CVEs published in July 2026

CVE-2026-0283High

PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN)

CVE-2026-0282Medium

PAN-OS: File Deletion Vulnerability in Management Web Interface

CVE-2026-0281Medium

PAN-OS: Information Disclosure Vulnerability in Management Web Interface

CVE-2026-0280Medium

PAN-OS: IPv6 Firewall Policy Bypass

CVE-2026-0279Medium

PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities

CVE-2026-0278High

Prisma Access Agent: Multiple DLP Policy Bypass Vulnerabilities on Windows

CVE-2026-0277High

Prisma Access Agent: Improper Certificate Validation on iOS

CVE-2026-0276Medium

Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability

CVE-2026-0275High

CVE-2026-59877Critical

Denial of Service via crafted.proto schema

CVE-2026-59871Medium

Denial of Service due to incorrect PAX path handling

CVE-2026-59874High

Denial of Service via malformed tar archive header

CVE-2026-59873Critical

Denial of Service via crafted gzip bomb

CVE-2026-59875Medium

Denial of Service via crafted archive with NUL bytes in metadata

CVE-2026-59869High

DoS (Denial of Service) js-yaml Dependency in Jira Software Data Center

CVE-2026-22927High

Omnissa Workspace ONE Tunnel for Windows addresses a Local Privilege Escalation Vulnerability.

CVE-2026-41042Critical

Apache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API

CVE-2026-60001High

Brute-force attacks facilitated due to insufficient authentication delay

CVE-2026-49487Medium

Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs

CVE-2026-49296Medium

Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id}

CVE-2026-48892Medium

Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options

CVE-2026-48891Medium

Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target

CVE-2026-48828Medium

Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact called without the key

CVE-2026-33264Critical

Apache Airflow: DAG author RCE on webserver via unrestricted import_string in BaseSerialization.deserialize

CVE-2026-33630High

Use-after-free / double-free in query-completion handling

CVE-2026-55379High

Denial of Service via crafted BDF font file

CVE-2026-55380High

Denial of Service via crafted GD 2.x image file

CVE-2026-54060High

Denial of Service via excessive memory allocation when processing font files

CVE-2026-54059High

Denial of Service via crafted PCF font data

CVE-2026-55798High

Arbitrary command injection via shell metacharacters in file paths

CVE-2026-43825High

Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected: before 3.0.0-M4 (libsvm document…

CVE-2026-49297High

Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS…

CVE-2026-49042High

Improper Input Validation vulnerability in Apache Camel

CVE-2026-46588High

Improper Input Validation vulnerability in Apache Camel

CVE-2026-46587High

Improper Input Validation vulnerability in Apache Camel

CVE-2026-55994High

Apache Camel: Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery…

CVE-2026-55993Critical

Apache Camel: Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery…

CVE-2026-53913Critical

CVE-2026-23552Critical

CVE-2026-49099Medium

Apache Camel: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Authorization…

CVE-2026-49097Medium

Apache Camel: Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component…

CVE-2026-49086Medium

Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel DAPR…

CVE-2026-48206Medium

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel JIRA component

CVE-2026-48205Critical

Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS component

CVE-2026-48204Critical

Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component

CVE-2026-48203Critical

Apache Camel: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input…

CVE-2026-46591High

CVE-2025-66169High

CVE-2026-46585High

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Lucene…

CVE-2026-46457High

Improper Input Validation vulnerability in Apache Camel NATS component

CVE-2026-46456Critical

Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component

CVE-2026-46455Critical

Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component

CVE-2026-46454Critical

Improper Input Validation vulnerability in Apache Camel Cometd Component

CVE-2026-46453Medium

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel…

CVE-2026-46590Critical

CVE-2026-43867Critical

CVE-2026-43865Critical

Apache Camel: Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component.

CVE-2026-42527High

Apache ActiveMQ: Deserialization of Untrusted Data vulnerability in Apache Camel.

CVE-2026-24014Critical

Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file…

CVE-2026-24013Critical

Apache IoTDB: Authentication Bypass by Spoofing vulnerability in Apache IoTDB.

CVE-2026-24012High

Apache IoTDB: Uncontrolled Resource Consumption vulnerability in Apache IoTDB.

CVE-2026-43866High

Apache Camel JMS components: Arbitrary Exchange state injection

CVE-2026-56140Critical

Apache Camel AWS SNS Component: Defense-in-depth hardening due to improper input validation

CVE-2026-56139Medium

Information disclosure via error messages containing sensitive data

CVE-2026-49365Medium

Information disclosure via error messages containing sensitive data

CVE-2026-49098Medium

Message redirection and injection via header manipulation

CVE-2026-46726High

Server-Side Request Forgery and sensitive data exposure

CVE-2026-46592High

Remote attacker can execute unintended operations via header manipulation

CVE-2026-46584High

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel…

CVE-2026-40859High

Apache Camel: Deserialization of Untrusted Data vulnerability in Apache Camel.

CVE-2026-40047Critical

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component

CVE-2026-53362HighCISA KEV

Linux Kernel Unspecified Vulnerability

CVE-2026-53359High

Fix shadow paging use-after-free due to unexpected role

CVE-2026-47896High

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene

CVE-2026-47898Medium

Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library)

CVE-2026-47897High

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene

CVE-2026-9547Critical

Man-in-the-middle attack via SSH host key bypass

CVE-2026-9545Critical

Information disclosure via cached SSL session and early data

CVE-2026-9079Critical

Information disclosure due to failure to clear proxy authentication credentials

CVE-2026-8926Critical

Information disclosure via incorrect.netrc password lookup

CVE-2026-8925Critical

Double-free vulnerability in SASL authentication

CVE-2026-8924Critical

Cookie injection via malicious HTTP server using super cookies

CVE-2026-8286Critical

Insecure connection establishment due to TLS configuration mismatch

CVE-2026-11856Critical

Information disclosure via incorrect Digest authentication header reuse

CVE-2026-11564Critical

Certificate validation bypass due to incorrect connection reuse

CVE-2026-8247High

Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker on the same local network segment to execute arbitrary code

CVE-2026-13728Medium

In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to encrypt saved credentials for Access Portal resources

CVE-2026-13722High

WatchGuard Fireware OS contains a firmware validation bypass when processing a backup image via the backup/restore feature

CVE-2026-13384High

Out-of-bounds Write vulnerability in WatchGuard Fireware OS wgagent process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI

CVE-2026-13383High

Out-of-bounds Write vulnerability in WatchGuard Fireware OS ikestubd process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI

CVE-2026-13377Medium

CVE-2026-13376Medium

CVE-2026-13375Medium

CVE-2026-13374Medium

CVE-2026-13373Medium

CVE-2026-13368Critical

WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2

CVE-2026-13084High

null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to create a denial-of-service (DoS) condition by sending specially crafted IKEv2 messages

CVE-2026-13079High

local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker to escalate their privileges to NT AUTHORITY\SYSTEM on the machine where the client is installed

CVE-2026-13054High

path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem

CVE-2026-13053High

Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially crafted CLI command