Published vulnerability pages

Website Security Risk Index — Page 16

Current vulnerabilities, affected platforms, and fix guidance for website owners and developers.

Last week Critical this week

Browse by topic

Security risk categories

46 categories with published guidance

Memory Corruption

409

Browse published Memory Corruption vulnerabilities, affected products, and practical fix guidance.

Authorization Bypass

373

Browse published Authorization Bypass vulnerabilities, affected products, and practical fix guidance.

WordPress

350

Browse published WordPress vulnerabilities, affected products, and practical fix guidance.

Information Disclosure

320

Browse published Information Disclosure vulnerabilities, affected products, and practical fix guidance.

Remote Code Execution

303

Browse published Remote Code Execution vulnerabilities, affected products, and practical fix guidance.

Cross-site Scripting

260

Browse published Cross-site Scripting vulnerabilities, affected products, and practical fix guidance.

Network Security

253

Browse published Network Security vulnerabilities, affected products, and practical fix guidance.

Input Validation

243

Browse published Input Validation vulnerabilities, affected products, and practical fix guidance.

Web Application

239

Browse published Web Application vulnerabilities, affected products, and practical fix guidance.

Windows

216

Browse published Windows vulnerabilities, affected products, and practical fix guidance.

API Security

215

Browse published API Security vulnerabilities, affected products, and practical fix guidance.

Browser

215

Browse published Browser vulnerabilities, affected products, and practical fix guidance.

Denial of Service

215

Browse published Denial of Service vulnerabilities, affected products, and practical fix guidance.

Microsoft

212

Browse published Microsoft vulnerabilities, affected products, and practical fix guidance.

PHP

199

Browse published PHP vulnerabilities, affected products, and practical fix guidance.

Path Traversal

167

Browse published Path Traversal vulnerabilities, affected products, and practical fix guidance.

Authentication Bypass

118

Browse published Authentication Bypass vulnerabilities, affected products, and practical fix guidance.

Arbitrary File Write

116

Browse published Arbitrary File Write vulnerabilities, affected products, and practical fix guidance.

Privilege Escalation

113

Browse published Privilege Escalation vulnerabilities, affected products, and practical fix guidance.

Linux

Browse published Linux vulnerabilities, affected products, and practical fix guidance.

DevOps

Browse published DevOps vulnerabilities, affected products, and practical fix guidance.

SQL Injection

Browse published SQL Injection vulnerabilities, affected products, and practical fix guidance.

Cryptography

Browse published Cryptography vulnerabilities, affected products, and practical fix guidance.

SSRF

Browse published SSRF vulnerabilities, affected products, and practical fix guidance.

Python

Browse published Python vulnerabilities, affected products, and practical fix guidance.

Java

Browse published Java vulnerabilities, affected products, and practical fix guidance.

IDOR

Browse published IDOR vulnerabilities, affected products, and practical fix guidance.

WooCommerce

Browse published WooCommerce vulnerabilities, affected products, and practical fix guidance.

Unsafe Deserialization

Browse published Unsafe Deserialization vulnerabilities, affected products, and practical fix guidance.

File Upload

Browse published File Upload vulnerabilities, affected products, and practical fix guidance.

npm

Browse published npm vulnerabilities, affected products, and practical fix guidance.

Joomla

Browse published Joomla vulnerabilities, affected products, and practical fix guidance.

Supply Chain

Browse published Supply Chain vulnerabilities, affected products, and practical fix guidance.

Cloud Security

Browse published Cloud Security vulnerabilities, affected products, and practical fix guidance.

CSRF

Browse published CSRF vulnerabilities, affected products, and practical fix guidance.

Race Condition

Browse published Race Condition vulnerabilities, affected products, and practical fix guidance.

PDF Editor

Browse published PDF Editor vulnerabilities, affected products, and practical fix guidance.

Industrial Control

Browse published Industrial Control vulnerabilities, affected products, and practical fix guidance.

.NET

Browse published .NET vulnerabilities, affected products, and practical fix guidance.

File Deletion

Browse published File Deletion vulnerabilities, affected products, and practical fix guidance.

Open Redirect

Browse published Open Redirect vulnerabilities, affected products, and practical fix guidance.

Node.js

Browse published Node.js vulnerabilities, affected products, and practical fix guidance.

SAML

Browse published SAML vulnerabilities, affected products, and practical fix guidance.

Virtualization

Browse published Virtualization vulnerabilities, affected products, and practical fix guidance.

Drupal

Browse published Drupal vulnerabilities, affected products, and practical fix guidance.

Unix Domain Sockets

Browse published Unix Domain Sockets vulnerabilities, affected products, and practical fix guidance.

Published security risks

Showing 541–576 of 2230 published risks.

mediumEPSS 0.001

CVE-2026-56454 dfxanalytics vulnerability

HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1. These legacy protocols contain numerous cryptographic design flaws that expose data to interception and decryption. To remediate this risk, the application must disable all support for TLS 1.0 and TLS 1.1, and exclusively enable support for secure protocols, specifically TLS 1.2 and TLS 1.3.

CVE-2026-56454cryptography

Updated Jul 18, 2026

mediumEPSS 0.003

CVE-2026-56455 dfxanalytics vulnerability

HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS). The application fails to properly validate input sizes, allowing an attacker to pass an excessive amount of information into a memory container, which can cause the system to crash or become unresponsive. To mitigate this flaw, comprehensive input length checks must be implemented and enforced on both the client and server sides.

CVE-2026-56455denial-of-servicememory-corruption

Updated Jul 18, 2026

mediumEPSS 0.002

CVE-2026-56456 dfxanalytics vulnerability

HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding its internal file structure and directory paths through unhandled error messages, system logs, or debugging output, which could allow a remote attacker to map the underlying server environment and identify targets for further exploitation.

CVE-2026-56456information-disclosure

Updated Jul 18, 2026

mediumEPSS 0.010

CVE-2026-44595 yamcs vulnerability

Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one with low or no privileges, could enumerate all user accounts in the system including their usernames, superuser status, and group memberships. This issue is fixed in versions 5.12.7 and 5.13.0.

CVE-2026-44595javaapi-securityauthorization-bypass

Updated Jul 18, 2026

mediumEPSS 0.018

CVE-2026-44596 yamcs vulnerability

Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling, so an unauthenticated remote attacker could perform unlimited password-guessing attempts against any user account, significantly increasing the risk of successful brute-force attacks. This issue is fixed in versions 5.12.7 and 5.13.0.

CVE-2026-44596java

Updated Jul 18, 2026

criticalEPSS 0.009

CVE-2026-44632 yamcs vulnerability

Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs algorithm evaluation engine org.yamcs.algorithms.JavaExprAlgorithmExecutionFactory, which dynamically compiled and evaluated user-controlled algorithm text through the Janino compiler without enforcing a secure sandbox, so an authenticated user with the ChangeMissionDatabase privilege could override an existing algorithm's text via the mission database REST API and inject Java code (for example using java.lang.Runtime) to achieve remote code execution on the underlying host operating system. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.

CVE-2026-44632javaapi-securityremote-code-execution

Updated Jul 18, 2026

criticalCISA KEVEPSS 0.361

Fortinet FortiSandbox OS Command Injection Vulnerability

Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.

CVE-2026-25089remote-code-execution

Updated Jul 18, 2026

criticalCISA KEVEPSS 0.842

Fortinet FortiSandbox OS Command Injection Vulnerability

Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.

CVE-2026-39808remote-code-execution

Updated Jul 18, 2026

highEPSS 0.003

CVE-2026-60114 sustainable irrigation platform vulnerability

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to the restore functionality to write files to arbitrary locations by uploading crafted JSON backup files with unvalidated keys used to construct file paths. Attackers can exploit the lack of key validation in the JSON restore process, combined with the absence of a required passphrase in the default configuration or the default passphrase 'opendoor', to write arbitrary JSON files outside the intended data directory.

CVE-2026-60114path-traversal

Updated Jul 17, 2026

medium

CVE-2026-33842 windows 10 1607 vulnerability

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.

CVE-2026-33842windowsinformation-disclosure

Updated Jul 17, 2026

medium

CVE-2026-34328 windows 10 1809 vulnerability

Exposure of sensitive information to an unauthorized actor in Windows Audio Service allows an authorized attacker to disclose information locally.

CVE-2026-34328windowsinformation-disclosure

Updated Jul 17, 2026

medium

CVE-2026-34346 windows 10 1607 vulnerability

Cleartext transmission of sensitive information in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally.

CVE-2026-34346windowsinformation-disclosure

Updated Jul 17, 2026

medium

CVE-2026-34348 windows 10 1809 vulnerability

Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network.

CVE-2026-34348windows

Updated Jul 17, 2026

medium

CVE-2026-34349 windows 10 1809 vulnerability

Exposure of sensitive information to an unauthorized actor in Windows Media allows an authorized attacker to disclose information locally.

CVE-2026-34349windowsinformation-disclosure

Updated Jul 17, 2026

high

CVE-2026-40378 windows 10 1607 vulnerability

Memory allocation with excessive size value in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.

CVE-2026-40378windows

Updated Jul 17, 2026

highEPSS 0.006

CVE-2026-40400 windows 10 1607 vulnerability

Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network.

CVE-2026-40400windowspath-traversal

Updated Jul 17, 2026

mediumEPSS 0.003

CVE-2026-40422 windows 10 1607 vulnerability

Use of uninitialized resource in Windows File Explorer allows an authorized attacker to disclose information locally.

CVE-2026-40422windows

Updated Jul 17, 2026

mediumEPSS 0.004

CVE-2026-41087 windows 10 1607 vulnerability

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.

CVE-2026-41087windowsinformation-disclosure

Updated Jul 17, 2026

highEPSS 0.004

CVE-2026-42900 windows 10 1607 vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Store allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-42900windowsmemory-corruptionrace-condition

Updated Jul 17, 2026

highEPSS 0.004

CVE-2026-42975 windows 10 1607 vulnerability

Heap-based buffer overflow in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network.

CVE-2026-42975windowsmemory-corruption

Updated Jul 17, 2026

highEPSS 0.003

CVE-2026-42982 windows 10 1607 vulnerability

Improper validation of consistency within input in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.

CVE-2026-42982linuxwindows

Updated Jul 17, 2026

criticalEPSS 0.007

CVE-2026-42990 windows 10 1607 vulnerability

Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network.

CVE-2026-42990windowsmemory-corruption

Updated Jul 17, 2026

highEPSS 0.002

CVE-2026-44800 windows 11 23h2 vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

CVE-2026-44800windowsmemory-corruptionrace-condition

Updated Jul 17, 2026

mediumEPSS 0.008

CVE-2026-44806 windows 10 1607 vulnerability

Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network.

CVE-2026-44806windowsdenial-of-service

Updated Jul 17, 2026

mediumEPSS 0.005

CVE-2026-45496 visual studio code vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

CVE-2026-45496microsoftpath-traversal

Updated Jul 17, 2026

highEPSS 0.008

CVE-2026-45646 asp.net core odata vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVE-2026-45646dotnetdenial-of-service

Updated Jul 17, 2026

mediumEPSS 0.006

CVE-2026-47282 visual studio code vulnerability

Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

CVE-2026-47282microsoftinformation-disclosure

Updated Jul 17, 2026

highEPSS 0.006

CVE-2026-47296 sql server 2016 vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.

CVE-2026-47296sql-injection

Updated Jul 17, 2026

highEPSS 0.003

CVE-2026-47632 azure connected machine agent vulnerability

Improper certificate validation in Azure Monitor Agent allows an unauthorized attacker to elevate privileges over an adjacent network.

CVE-2026-47632cryptography

Updated Jul 17, 2026

criticalEPSS 0.008

CVE-2026-48561 365 copilot vulnerability

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to execute code over a network.

CVE-2026-48561microsoftremote-code-execution

Updated Jul 17, 2026

highEPSS 0.008

CVE-2026-48564 windows 10 1607 vulnerability

Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.

CVE-2026-48564windowsmemory-corruption

Updated Jul 17, 2026

highEPSS 0.002

CVE-2026-48571 windows 11 23h2 vulnerability

Use after free in Windows App Installer allows an authorized attacker to elevate privileges locally.

CVE-2026-48571windowsmemory-corruption

Updated Jul 17, 2026

highEPSS 0.002

CVE-2026-48572 windows 11 23h2 vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Installer allows an authorized attacker to elevate privileges locally.

CVE-2026-48572windowsmemory-corruptionrace-condition

Updated Jul 17, 2026

highEPSS 0.002