Total
5364 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-27891 | 2026-07-22 | N/A | 5.3 MEDIUM | ||
| On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports. This can cause outgoing packets to incorrectly be allowed or denied. | |||||
| CVE-2026-11017 | 4 Apple, Google, Linux and 1 more | 4 Macos, Chrome, Linux Kernel and 1 more | 2026-07-22 | N/A | 6.5 MEDIUM |
| Inappropriate implementation in Link Preview in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-10806 | 2026-07-22 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was found in mjperpinosa stumasy. The affected element is an unknown function of the file application/PHP/objects/updates/add_post.php. Performing a manipulation of the argument up_file_to_post results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-9590 | 1 Devolutions | 1 Devolutions Server | 2026-07-22 | N/A | 5.3 MEDIUM |
| Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user with entry edit privileges to modify asset information without the required permission. | |||||
| CVE-2026-42074 | 1 Gitlawb | 1 Openclaude | 2026-07-22 | N/A | 9.8 CRITICAL |
| OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the dangerouslyDisableSandbox parameter is exposed as part of the BashTool input schema, meaning the LLM (an untrusted principal per the project's own threat model) can set it to true in any tool_use response. Combined with the default allowUnsandboxedCommands: true setting, a prompt-injected model can escape the sandbox for any arbitrary command, achieving full host-level code execution. This issue has been patched in version 0.5.1. | |||||
| CVE-2026-40713 | 1 Dell | 1 Thinos | 2026-07-22 | N/A | 6.1 MEDIUM |
| Dell ThinOS 10, versions prior to ThinOS10 2602_10.0765, contain an Improper Access control vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information exposure. | |||||
| CVE-2026-45080 | 2026-07-22 | N/A | N/A | ||
| Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal. Prior to version 2.10.4, improper access control allows disclosure of password hash. This issue has been patched in version 2.10.4. | |||||
| CVE-2026-7198 | 1 Progress | 1 Sitefinity | 2026-07-22 | N/A | 9.8 CRITICAL |
| CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4.8630 allows a remote unauthenticated attacker to access content that should be restricted, resulting in full compromise of confidentiality, integrity, and availability of affected installations. | |||||
| CVE-2026-40715 | 1 Dell | 1 Thinos | 2026-07-22 | N/A | 7.8 HIGH |
| Dell ThinOS 10, versions prior to ThinOS10 2602_10.0765, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation. | |||||
| CVE-2026-9522 | 1 Devolutions | 1 Devolutions Server | 2026-07-22 | N/A | 5.4 MEDIUM |
| Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative privileges to delete network discovery scan configurations. | |||||
| CVE-2026-14322 | 2026-07-22 | N/A | 5.3 MEDIUM | ||
| The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointments without making any payment. | |||||
| CVE-2026-16451 | 2026-07-22 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A security flaw has been discovered in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This impacts an unknown function of the file /api/system/file/upload of the component com.zs.file.controller.SysFileController. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-58545 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-07-22 | N/A | 5.5 MEDIUM |
| Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally. | |||||
| CVE-2026-50495 | 1 Microsoft | 9 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 6 more | 2026-07-22 | N/A | 6.1 MEDIUM |
| Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally. | |||||
| CVE-2026-50465 | 1 Microsoft | 4 Windows 11 24h2, Windows 11 25h2, Windows 11 26h1 and 1 more | 2026-07-22 | N/A | 7.1 HIGH |
| Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally. | |||||
| CVE-2026-50423 | 1 Microsoft | 7 Windows 10 21h2, Windows 10 22h2, Windows 11 24h2 and 4 more | 2026-07-22 | N/A | 7.8 HIGH |
| Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-50418 | 1 Microsoft | 5 Windows 11 24h2, Windows 11 25h2, Windows 11 26h1 and 2 more | 2026-07-22 | N/A | 5.1 MEDIUM |
| Improper access control in Windows System allows an unauthorized attacker to bypass a security feature locally. | |||||
| CVE-2026-50373 | 1 Microsoft | 9 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 6 more | 2026-07-22 | N/A | 7.8 HIGH |
| Improper access control in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-50325 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-07-22 | N/A | 7.0 HIGH |
| Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-50311 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-07-22 | N/A | 7.8 HIGH |
| Improper access control in Windows Server allows an authorized attacker to elevate privileges locally. | |||||