Total
7911 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-42126 | 1 Liferay | 2 Digital Experience Platform, Liferay Portal | 2026-07-09 | N/A | 4.3 MEDIUM |
| The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the UI. | |||||
| CVE-2026-41123 | 1 Dell | 1 Data Domain Operating System | 2026-07-08 | N/A | 4.3 MEDIUM |
| Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper access control vulnerability in the RBAC. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information tampering. | |||||
| CVE-2026-56217 | 2026-07-08 | N/A | 4.3 MEDIUM | ||
| Capgo before 12.128.2 contains a policy bypass vulnerability in app_versions update enforcement that allows app-scoped API keys to downgrade encrypted bundles to non-encrypted state. Attackers with app-scoped all API keys can directly update the app_versions table via PostgREST to clear session_key and key_id fields, bypassing organization-enforced encrypted-bundle policies and weakening OTA security controls. | |||||
| CVE-2026-48204 | 1 Apache | 1 Camel | 2026-07-08 | N/A | 9.8 CRITICAL |
| Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when the endpoint's operation parameter is not set - which is the default. The control-header constants (GridFsConstants.GRIDFS_OPERATION, GRIDFS_OBJECT_ID, GRIDFS_METADATA, GRIDFS_CHUNKSIZE, GRIDFS_FILE_ID_PRODUCED) were the plain strings gridfs.operation, gridfs.objectid, gridfs.metadata, gridfs.chunksize and gridfs.fileid. Because these names do not start with the Camel / camel prefix, HttpHeaderFilterStrategy - which blocks only the Camel header namespace on the HTTP boundary - let them pass from an inbound HTTP request straight into the Exchange. In a route that bridges an HTTP consumer (for example platform-http) into a mongodb-gridfs: producer with no explicit operation, any HTTP client could therefore set the gridfs.operation header to override the route's intended operation - switching, for example, a file upload to remove (deleting a file identified by the attacker-supplied gridfs.objectid), listAll (enumerating every file in the bucket) or findOne (reading a file) - and supply a gridfs.metadata value that is parsed as a MongoDB document, enabling NoSQL operator injection. No credentials are required when the bridging consumer is unauthenticated. This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, routes that drive GridFS operations or metadata via the raw header names must use CamelGridFsOperation / CamelGridFsObjectId / CamelGridFsMetadata / CamelGridFsChunkSize / CamelGridFsFileId instead of the gridfs.* names. For deployments that cannot upgrade immediately, set an explicit operation on the mongodb-gridfs: endpoint so the operation is not taken from a header, and strip the gridfs.* headers from any untrusted ingress before the producer. | |||||
| CVE-2026-54765 | 1 Traefik | 1 Traefik | 2026-07-08 | N/A | 8.5 HIGH |
| Traefik is an open source HTTP reverse proxy and load balancer. From v3.7.0 prior to v3.7.6, Traefik's Kubernetes Gateway API provider may resolve two accepted HTTPRoutes that target the same backend Service:port but configure different backendRef filters to the same child service and apply only one route's filter set to all requests reaching that backend. In Gateway deployments where backendRef filters set security-sensitive headers, such as tenant identity, authorization context, or values the backend trusts, an attacker who can create an accepted HTTPRoute sharing the same backend Service:port may cause their route's filter context to be applied to another route's requests, potentially crossing namespace boundaries when a ReferenceGrant permits cross-namespace targeting. This issue is fixed in version v3.7.6. | |||||
| CVE-2026-58523 | 2 Google, Microsoft | 2 Android, Edge Chromium | 2026-07-07 | N/A | 6.5 MEDIUM |
| Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network. | |||||
| CVE-2026-27660 | 2026-07-07 | N/A | 7.5 HIGH | ||
| Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission. | |||||
| CVE-2026-26292 | 2026-07-07 | N/A | 9.8 CRITICAL | ||
| Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests. | |||||
| CVE-2026-26247 | 2026-07-07 | N/A | 9.1 CRITICAL | ||
| Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check. | |||||
| CVE-2026-25712 | 2026-07-07 | N/A | 7.5 HIGH | ||
| Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations. | |||||
| CVE-2026-24690 | 2026-07-07 | N/A | 7.5 HIGH | ||
| Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches. | |||||
| CVE-2026-24451 | 2026-07-07 | N/A | 7.5 HIGH | ||
| Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized. | |||||
| CVE-2026-20909 | 2026-07-07 | N/A | 5.3 MEDIUM | ||
| Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries. | |||||
| CVE-2026-20896 | 2026-07-07 | N/A | 9.8 CRITICAL | ||
| Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled. | |||||
| CVE-2026-24014 | 1 Apache | 1 Iotdb | 2026-07-07 | N/A | 9.8 CRITICAL |
| Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to write files outside the intended Trigger installation directory. This could allow arbitrary file write with the permissions of the IoTDB process. This issue affects Apache IoTDB: from 1.3.3 before 2.0.8. Users are recommended to upgrade to version 2.0.8, which fixes the issue. | |||||
| CVE-2026-54408 | 1 Ui | 1 Unifi Protect | 2026-07-07 | N/A | 8.6 HIGH |
| A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication for data streaming. | |||||
| CVE-2024-43590 | 1 Microsoft | 4 Visual C\+\+ Redistributable, Visual Studio 2017, Visual Studio 2019 and 1 more | 2026-07-07 | N/A | 7.8 HIGH |
| Visual C++ Redistributable Installer Elevation of Privilege Vulnerability | |||||
| CVE-2026-26145 | 1 Microsoft | 1 Azure Synapse | 2026-07-07 | N/A | 4.8 MEDIUM |
| Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-58286 | 1 Microsoft | 1 Edge Chromium | 2026-07-07 | N/A | 8.1 HIGH |
| Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | |||||
| CVE-2026-14792 | 2026-07-07 | 6.4 MEDIUM | 6.5 MEDIUM | ||
| A security vulnerability has been detected in Formbricks 5.0.0. This impacts an unknown function of the file apps/web/modules/survey/link/actions.ts of the component Survey Handler. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. Upgrading to version 5.1.0-rc.1 will fix this issue. The identifier of the patch is af6023b5ac3b030ffcea24fac799f76f3e3512c6. You should upgrade the affected component. | |||||