Total
7911 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-14775 | 2026-07-07 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was identified in SourceCodester Onlne Examination & Learning Management System 1.0. Affected is an unknown function of the file /process_lesson.php. Such manipulation of the argument user_id leads to unrestricted upload. The attack may be launched remotely. The exploit is publicly available and might be used. The name of the affected product appears to have a typo in it. | |||||
| CVE-2026-22555 | 2026-07-06 | N/A | 8.1 HIGH | ||
| Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets. | |||||
| CVE-2026-54407 | 1 Ui | 1 Unifi Protect | 2026-07-06 | N/A | 8.6 HIGH |
| A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication in certain UniFi Protect Application API endpoints. | |||||
| CVE-2026-55114 | 1 Ui | 1 Unifi Network Application | 2026-07-06 | N/A | 8.8 HIGH |
| A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application. | |||||
| CVE-2026-55118 | 1 Ui | 1 Unifi Network Application | 2026-07-06 | N/A | 8.3 HIGH |
| A malicious actor with access to the network,low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application. | |||||
| CVE-2026-58282 | 1 Microsoft | 1 Edge Chromium | 2026-07-06 | N/A | 8.1 HIGH |
| Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | |||||
| CVE-2026-20706 | 2026-07-06 | N/A | 9.1 CRITICAL | ||
| Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint. | |||||
| CVE-2025-71380 | 2026-07-06 | N/A | 8.8 HIGH | ||
| The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host system where n8n runs. Attackers with user access or compromised credentials can exploit this node to run malicious commands, potentially leading to data exfiltration, service disruption, or complete system compromise. | |||||
| CVE-2026-58422 | 2026-07-06 | N/A | 9.8 CRITICAL | ||
| Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts | |||||
| CVE-2026-58421 | 2026-07-06 | N/A | 7.5 HIGH | ||
| Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service | |||||
| CVE-2026-27779 | 2026-07-06 | N/A | 7.5 HIGH | ||
| Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation. | |||||
| CVE-2026-28699 | 2026-07-06 | N/A | 8.1 HIGH | ||
| Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication. | |||||
| CVE-2026-9085 | 2026-07-06 | N/A | 8.8 HIGH | ||
| Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-Parental-Control allows DNS Spoofing. This issue affects Pardus-Parental-Control: from <=0.5.1 before 0.7.0. | |||||
| CVE-2026-14776 | 2026-07-06 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A security flaw has been discovered in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is the function pathinfo of the file /upload_files.php of the component Filename Extension. Performing a manipulation results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The name of the affected product appears to have a typo in it. | |||||
| CVE-2026-14736 | 2026-07-06 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was found in Ruijie RG-UAC up to 1.0-R1.8.2.p5. The impacted element is an unknown function of the file user_auth_commit.php. Performing a manipulation of the argument upload_image results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. | |||||
| CVE-2026-14698 | 2026-07-06 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management and Examination System 1.0. Impacted is an unknown function of the file upload_files.php. Performing a manipulation results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. | |||||
| CVE-2026-14777 | 2026-07-06 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A weakness has been identified in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this issue is some unknown functionality of the file /announcements.php. Executing a manipulation can lead to unrestricted upload. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The name of the affected product appears to have a typo in it. | |||||
| CVE-2026-8147 | 1 Lfprojects | 1 Mlflow | 2026-07-06 | N/A | 8.1 HIGH |
| In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying traces on experiments they do not have permission to access. The issue arises from the `_before_request` handler, which does not register authorization validators for trace endpoints, resulting in requests proceeding without validation. This vulnerability can expose sensitive data, destroy audit logs, and allow unauthorized modifications. | |||||
| CVE-2025-44619 | 1 Tinxy | 2 Wifi Lock Controller V1 Rf, Wifi Lock Controller V1 Rf Firmware | 2026-07-05 | N/A | 9.1 CRITICAL |
| Tinxy WiFi Lock Controller v1 RF was discovered to be configured to transmit on an open Wi-Fi network, allowing attackers to join the network without authentication. | |||||
| CVE-2026-29597 | 2026-07-05 | N/A | 6.5 MEDIUM | ||
| DDSN Interactive cm3 Acora CMS version 10.7.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive configuration files by force browsing the “/Admin/file_manager/file_details.asp” endpoint and manipulating the “file” parameter. By referencing specific files (e.g., cm3.xml), the attacker can retrieve system administrator credentials, SMTP settings, database credentials, and other confidential information. The exposure of this information can lead to full administrative access to the CMS, unauthorized access to email services, compromise of backend databases, lateral movement within the network, and long-term persistence by an attacker. This access control bypass poses a critical risk of account takeover, privilege escalation, and systemic compromise of the affected application and its associated infrastructure. | |||||