаяCVSS 9,9Proof of conceptEPSS 0 %coollabsio · coolify7 июл. 2026 г.
- CVE-2026-1227734Наблюдать
Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Deletion via Saved File Metadata Path Traversal
ВысокаяCVSS 8,7Proof of conceptEPSS 0 %unknown · frontend file manager plugin7 июл. 2026 г.
- CVE-2026-3326439Наблюдать
Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()
КритическаяCVSS 9,8Эксплойта нетEPSS 1 %apache · airflow7 июл. 2026 г.
- CVE-2026-1235223Наблюдать
Incorrect Authorization
СредняяCVSS 5,9Proof of conceptEPSS 0 %digi international · portserver ts 1/2/47 июл. 2026 г.
- CVE-2026-1294819Наблюдать
Stored Cross-Site Scripting (XSS)
СредняяCVSS 4,8Proof of conceptEPSS 0 %digi international · digi portserver ts7 июл. 2026 г.
- CVE-2026-2369734Наблюдать
Vtiger CRM < 8.4.0 Authenticated File Upload RCE via Documents Module
ВысокаяCVSS 8,7Proof of conceptEPSS 0 %vtiger · vtiger crm7 июл. 2026 г.
- CVE-2026-2369834Наблюдать
Vtiger CRM 8.4.0 Authenticated RCE via Module Import File Upload
ВысокаяCVSS 8,6Proof of conceptEPSS 1 %vtiger · vtiger crm7 июл. 2026 г.
- CVE-2026-5785134Наблюдать
MSI KernCoreLib64.sys Privilege Escalation via IOCTL Handlers
ВысокаяCVSS 8,5Proof of conceptEPSS 0 %micro-star international (msi) · kerncorelib64.sys7 июл. 2026 г.
- CVE-2026-5559215Наблюдать
Dashy: XSS in workspace url parameter
НизкаяCVSS 3,9Proof of conceptEPSS 0 %lissy93 · dashy7 июл. 2026 г.
- CVE-2026-5723931Наблюдать
Foxit PDF Editor/Reader Local Privilege Escalation
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %foxit · pdf editor8 июл. 2026 г.
- CVE-2026-4104236Наблюдать
Apache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server vi
КритическаяCVSS 9,1Proof of conceptEPSS 1 %apache software foundation · apache gravitino8 июл. 2026 г.
- CVE-2026-685430Наблюдать
My Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %joedolson · my calendar – accessible event manager8 июл. 2026 г.