Total
3758 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-20803 | 1 Microsoft | 2 Sql Server 2022, Sql Server 2025 | 2026-07-30 | N/A | 7.2 HIGH |
| Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-44100 | 2026-07-30 | N/A | 9.4 CRITICAL | ||
| The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UIDs, Denial-of-Service and files tampering. | |||||
| CVE-2026-44090 | 2026-07-30 | N/A | 9.8 CRITICAL | ||
| Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access by a firewall. This may lead to the device being fully compromised. | |||||
| CVE-2026-1579 | 1 Px4 | 1 Autopilot | 2026-07-29 | N/A | 9.8 CRITICAL |
| The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIAL_CONTROL, which provides interactive shell access -- can be sent by an unauthenticated party with access to the MAVLink interface. PX4 provides MAVLink 2.0 message signing as the cryptographic authentication mechanism for all MAVLink communication. When signing is enabled, unsigned messages are rejected at the protocol level. | |||||
| CVE-2026-61094 | 1 Oracle | 2 Mysql Cluster, Mysql Server | 2026-07-28 | N/A | 7.2 HIGH |
| Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). | |||||
| CVE-2021-47933 | 2026-07-25 | N/A | 9.8 CRITICAL | ||
| WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the REST API endpoint. Attackers can upload PHP files with arbitrary names to the config_file endpoint to achieve remote code execution on the server. | |||||
| CVE-2021-47940 | 2026-07-25 | N/A | 9.8 CRITICAL | ||
| WordPress Plugin Download From Files version 1.48 and earlier contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting the AJAX fileupload action. Attackers can send POST requests to the admin-ajax.php endpoint with the download_from_files_617_fileupload action, manipulating the allowExt parameter to bypass file type restrictions and upload executable files like PHP shells to the web root. | |||||
| CVE-2026-33715 | 1 Chamilo | 1 Chamilo Lms | 2026-07-24 | N/A | 7.2 HIGH |
| Chamilo LMS is an open-source learning management system. In version 2.0-RC.2, the file public/main/inc/ajax/install.ajax.php is accessible without authentication on fully installed instances because, unlike other AJAX endpoints, it does not include the global.inc.php file that performs authentication and installation-completed checks. Its test_mailer action accepts an arbitrary Symfony Mailer DSN string from POST data and uses it to connect to an attacker-specified SMTP server, enabling Server-Side Request Forgery (SSRF) into internal networks via the SMTP protocol. An unauthenticated attacker can also abuse this to weaponize the Chamilo server as an open email relay for phishing and spam campaigns, with emails appearing to originate from the server's IP address. Additionally, error responses from failed SMTP connections may disclose information about internal network topology and running services. This issue has been fixed in version 2.0.0-RC.3. | |||||
| CVE-2026-34160 | 1 Chamilo | 1 Chamilo Lms | 2026-07-24 | N/A | 8.6 HIGH |
| Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the PENS (Package Exchange Notification Services) plugin endpoint at public/plugin/Pens/pens.php is accessible without authentication and accepts a user-controlled package-url parameter that the server fetches using curl without filtering private or internal IP addresses, enabling unauthenticated Server-Side Request Forgery (SSRF). An attacker can exploit this to probe internal network services, access cloud metadata endpoints (such as 169.254.169.254) to steal IAM credentials and sensitive instance metadata, or trigger state-changing operations on internal services via the receipt and alerts callback parameters. No authentication is required to exploit either SSRF vector, significantly increasing the attack surface. This issue has been fixed in version 2.0.0-RC.3. | |||||
| CVE-2026-28767 | 1 Mygardyn | 1 Cloud Api | 2026-07-24 | N/A | 5.3 MEDIUM |
| A specific administrative endpoint notifications is accessible without proper authentication. | |||||
| CVE-2019-25686 | 1 Coreftp | 1 Core Ftp | 2026-07-24 | N/A | 7.5 HIGH |
| Core FTP 2.0 build 653 contains a denial of service vulnerability in the PBSZ command that allows unauthenticated attackers to crash the service by sending a malformed command with an oversized buffer. Attackers can send a PBSZ command with a payload exceeding 211 bytes to trigger an access violation and crash the FTP server process. | |||||
| CVE-2026-34952 | 1 Praison | 1 Praisonai | 2026-07-24 | N/A | 9.1 CRITICAL |
| PraisonAI is a multi-agent teams system. Prior to version 4.5.97, the PraisonAI Gateway server accepts WebSocket connections at /ws and serves agent topology at /info with no authentication. Any network client can connect, enumerate registered agents, and send arbitrary messages to agents and their tool sets. This issue has been patched in version 4.5.97. | |||||
| CVE-2026-28766 | 1 Mygardyn | 1 Cloud Api | 2026-07-24 | N/A | 9.3 CRITICAL |
| A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication. | |||||
| CVE-2026-32646 | 1 Mygardyn | 1 Cloud Api | 2026-07-24 | N/A | 7.5 HIGH |
| A specific administrative endpoint is accessible without proper authentication, exposing device management functions. | |||||
| CVE-2019-25678 | 1 Gatech | 1 Computing For Good\'s Basic Laboratory Information System | 2026-07-24 | N/A | 8.2 HIGH |
| C4G Basic Laboratory Information System 3.4 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by injecting malicious code through the site parameter. Attackers can send GET requests to the users_select.php endpoint with crafted SQL payloads to extract sensitive database information including patient records and system credentials. | |||||
| CVE-2026-42302 | 2026-07-24 | N/A | 9.8 CRITICAL | ||
| FastGPT is an AI Agent building platform. From version 4.14.10 to before version 4.14.13, the agent-sandbox component of FastGPT is vulnerable to unauthenticated Remote Code Execution (RCE). The startup script entrypoint.sh initializes code-server with the --auth none flag and binds the service to all network interfaces (0.0.0.0:8080). This configuration allows any user with network access to the port to bypass authentication and gain full control over the sandbox environment. This issue has been patched in version 4.14.13. | |||||
| CVE-2026-33951 | 1 Signalk | 1 Signal K Server | 2026-07-24 | N/A | 7.5 HIGH |
| Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.1, the SignalK Server exposes an unauthenticated HTTP endpoint that allows remote attackers to modify navigation data source priorities. This endpoint, accessible via PUT /signalk/v1/api/sourcePriorities, does not enforce authentication or authorization checks and directly assigns user-controlled input to the server configuration. As a result, attackers can influence which GPS, AIS, or other sensor data sources are trusted by the system. The changes are immediately applied and persisted to disk, allowing the manipulation to survive server restarts. This issue has been patched in version 2.24.0-beta.1. | |||||
| CVE-2026-32211 | 1 Microsoft | 1 Azure Web Apps | 2026-07-24 | N/A | 9.1 CRITICAL |
| Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information over a network. | |||||
| CVE-2026-35450 | 1 Wwbn | 1 Avideo | 2026-07-24 | N/A | 5.3 MEDIUM |
| WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints (kill.ffmpeg.json.php, list.ffmpeg.json.php, ffmpeg.php) require User::isAdmin(). | |||||
| CVE-2026-34162 | 1 Fastgpt | 1 Fastgpt | 2026-07-24 | N/A | 10.0 CRITICAL |
| FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint (/api/core/app/httpTools/runTool) is exposed without any authentication. This endpoint acts as a full HTTP proxy — it accepts a user-supplied baseUrl, toolPath, HTTP method, custom headers, and body, then makes a server-side HTTP request and returns the complete response to the caller. This issue has been patched in version 4.14.9.5. | |||||