CVEs published July 18, 2026
77,396 CVEs in 2026
Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded.
VMware Avi Load Balancer contains an authentication bypass vulnerability.
VMware Avi Load Balancer contains a directory traversal vulnerability.
A vulnerability was found in Shibby Tomato 1.28.
A vulnerability has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124.
A flaw has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124.
OpenPLC_v3 contains a heap-based buffer overflow in the getData() function in webserver/core/modbus_master.cpp. getData() reads characters between two delimiters into a caller-supplied buffer with no size…
VMware Avi Load Balancer contains a remote code execution vulnerability.
VMware Avi Load Balancer contains a remote code execution vulnerability.
Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter.
Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix.
VMware Avi Load Balancer contains an authorization bypass vulnerability.
QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim…
The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python's Mersenne Twister…
uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime.
VMware Avi Load Balancer contains a local privilege escalation vulnerability.
Uncontrolled Resource Consumption vulnerability in Apache Traffic Server.
ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user.
A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/1.php.
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0.
A security flaw has been discovered in zevorn rt-claw up to 0.2.0.
A vulnerability was identified in zevorn rt-claw up to 0.2.0.
A vulnerability was determined in zevorn rt-claw up to 0.2.0.
A vulnerability was found in zevorn rt-claw up to 0.2.0.
A weakness has been identified in Sipeed PicoClaw up to 0.2.9.
VMware Avi Load Balancer contains a privilege escalation vulnerability.
A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9.
A weakness has been identified in Sipeed PicoClaw up to 0.2.9.
A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9.
A vulnerability was determined in zhayujie CowAgent up to 2.1.1.
A vulnerability has been found in CartoDB carto-api-client 0.5.29.
A vulnerability was found in RobinHerbots Inputmask up to 5.0.9.
A weakness has been identified in itsourcecode Hospital Management System 1.0.
A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.15.0-beta.32.
A weakness has been identified in nextlevelbuilder GoClaw up to 3.13.2.
A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.2.
A vulnerability was determined in nextlevelbuilder GoClaw up to 3.13.3-beta.3.
A vulnerability was found in nextlevelbuilder GoClaw up to 3.13.2.
A vulnerability has been found in AstrBotDevs AstrBot up to 4.25.5.
Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component (reachable to any process on the device via the android.intent.action.SEND intent) and accepts the file to share as a URI…
A stored cross-site scripting (XSS) vulnerability exists in the `POST /api/prompts/share` endpoint of parisneo/lollms (latest version).
A vulnerability has been found in princezuda SafestClaw up to 4.2.4.
A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9.
A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9.
A vulnerability was identified in Sipeed PicoClaw up to 0.2.9.
A vulnerability was found in AstrBotDevs AstrBot up to 4.25.5.
A flaw has been found in LiuMengxuan04 MiniCode 0.1.0.
A vulnerability was detected in halo-dev halo up to 2.24.2.
A vulnerability was identified in nearai ironclaw up to 0.29.1.
The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0.
The Flow Payment plugin for WordPress (flow.cl) version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page.
A security flaw has been discovered in nextlevelbuilder GoClaw up to 3.13.2.
A vulnerability was determined in Sipeed PicoClaw up to 0.2.9.
A flaw has been found in AstrBotDevs AstrBot up to 4.25.5.
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0.
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0.