CVEs published in July 2026

CVE-2026-58159High

Apache Traffic Server: Listener and ACL handling allow access-control bypass

CVE-2026-58158Medium

Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow

CVE-2026-58157High

Apache Traffic Server: Improper server-session reuse can expose data across client connections

CVE-2026-58156Medium

Apache Traffic Server: URL and port parsing errors allow access-control bypass

CVE-2026-58155Critical

Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling

CVE-2026-58154High

Apache Traffic Server: Memory-safety errors in MIME and header parsing

CVE-2026-65325Medium

Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname

CVE-2026-65324High

Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion

CVE-2026-58153Medium

Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1

CVE-2026-58152Medium

Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory

CVE-2026-58151High

Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server

CVE-2026-58150Critical

Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling

CVE-2026-57834Critical

Apache Traffic Server: Malformed chunked message body allows request smuggling

CVE-2026-33930Medium

Apache Traffic Server: Buffer overflow via Host field that has a long string value

CVE-2026-24033Medium

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server

CVE-2026-33267High

Improper Input Validation vulnerability in Apache Traffic Server

CVE-2026-22068Medium

Regular Expression without Anchors vulnerability in Apache Traffic Server

CVE-2026-41920High

Improper Access Control vulnerability in Apache Traffic Server

CVE-2026-64634Critical

CVE-2026-64633Critical

CVE-2026-64632Critical

CVE-2026-64631Critical

CVE-2026-64630Critical

CVE-2026-58075Critical

CVE-2026-58074Critical

CVE-2026-66299High

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example

CVE-2026-66713Critical

Remote code execution via deserialization of untrusted data in Tribes clustering

CVE-2026-59878High

Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All

CVE-2026-61487Medium

Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ

CVE-2026-6949High

TSIG packet with crafted name compression can crash DNS server

CVE-2026-58224High

Samba Vulnerability in NetApp Products

CVE-2026-58222High

Samba AD LDAP Compare filter injection and trusted-request confusion disclose protected attributes

CVE-2026-58221High

authenticated LDAP access to internal LDB special DNs permits domain takeover

CVE-2026-58218Medium

DNS signing DoS via TKEY name cache exhaustion

CVE-2026-58216Medium

kpasswd service: kpasswd packet that contains malformed ASN.1 might cause the server to access 6 bytes of unallocated memory leading server to crash

CVE-2026-64635Critical

CVE-2026-58073Critical

CVE-2026-58072Critical

CVE-2026-58071Critical

CVE-2026-58067Critical

CVE-2026-45623High

Information disclosure and denial of service via crafted CSS input

CVE-2026-66391Medium

Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket

CVE-2026-66390Medium

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket

CVE-2026-59251High

Erlang/OTP public_key: Denial of Service via crafted TLS certificate chains

CVE-2026-55953Critical

Erlang/OTP ssl client: Authentication bypass via unoffered anonymous cipher suite acceptance

CVE-2026-55737High

Denial of Service via crafted external term format binary

CVE-2026-66053Medium

Apache Thrift Python bindings: Information disclosure due to improper certificate validation

CVE-2026-58662High

Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings

CVE-2026-58389High

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings

CVE-2026-58023Medium

Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings

CVE-2026-55971Critical

Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings

CVE-2026-55970Medium

Buffer Over-read vulnerability in Apache Thrift C++ bindings

CVE-2026-55969High

Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings

CVE-2026-55968High

Apache Thrift Node: Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache…

CVE-2026-49158High

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings

CVE-2026-48586High

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go…

CVE-2026-48145High

Information disclosure due to improper certificate validation

CVE-2026-48144Critical

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings

CVE-2026-45112High

Denial of Service due to uncontrolled resource allocation

CVE-2026-43871High

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java…

CVE-2026-41608High

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings

CVE-2026-64535Critical

Fix potential UAF when ddgst mismatch

CVE-2026-64534Critical

check INIT_FAILED before nvmet_req_uninit in digest error path

CVE-2026-64531High

reject oversized nested action attrs

CVE-2026-64391Critical

use opener credentials for ADS I/O

CVE-2026-64319Critical

validate reply message payload bounds against transfer length

CVE-2026-66035High

Libssh2 Vulnerability in NetApp Products

CVE-2026-66034High

Information disclosure and potential arbitrary code execution via heap out-of-bounds read

CVE-2026-66033High

Denial of Service via integer underflow in AES-GCM cipher negotiation

CVE-2026-66032High

Libssh2 Vulnerability in NetApp Products

CVE-2026-49326Medium

Missing Authorization vulnerability in Apache HBase thrift and rest delegation service

CVE-2026-46452Medium

Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could

CVE-2026-45816High

NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event

CVE-2026-45815High

Reachable Assertion vulnerability in Apache NimBLE

CVE-2026-45813High

Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service

CVE-2026-45812Medium

Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event

CVE-2026-45811High

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE

CVE-2026-66144High

Although remote policy references are not retrieved during policy normalization, if they are manually retrieved

CVE-2026-66010Critical

Cross-Site Scripting (XSS) via custom element attribute bypass

CVE-2026-66143High

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2

CVE-2026-66142High

Apache Neethi is vulnerable to uncontrolled recursion

CVE-2026-63317Medium

Arbitrary class instantiation via crafted XML or untrusted format names

CVE-2026-56392Medium

GNU coreutils unexpand: Denial of Service via crafted tab stop values

CVE-2026-56191Critical

Microsoft Exchange Online Tampering Vulnerability

CVE-2026-62574High

Java SE Vulnerability in NetApp Products

CVE-2026-60526Medium

Java Platform Standard Edition Vulnerability in NetApp Products

CVE-2026-60166Medium

CVE-2026-60164Medium

CVE-2026-58052Low

7-Zip Vulnerability in NetApp Products

CVE-2026-50009High

CVE-2026-47035Medium

CVE-2026-47034Medium

CVE-2026-47030Medium

CVE-2026-47013Medium

CVE-2026-46307High

Linux Kernel Vulnerability in NetApp Products

CVE-2026-46306High

Linux Kernel Vulnerability in NetApp Products

CVE-2026-46304High

Linux Kernel Vulnerability in NetApp Products

CVE-2026-46303High

Linux Kernel Vulnerability in NetApp Products

CVE-2026-44892High

CVE-2026-41254High