Published vulnerability pages

Website Security Risk Index — Page 33

Current vulnerabilities, affected platforms, and fix guidance for website owners and developers.

Last week Critical this week

Browse by topic

Security risk categories

46 categories with published guidance

Memory Corruption

409

Browse published Memory Corruption vulnerabilities, affected products, and practical fix guidance.

Authorization Bypass

373

Browse published Authorization Bypass vulnerabilities, affected products, and practical fix guidance.

WordPress

350

Browse published WordPress vulnerabilities, affected products, and practical fix guidance.

Information Disclosure

320

Browse published Information Disclosure vulnerabilities, affected products, and practical fix guidance.

Remote Code Execution

303

Browse published Remote Code Execution vulnerabilities, affected products, and practical fix guidance.

Cross-site Scripting

260

Browse published Cross-site Scripting vulnerabilities, affected products, and practical fix guidance.

Network Security

253

Browse published Network Security vulnerabilities, affected products, and practical fix guidance.

Input Validation

243

Browse published Input Validation vulnerabilities, affected products, and practical fix guidance.

Web Application

239

Browse published Web Application vulnerabilities, affected products, and practical fix guidance.

Windows

216

Browse published Windows vulnerabilities, affected products, and practical fix guidance.

API Security

215

Browse published API Security vulnerabilities, affected products, and practical fix guidance.

Browser

215

Browse published Browser vulnerabilities, affected products, and practical fix guidance.

Denial of Service

215

Browse published Denial of Service vulnerabilities, affected products, and practical fix guidance.

Microsoft

212

Browse published Microsoft vulnerabilities, affected products, and practical fix guidance.

PHP

199

Browse published PHP vulnerabilities, affected products, and practical fix guidance.

Path Traversal

167

Browse published Path Traversal vulnerabilities, affected products, and practical fix guidance.

Authentication Bypass

118

Browse published Authentication Bypass vulnerabilities, affected products, and practical fix guidance.

Arbitrary File Write

116

Browse published Arbitrary File Write vulnerabilities, affected products, and practical fix guidance.

Privilege Escalation

113

Browse published Privilege Escalation vulnerabilities, affected products, and practical fix guidance.

Linux

Browse published Linux vulnerabilities, affected products, and practical fix guidance.

DevOps

Browse published DevOps vulnerabilities, affected products, and practical fix guidance.

SQL Injection

Browse published SQL Injection vulnerabilities, affected products, and practical fix guidance.

Cryptography

Browse published Cryptography vulnerabilities, affected products, and practical fix guidance.

SSRF

Browse published SSRF vulnerabilities, affected products, and practical fix guidance.

Python

Browse published Python vulnerabilities, affected products, and practical fix guidance.

Java

Browse published Java vulnerabilities, affected products, and practical fix guidance.

IDOR

Browse published IDOR vulnerabilities, affected products, and practical fix guidance.

WooCommerce

Browse published WooCommerce vulnerabilities, affected products, and practical fix guidance.

Unsafe Deserialization

Browse published Unsafe Deserialization vulnerabilities, affected products, and practical fix guidance.

File Upload

Browse published File Upload vulnerabilities, affected products, and practical fix guidance.

npm

Browse published npm vulnerabilities, affected products, and practical fix guidance.

Joomla

Browse published Joomla vulnerabilities, affected products, and practical fix guidance.

Supply Chain

Browse published Supply Chain vulnerabilities, affected products, and practical fix guidance.

Cloud Security

Browse published Cloud Security vulnerabilities, affected products, and practical fix guidance.

CSRF

Browse published CSRF vulnerabilities, affected products, and practical fix guidance.

Race Condition

Browse published Race Condition vulnerabilities, affected products, and practical fix guidance.

PDF Editor

Browse published PDF Editor vulnerabilities, affected products, and practical fix guidance.

Industrial Control

Browse published Industrial Control vulnerabilities, affected products, and practical fix guidance.

.NET

Browse published .NET vulnerabilities, affected products, and practical fix guidance.

File Deletion

Browse published File Deletion vulnerabilities, affected products, and practical fix guidance.

Open Redirect

Browse published Open Redirect vulnerabilities, affected products, and practical fix guidance.

Node.js

Browse published Node.js vulnerabilities, affected products, and practical fix guidance.

SAML

Browse published SAML vulnerabilities, affected products, and practical fix guidance.

Virtualization

Browse published Virtualization vulnerabilities, affected products, and practical fix guidance.

Drupal

Browse published Drupal vulnerabilities, affected products, and practical fix guidance.

Unix Domain Sockets

Browse published Unix Domain Sockets vulnerabilities, affected products, and practical fix guidance.

Published security risks

Showing 1153–1188 of 2230 published risks.

highEPSS 0.002

CVE-2026-6688 in FatFs

FatFs R0.16 and earlier contains a downstream-caller vulnerability pattern associated with FatFs long filename handling. With LFN enabled, fno.fname can be up to 255 characters; many callers copy it into short fixed buffers without bounds checks, causing overflow. This maps to CWE-120 (Buffer Copy without Checking Size of Input). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.

CVE-2026-6688supply-chaininput-validationmemory-corruption

Updated Jul 15, 2026

info

CVE-2026-13706 in MediaWiki UrlShortener

Improper input validation vulnerability in Wikimedia Foundation UrlShortener. This vulnerability is associated with program files includes/UrlShortenerUtils.Php.

CVE-2026-13706phpweb-applicationinput-validation

Updated Jul 15, 2026

info

CVE-2026-13707 in MediaWiki OAuth

Session fixation vulnerability in Wikimedia Foundation OAuth. This vulnerability is associated with program files src/Backend/MWOAuthServer.Php. This issue affects OAuth: from * through 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-13707phpweb-applicationauthentication-bypass

Updated Jul 15, 2026

high

CVE-2026-24240 in NVIDIA Megatron Bridge

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

CVE-2026-24240pythonlinuxdevopsremote-code-execution

Updated Jul 15, 2026

high

CVE-2026-24242 in NVIDIA Megatron Bridge

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.

CVE-2026-24242pythonlinuxdevopsinformation-disclosure

Updated Jul 15, 2026

high

CVE-2026-24243 in NVIDIA Megatron Bridge

CVE-2026-24243pythonlinuxdevopsremote-code-execution

Updated Jul 15, 2026

high

CVE-2026-24244 in NVIDIA Megatron Bridge

CVE-2026-24244pythonlinuxdevopsremote-code-execution

Updated Jul 15, 2026

high

CVE-2026-24245 in NVIDIA Megatron Bridge

CVE-2026-24245pythonlinuxdevopsremote-code-execution

Updated Jul 15, 2026

highEPSS 0.002

CVE-2026-24246 in NVIDIA Megatron Bridge

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically managed code resources. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

CVE-2026-24246pythonlinuxdevopsremote-code-execution

Updated Jul 15, 2026

highEPSS 0.002

CVE-2026-24247 in NVIDIA Megatron Bridge

CVE-2026-24247pythonlinuxdevopsremote-code-execution

Updated Jul 15, 2026

highEPSS 0.002

CVE-2026-24248 in NVIDIA Megatron Bridge

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of code generation. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

CVE-2026-24248pythonlinuxdevopsremote-code-execution

Updated Jul 15, 2026

highEPSS 0.002

CVE-2026-24249 in NVIDIA Megatron Bridge

CVE-2026-24249pythonlinuxdevopsremote-code-execution

Updated Jul 15, 2026

highEPSS 0.002

CVE-2026-24250 in NVIDIA Megatron Bridge

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper validation of allowed inputs. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

CVE-2026-24250pythonlinuxdevopsremote-code-execution

Updated Jul 15, 2026

highEPSS 0.002

CVE-2026-24251 in NVIDIA Megatron Bridge

CVE-2026-24251pythonlinuxdevopsremote-code-execution

Updated Jul 15, 2026

highEPSS 0.008

CVE-2026-24264 in NVIDIA Triton Inference Server

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause improper handling of highly compressed data. A successful exploit of this vulnerability might lead to denial of service.

CVE-2026-24264linuxdevopsinput-validationdenial-of-service

Updated Jul 15, 2026

mediumEPSS 0.007

CVE-2026-24266 in NVIDIA Triton Inference Server

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a use-after-free issue. A successful exploit of this vulnerability might lead to denial of service.

CVE-2026-24266linuxdevopsdenial-of-servicememory-corruption

Updated Jul 15, 2026

mediumEPSS 0.004

CVE-2026-58024 in MediaWiki

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiUserrights.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-58024phpapi-securityweb-applicationinformation-disclosure

Updated Jul 15, 2026

mediumEPSS 0.005

CVE-2026-58025 in MediaWiki

Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-58025phpweb-applicationremote-code-executionfile-write

Updated Jul 15, 2026

infoEPSS 0.004

CVE-2026-58026 in MediaWiki

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Parser/Parser.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-58026phpweb-applicationinformation-disclosure

Updated Jul 15, 2026

mediumEPSS 0.004

CVE-2026-58027 in MediaWiki AbuseFilter

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseFilters.Php. This issue affects AbuseFilter: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-58027phpapi-securityweb-applicationinformation-disclosure

Updated Jul 15, 2026

infoEPSS 0.003

CVE-2026-58028 in MediaWiki and CentralAuth

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth. This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php, includes/ResourceLoader/Module.Php, includes/Hooks/Handlers/PageDisplayHookHandler.Php, includes/LogFormatter/PermissionChangeLogFormatter.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9; CentralAuth: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-58028phpapi-securityweb-applicationxss

Updated Jul 15, 2026

mediumEPSS 0.004

CVE-2026-58029 in MediaWiki

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiChangeAuthenticationData.Php, includes/Api/ApiLinkAccount.Php, includes/Api/ApiRemoveAuthenticationData.Php, includes/Specials/SpecialLinkAccounts.Php, includes/Specials/SpecialUnlinkAccounts.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-58029phpapi-securityweb-applicationauthentication-bypass

Updated Jul 15, 2026

mediumEPSS 0.003

CVE-2026-58030 in MediaWiki SyntaxHighlight_GeSHi

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighlight_GeSHi. This vulnerability is associated with program files includes/SyntaxHighlight.Php. This issue affects SyntaxHighlight_GeSHi: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-58030phpweb-applicationxss

Updated Jul 15, 2026

mediumEPSS 0.003

CVE-2026-58032 in MediaWiki

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Api/index.Js. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-58032phpapi-securityweb-applicationxss

Updated Jul 15, 2026

mediumEPSS 0.004

CVE-2026-58033 in MediaWiki

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/InfoAction.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-58033phpweb-applicationinformation-disclosure

Updated Jul 15, 2026

lowEPSS 0.002

CVE-2026-58036 in MediaWiki

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryAllUsers.Php, includes/Api/ApiQueryUsers.Php, includes/Permissions/PermissionManager.Php, includes/User/UserGroupManager.Php.

CVE-2026-58036phpapi-securityweb-applicationinformation-disclosure

Updated Jul 15, 2026

infoEPSS 0.003

CVE-2026-58037 in MediaWiki

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Language/Language.Php, includes/Logging/BlockLogFormatter.Php, includes/Logging/LogFormatter.Php, includes/Logging/PatrolLogFormatter.Php, includes/Logging/RenameuserLogFormatter.Php, includes/Logging/TagLogFormatter.Php, includes/Specials/SpecialVersion.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-58037phpweb-applicationxss

Updated Jul 15, 2026

infoEPSS 0.002

CVE-2026-58038 in MediaWiki Timeline

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files includes/Timeline.Php, scripts/EasyTimeline.Pl. This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-58038phpweb-applicationxss

Updated Jul 15, 2026

criticalEPSS 0.010

CVE-2026-58126 in PACSgear PACS Scan

PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to read and write arbitrary files by exploiting an exposed .NET Remoting TCP service on port 22222 via PGImageExchQueue.exe without any authentication requirement. Attackers can chain the arbitrary file write primitive with DLL hijacking in PGImageExchangeQueueSvc.exe, which loads missing DLLs such as CRYPTSP.DLL from the application directory, to achieve remote code execution as NT Authority\SYSTEM upon service restart.

CVE-2026-58126dotnetwindowsnetwork-securityremote-code-execution

Updated Jul 15, 2026

criticalEPSS 0.010

CVE-2026-58127 in PACSgear MediaWriter

PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs RemoteObj and UIRemoteObj, without any authentication requirement. By exploiting the MarshalByRefObject object unmarshalling technique and implementing .NET WebClient class methods, an unauthenticated remote attacker can read and write arbitrary files on the host filesystem. The ObjectURIs are identical across all installations by default. Chaining the arbitrary file write primitive with DLL hijacking opportunities in the MediaWriter service (which runs as NT Authority\\SYSTEM and loads missing DLLs such as CRYPTBASE.DLL from the application directory) enables unauthenticated remote code execution as SYSTEM upon service restart.

CVE-2026-58127dotnetwindowsnetwork-securityremote-code-execution

Updated Jul 15, 2026

infoEPSS 0.003

CVE-2026-8857 in MediaWiki Timeline

A vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files scripts/EasyTimeline.Pl, includes/Timeline.Php. This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVE-2026-8857phpweb-applicationremote-code-execution

Updated Jul 15, 2026

high

CVE-2026-20213 in ClamAV

A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PE files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains PE content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

CVE-2026-20213network-securitydenial-of-servicememory-corruption

Updated Jul 15, 2026

high

CVE-2026-20214 in ClamAV

A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in FSG files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains portable executable content compressed with FSG to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

CVE-2026-20214network-securitydenial-of-servicememory-corruption

Updated Jul 15, 2026

high

CVE-2026-20215 in ClamAV

A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in 7z files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains 7z content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

CVE-2026-20215network-securitydenial-of-servicememory-corruption

Updated Jul 15, 2026

high

CVE-2026-20216 in ClamAV

A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software.

CVE-2026-20216network-securityinput-validationdenial-of-service

Updated Jul 15, 2026

high

CVE-2026-20217 in ClamAV

A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PESpin files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains PESpin content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

CVE-2026-20217network-securitydenial-of-servicememory-corruption

Updated Jul 15, 2026