CVEs published in July 2026

CVE-2026-55833High

DoS (Denial of Service) io.netty:netty-codec-http Dependency in Bitbucket Data Center

CVE-2026-55831High

DoS (Denial of Service) io.netty:netty-codec-http Dependency in Bitbucket Data Center

CVE-2026-56623High

CVE-2026-48827High

CVE-2026-56624High

Improper certificate validation in Apache MINA SSHD (server-side)

CVE-2026-58624Medium

Improper input validation in sshd-git in Apache MINA SSHD

CVE-2026-56452High

Path traversal in the sshd-scp component of Apache MINA SSHD

CVE-2026-15788Medium

Information Disclosure via Improper Handling of NTFS Directory Junctions

CVE-2026-62418High

Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope

CVE-2026-62183Critical

Improper Privilege Management vulnerability in Apache Syncope

CVE-2026-57308Critical

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope

CVE-2026-53421Critical

Improper Isolation or Compartmentalization vulnerability in Apache Syncope

CVE-2026-53405Critical

Improper Isolation or Compartmentalization vulnerability in Apache Syncope

CVE-2026-63071Critical

Improper Isolation or Compartmentalization vulnerability in Apache Syncope

CVE-2026-15588Medium

GDBusServer pre-authentication DoS via unbounded SASL line buffering

CVE-2026-64106Medium

Reject restored DTE with out-of-range num_eventid_bits

CVE-2026-64102High

Reject MPA FPDU length underflow before signed receive math

CVE-2026-53398High

Fix SECINFO_NO_NAME decode error cleanup

CVE-2026-59173High

Uncontrolled Resource Consumption vulnerability in Apache Traffic Server

CVE-2026-47871High

Avi Load Balancer: VMware Avi Load Balancer contains a directory traversal vulnerability.

CVE-2026-47870High

Avi Load Balancer: VMware Avi Load Balancer contains a privilege escalation vulnerability.

CVE-2026-47869High

Avi Load Balancer: VMware Avi Load Balancer contains a remote code execution vulnerability.

CVE-2026-47868High

Avi Load Balancer: VMware Avi Load Balancer contains a local privilege escalation vulnerability.

CVE-2026-47867High

Avi Load Balancer: VMware Avi Load Balancer contains a remote code execution vulnerability.

CVE-2026-47866High

Avi Load Balancer: VMware Avi Load Balancer contains an authorization bypass vulnerability.

CVE-2026-47865Critical

Avi Load Balancer: VMware Avi Load Balancer contains an authentication bypass vulnerability.

CVE-2026-56171High

Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

CVE-2026-45784Medium

Heap Corruption from Incorrect Buffer Sizing

CVE-2026-51083Medium

Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtain hashed passwords via the cloudinit/dump API

CVE-2026-51082High

race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x pve-manager before 9.1.9 and 8.x before 8.4.19; qemu-server 9.x before 9.1.7 and 8.x before 8.4.7; and pve-container before 6.1.3 (PVE 9.x) and before 5.3.4 (PVE 8.x) allows an attacker with privileges to call "vncproxy" to hijack a VNC session that is established in parallel by a different user for a different VM

CVE-2026-51081Medium

cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and Proxmox Virtual Environment (PVE) 8.x 4.3.16 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload

CVE-2026-62764Medium

Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo

CVE-2026-9762High

IBM Db2 Vulnerability in NetApp Products

CVE-2026-7771Medium

IBM Db2 Vulnerability in NetApp Products

CVE-2026-10695Medium

IBM Db2 Vulnerability in NetApp Products

CVE-2026-10535High

IBM Db2 Vulnerability in NetApp Products

CVE-2026-62826Medium

Microsoft SharePoint Server Spoofing Vulnerability

CVE-2026-22752Critical

Spring Security: Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server.

CVE-2026-26032Medium

The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by…

CVE-2026-20298Medium

Sensitive Information Disclosure through the storage/passwords REST Endpoint in Splunk Enterprise

CVE-2026-20296High

SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk Enterprise

CVE-2026-20297High

Path Traversal through 'explicit_appname' in the App Install REST Endpoint in Splunk Enterprise

CVE-2026-60065Medium

When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthenticated attackers can send requests with conditions beyond the attacker's control to cause a heap buffer over-read in the NGINX worker process, leading to a restart

CVE-2026-56434High

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module

CVE-2026-60062Medium

The NGINX Agent config_dirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designated secure directory

CVE-2026-52865High

When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or modify Ingress or TransportServer resources can cause the NGINX Ingress Controller process to terminate

CVE-2026-55723High

When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller

CVE-2026-59762High

BIG-IP: When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization

CVE-2026-57821High

CVE-2024-32838High

CVE-2026-35152High

Apache Fineract: SQL injection in runreports endpoint

CVE-2026-56287High

boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in…

CVE-2026-15410CriticalCISA KEV

SonicWall SMA1000 Appliances Code Injection Vulnerability

CVE-2026-15409CriticalCISA KEV

SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

CVE-2026-15778High

Insufficient validation of untrusted input in Navigation

CVE-2026-15777High

Use after free in UI

CVE-2026-15776High

Type Confusion in V8

CVE-2026-15775Critical

Insufficient policy enforcement in V8

CVE-2026-15774Critical

Use after free in Skia

CVE-2026-15773Critical

Use after free in Core

CVE-2026-15772High

Use after free in GPU

CVE-2026-15771High

Insufficient validation of untrusted input in Media

CVE-2026-15770High

Uninitialized Use in V8

CVE-2026-15769High

Insufficient validation of untrusted input in Linux Toolkit Theming

CVE-2026-15768High

Insufficient policy enforcement in HTML-in-Canvas

CVE-2026-15767High

Heap buffer overflow in libyuv

CVE-2026-15766High

Uninitialized Use in Skia

CVE-2026-15765High

Use after free in Ozone

CVE-2026-15764High

Use after free in Ozone

CVE-2026-48801High

DoS (Denial of Service) linkify-it Dependency in Jira Service Management Data Center

CVE-2026-62659Medium

security flaw was discovered in the NETGEAR WAX333 Access Point that could allow someone already logged in and connected to the local network to make unauthorized changes to the device's settings

CVE-2026-62658Medium

security flaw was discovered in certain NETGEAR Nighthawk RAX series routers that could allow someone already logged in to the device to run unauthorized commands or code on the router

CVE-2026-62657Medium

security flaw in the router's certificate validation process was discovered in the NETGEAR XR1000 Gaming Router and certain Nighthawk models that could allow an unauthorized person to remotely access and take control of the device

CVE-2026-62656Medium

security flaw was found in certain NETGEAR RAX models that could allow a logged-in user to send specially crafted requests to the router and run unauthorized commands

CVE-2026-62655Medium

security flaw was found in certain NETGEAR Orbi models that could allow an unauthorized user to cause the device to stop responding or restart unexpectedly, disrupting network connectivity and making the device temporarily unavailable

CVE-2026-15757Medium

security flaw was discovered in the NETGEAR DGND3700v1 that could allow someone on the same local WiFi network to send unauthorized commands to the device

CVE-2026-55121Medium

Microsoft Office Information Disclosure Vulnerability

CVE-2026-56192Medium

Microsoft Office Information Disclosure Vulnerability

CVE-2026-55130High

Microsoft Word Remote Code Execution Vulnerability

CVE-2026-55128High

Microsoft Word Remote Code Execution Vulnerability

CVE-2026-55142Medium

Microsoft Word Information Disclosure Vulnerability

CVE-2026-55134High

Microsoft Word Remote Code Execution Vulnerability

CVE-2026-55132High

Microsoft Word Remote Code Execution Vulnerability

CVE-2026-55038High

Microsoft Word Remote Code Execution Vulnerability

CVE-2026-55055High

Microsoft Word Remote Code Execution Vulnerability

CVE-2026-55035Medium

Microsoft Office Information Disclosure Vulnerability

CVE-2026-55127High

Microsoft Word Remote Code Execution Vulnerability

CVE-2026-55124Medium

Microsoft Word Information Disclosure Vulnerability

CVE-2026-55033High

Microsoft Word Remote Code Execution Vulnerability

CVE-2026-55032High

Microsoft Word Remote Code Execution Vulnerability

CVE-2026-55050Medium

Microsoft Word Information Disclosure Vulnerability

CVE-2026-55045High

Microsoft Office Remote Code Execution Vulnerability

CVE-2026-55047Medium

Microsoft Office Information Disclosure Vulnerability

CVE-2026-55028Medium

Microsoft Office Information Disclosure Vulnerability

CVE-2026-55027Medium

Microsoft Office Information Disclosure Vulnerability

CVE-2026-55026Medium

Microsoft Office Information Disclosure Vulnerability

CVE-2026-55125High

Microsoft Office Remote Code Execution Vulnerability

CVE-2026-55023Medium

Microsoft Office Information Disclosure Vulnerability

CVE-2026-50303Medium

Windows Key Guard Security Feature Bypass Vulnerability

CVE-2026-50300Medium

Windows DWM Core Library Information Disclosure Vulnerability