CVEs published in July 2026

CVE-2026-18446High

Injection fast-uri Dependency in Jira Software Data Center

CVE-2026-44615Medium

Path traversal vulnerability in Apache Zeppelin

CVE-2026-64607Medium

Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

CVE-2026-62391High

CVE-2025-66518High

CVE-2026-9828Medium

Logback Vulnerability in NetApp Products

CVE-2026-61082High

CVE-2026-60624High

CVE-2026-60623High

CVE-2026-60586High

CVE-2026-3276Medium

Python Vulnerability in NetApp Products

CVE-2026-31633Critical

Linux Kernel Vulnerability in NetApp Products

CVE-2026-26143High

Microsoft PowerShell Vulnerability in NetApp Products

CVE-2026-66756Medium

Improper Protection of Alternate Path vulnerability in Apache Tika

CVE-2026-66755Medium

Apache Tika: Arbitrary Local File Read in ISArchiveParser

CVE-2026-23985Medium

Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0

CVE-2026-23981Medium

Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own

CVE-2026-52680Critical

Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource

CVE-2026-48910Medium

carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim

CVE-2026-28814High

Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables

CVE-2026-28813High

Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities

CVE-2026-28812Critical

UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges

CVE-2026-28811High

Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3

CVE-2026-44617Medium

CVE-2024-31867Medium

CVE-2026-44616Medium

LDAP injection vulnerability in Apache Zeppelin

CVE-2026-44613Medium

Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling

CVE-2026-41709LowCISA KEV

Broadcom VMWare ESX Insufficient Logging Vulnerability

CVE-2026-41703High

Out-of-bounds read vulnerability

CVE-2026-47876Critical

VMXNET3 out-of-bounds write vulnerability

CVE-2026-59309Critical

vCenter: VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service.

CVE-2026-59310CriticalCISA KEV

Broadcom VMware vCenter Path Traversal Vulnerability

CVE-2026-59328Medium

Spring Boot: Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Bro…

CVE-2026-59327Medium

Spring Boot: Spring Tools for Eclipse stores the Spring Boot DevTools remote secret (spring.devtools.remote.secret) as a plain str…

CVE-2026-59326Low

Spring Boot: The Spring Boot language server logs the raw value of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment v…

CVE-2026-47882High

Spring Boot: When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud F…

CVE-2026-47858High

Spring Boot: Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running applic…

CVE-2026-58043High

Unauthorized filesystem access due to Permission Model enforcement flaw

CVE-2025-14562Low

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to commit changes to a project after being removed as a member, due to improper authorization checks on merge request collaboration settings

CVE-2026-3093Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper sanitization of user-controlled input

CVE-2026-4672Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with guest-role permissions to access test report contents they were not authorized to view due to improper access control enforcement

CVE-2026-6267High

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized information due to insufficient access controls on internal request handling

CVE-2026-6336Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthorized user to view project import source information due to a missing authorization check

CVE-2026-12436High

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of user-supplied attributes when processing pipeline schedule inputs

CVE-2026-13113Medium

Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab

CVE-2026-14341Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Maintainer role to modify protected branch configuration due to improper authorization in a projects API endpoint

CVE-2026-14351Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to view the title of a confidential issue through a publicly accessible merge request due to improper authorization checks

CVE-2026-15077Medium

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to access information from unauthorized projects due to improper neutralization of untrusted content processed by the AI-assisted code review functionality

CVE-2026-15831Medium

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to bypass administrator-configured tool governance policies due to improper authorization enforcement during token generation

CVE-2026-15975High

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to insufficient resource throttling when processing merge request discussions

CVE-2026-16553Medium

GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed some sensitive information to be disclosed to an unintended host due to improper handling of upstream requests in virtual registries

CVE-2026-13346Medium

Pip Vulnerability in NetApp Products

CVE-2026-20316MediumCISA KEV

Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability

CVE-2026-20313Critical

CVE-2026-20312Critical

CVE-2026-20311High

Cisco IOS XE Software Web-Based Management Interface Denial of Service Vulnerability

CVE-2026-20310Critical

CVE-2026-20304Critical

CVE-2026-20303Critical

CVE-2026-20301High

Cisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of Service Vulnerability

CVE-2026-20294High

Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability

CVE-2026-20289High

Cisco RoomOS Logging Subsystem Information Disclosure Vulnerability

CVE-2026-20288High

CVE-2026-20273Critical

CVE-2026-20272Critical

CVE-2026-20271Critical

CVE-2026-20270Critical

CVE-2026-20269Critical

CVE-2026-20268Critical

CVE-2026-20267Critical

CVE-2026-20263High

Cisco IOS XE Software Blocks Extensible Exchange Protocol Denial of Service Vulnerability

CVE-2026-20200High

CVE-2026-20198High

Cisco Integrated Management Controller Cross-Site Scripting Vulnerability

CVE-2026-20124High

Cisco IOS XE Software SNMP Denial of Service Vulnerability

CVE-2026-20028High

Cisco Terminal Services Agent Firewall Rules Bypass Vulnerability

CVE-2026-67214High

DoS (Denial of Service) nanoid Dependency in Bamboo Data Center and Server

CVE-2026-67213High

DoS (Denial of Service) nanoid Dependency in Bamboo Data Center and Server

CVE-2026-50622High

Missing Authorization in Apache Atlas

CVE-2026-23904High

Apache Kyuubi: Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination

CVE-2026-65100Medium

Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode

CVE-2026-58189High

Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification

CVE-2026-58188High

Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins

CVE-2026-58187Low

Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service

CVE-2026-58186High

Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses

CVE-2026-58185Medium

Apache Traffic Server: Use-after-free in the intercept plugin

CVE-2026-58184High

Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory

CVE-2026-58183Medium

Apache Traffic Server: prefetch plugin can crash on attacker-influenced input

CVE-2026-58182High

Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors

CVE-2026-58181High

Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash

CVE-2026-58180High

Apache Traffic Server: txn_box plugin overflows the stack from attacker input

CVE-2026-58179High

Apache Traffic Server: regex_remap plugin overflows the stack from attacker input

CVE-2026-58178High

Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery

CVE-2026-58177High

The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors

CVE-2026-58175High

Apache Traffic Server: HostDB SRV handling leaks memory

CVE-2026-58164High

Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free

CVE-2026-58163High

Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server

CVE-2026-58162Critical

Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates

CVE-2026-58161High

Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server

CVE-2026-59243Critical

Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)

CVE-2026-58160Medium

Apache Traffic Server: Out-of-bounds reads while parsing DNS responses