IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H1 A carefully crafted OS hypervisor call can cause the PowerVM hypervisor to crash or compromise OS memory integrity. CVSSv3.1 8.4 (HIGH)
A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search in a trusted context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain user can exploit these flaws to disclose confidential Active Dire CVSSv3.1 8.8 (HIGH)
Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in user-controlled URLs. Attackers can submit hexadecimal-encoded internal IP addresses through the web link creation feature, causing cURL to resolve and connect to internal network resources such as cloud instance metadata services, localhost services, and RFC1918 addresses while the isPrivateU CVSSv3.1 8.5 (HIGH)
Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker who can access the REST batch upload endpoint can provide path traversal sequences in the filename and cause the Kyuubi server process to write controlled content outside the intended upload directory, subject to filesystem permissions. This issue affects Apache Kyuubi: from 1.7.0 through 1.11.1. Users are recommended CVSSv3.1 9.8 (CRITICAL)
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in UMAI Vision Traffic Analysis System allows SQL Injection. This issue affects Traffic Analysis System: from 30 before 34. CVSSv3.1 9.8 (CRITICAL)
Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are recommended to upgrade to version 2.12.4, which fixes this issue. CVSSv3.1 8.8 (HIGH)
UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges. Users are recommended to upgrade to version 2.12.4 or newer which fixes this issue. CVSSv3.1 9.8 (CRITICAL)
SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled. CVSSv3.1 9.8 (CRITICAL)
A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that returns the records of other users without checking that the caller owns the data associated with that record. CVSSv3.1 8.1 (HIGH)
CVE-2026-66066 is a critical vulnerability in Ruby on Rails Active Storage when using libvips for image processing. An unauthenticated attacker can craft malicious image uploads to trigger unsafe libvips operations, enabling arbitrary file read and potential RCE via exposure of application secrets. Rails 7.0–8.1.x are affected; patched versions 7.2.3.2, 8.0.5.1, and 8.1.3.1 disable untrusted operations during initialization, requiring libvips 8.13+ and ruby-vips 2.2.1+.
Julep contains an insecure direct object reference vulnerability in the get_execution_details endpoint that allows authenticated tenants to read another tenant's execution data. Attackers can supply arbitrary execution_id values to retrieve sensitive execution records including task inputs, outputs, metadata, and temporal task tokens from other tenants. CVSSv3.1 8.1 (HIGH)
Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the _is_safe_url function that fails to validate hostnames through DNS resolution, allowing attackers to bypass the blocklist. Attackers can supply user-controlled image or audio URLs that resolve to private, loopback, or metadata addresses to reach internal services and exfiltrate credentials. CVSSv3.1 8.6 (HIGH)
MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches() that allows remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirect_uri whose hostname suffix matches a registered URI without proper dot-boundary anchoring. Attackers who control a domain ending with the registered redirect URI hostname can social-engineer victims into clicking a crafted autho CVSSv3.1 8.1 (HIGH)
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system. CVSSv3.1 9.8 (CRITICAL)
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled. CVSSv3.1 8.3 (HIGH)
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters. CVSSv3.1 8.8 (HIGH)
IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page. CVSSv3.1 9.3 (CRITICAL)
Metasploit Framework 6.5 released with 422 new modules and significant feature additions including Malleable C2 HTTP profile support across all Meterpreter payloads, a new MCP Server for AI-driven integration, expanded NTLM relay capabilities (HTTP-to-SMB/LDAP), the NTLMRelay2Self exploitation module, and enhanced Fetch payload functionality (fileless execution, pipe stagers, multi-architecture support).
Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without ensuring both use the same user record. An authenticated Editor can create a username collision with an Administrator account and obtain administrative privileges by logging in with their own password while the session loads the Administrator's account data. CVSSv3.1 8.8 (HIGH)
Cross-Site request forgery (CSRF) vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery. This issue affects E-Commerce Pack: through 30072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.3 (HIGH)
The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable SSH public key is included in the firmware's authorized_keys file for the root user. An attacker in possession of the corresponding private key could leverage it to bypass authentication and gain root-level access to the appliance. CVSSv3.1 8.1 (HIGH)
Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management Panel allows Authentication Bypass. This issue affects FTC E-Commerce Management Panel: before 1.0.2. CVSSv3.1 8.2 (HIGH)
Apple released 210 CVEs in July 2026 across iOS, macOS, tvOS, watchOS, and visionOS—a 5.7x jump from June's 37 CVEs. Critical vulnerabilities include CVE-2026-43818 (ImageIO RCE via malicious images, auto-parsed in Messages), CVE-2026-64747 (AVEVideoEncoder kernel code execution affecting all platforms), and CVE-2026-64767 (unauthenticated network-reachable kernel memory corruption via AFP). The release includes 9 code-execution bugs, 26 privilege-escalation flaws, 11 sandbox escapes, and 75 denial-of-service issues.
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code. CVSSv3.1 9.8 (CRITICAL)
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system. CVSSv3.1 9.8 (CRITICAL)