Application Security Detections Published in July 2026
In July, Qualys Web Application Scanning released QIDs targeting vulnerabilities in several widely used software products and frameworks, including:
Adobe ColdFusion, Adobe Experience Manager, Apache Airflow, Apache Camel, Apache Tomcat, Craft CMS, Drupal, Flowise, JetBrains TeamCity, JetBrains YouTrack, Joomla!, LiteLLM, Microsoft SharePoint, N8n, Netscaler, Nginx, Ollama, Oracle WebLogic Server, PHP, React Router, SAP, Sitecore, SolarWinds Serv-U, Traefik, WordPress, Zohocorp
Details about the following QIDs can be found in our knowledge base. Please review reports of the scanned applications for these detections and, if any are identified, follow the steps provided in the knowledge base to ensure applications are protected against the reported vulnerabilities. Immediate resolution of these vulnerabilities as soon as they are detected should be a priority for all organizations. If not addressed, these vulnerabilities can pose security risks, such as breaches, unauthorized access, and various malicious activities.
The following table lists the QIDs released in July 2026.
| QID | Title |
|---|---|
| 151104 | React Router Arbitrary Client-side Constructor Injection Vulnerability (CVE-2026-53666) |
| 151105 | React Router Improper Protocol Validation Vulnerability (CVE-2026-53667) |
| 151106 | React Router Open Redirect Vulnerability (CVE-2026-53668) |
| 151107 | React Router Open Redirect Vulnerability (CVE-2026-53669) |
| 151108 | React Router Denial of Service (DoS) Vulnerability (CVE-2026-55685) |
| 520205 | PHP Heap-based Buffer Overflow Vulnerability (CVE-2026-14355) |
| 520206 | Nginx Heap Buffer Overflow Vulnerability (CVE-2026-42533) |
| 520207 | Nginx Use After Free Vulnerability (CVE-2026-56434) |
| 520208 | Nginx Use of Uninitialized Resource Vulnerability (CVE-2026-60005) |
| 520209 | Nginx Use After Free Vulnerability (CVE-2026-42530) |
| 520210 | Nginx Buffer Overflow Vulnerability (CVE-2026-42055) |
| 520211 | Nginx Buffer Over-Read Vulnerability (CVE-2026-48142) |
| 520212 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability (CVE-2026-28302) |
| 520213 | SolarWinds Serv-U Remote Code Execution (RCE) Vulnerability (CVE-2026-28304) |
| 520214 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability (CVE-2026-28305) |
| 520215 | SolarWinds Serv-U Domain Administrator Privilege Escalation Vulnerability (CVE-2026-28306) |
| 520216 | SolarWinds Serv-U Domain User Privilege Escalation Vulnerability (CVE-2026-28307) |
| 520217 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability (CVE-2026-28308) |
| 520218 | SolarWinds Serv-U Broken Access Control Vulnerability (CVE-2026-28309) |
| 520219 | SolarWinds Serv-U Domain Administrator Privilege Escalation Vulnerability (CVE-2026-28310) |
| 520220 | SolarWinds Serv-U Privilege Escalation Vulnerability (CVE-2026-28312) |
| 520221 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability (CVE-2026-28313) |
| 520222 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability (CVE-2026-28314) |
| 520223 | SolarWinds Serv-U Stored Cross-Site Scripting (XSS) Vulnerability (CVE-2026-28315) |
| 520224 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability (CVE-2026-28316) |
| 520225 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability (CVE-2026-28317) |
| 520226 | SolarWinds Serv-U Broken Access Control Vulnerability (CVE-2026-28321) |
| 531622 | JetBrains YouTrack Improper Access Control Vulnerability (CVE-2026-57921) |
| 531623 | JetBrains YouTrack Project Settings Disclosure via MCP Vulnerability (CVE-2026-57922) |
| 531624 | JetBrains YouTrack Improper Authorization Vulnerability (CVE-2026-57923) |
| 531625 | JetBrains YouTrack Sensitive Configuration Exposed Vulnerability (CVE-2026-57924) |
| 531626 | JetBrains YouTrack Improper Access Control Vulnerability (CVE-2026-57925) |
| 531627 | JetBrains YouTrack Prototype Pollution Vulnerability (CVE-2026-57926) |
| 531633 | FlowiseAI Information Disclosure Vulnerability (CVE-2026-56268) |
| 531634 | FlowiseAI Unverified email change Vulnerability (CVE-2025-71337) |
| 531635 | FlowiseAI OS Command Injection Vulnerability (CVE-2026-56274) |
| 531636 | FlowiseAI Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-56275) |
| 531637 | FlowiseAI SQL Injection (SQLi) Vulnerability (CVE-2025-71332) |
| 531638 | FlowiseAI Weak Default Secret in Environment Variable Vulnerability (CVE-2026-56269) |
| 531639 | FlowiseAI Missing Authentication Vulnerability (CVE-2026-56270) |
| 531640 | FlowiseAI Weak Password Hashing Algorithm Vulnerability (CVE-2026-56272) |
| 531641 | FlowiseAI Path Traversal Vulnerability (CVE-2025-71324) |
| 531642 | FlowiseAI Authentication Bypass Vulnerability (CVE-2025-71327) |
| 531643 | FlowiseAI Unverified Password Change Vulnerability (CVE-2025-71328) |
| 531644 | FlowiseAI Unauthenticated File Upload Vulnerability (CVE-2025-71333) |
| 531645 | FlowiseAI Path Traversal Vulnerability (CVE-2025-71334) |
| 531646 | FlowiseAI Session Fixation (Authentication Bypass) Vulnerability (CVE-2025-71335) |
| 531647 | FlowiseAI Unsandboxed Remote Code Execution (RCE) Vulnerability (CVE-2025-71336) |
| 531648 | Flowise Custom MCP Environment Variable Denylist Bypass Vulnerability (CVE-2026-58057) |
| 531649 | N8n SQL Injection Vulnerability (CVE-2026-56351) |
| 531650 | N8n SQL Injection Vulnerability (CVE-2026-44792) |
| 531651 | N8n Prototype Pollution Vulnerability (CVE-2026-44791) |
| 531652 | N8n Arbitrary File Read Vulnerability (CVE-2026-44790) |
| 531653 | WordPress Schema and Structured Data for WP Plugin: Arbitrary File Upload Vulnerability (CVE-2026-9067) |
| 531654 | WordPress Contact Form Entries Plugin: Arbitrary File Deletion Vulnerability (CVE-2026-9843) |
| 531655 | WordPress Branda Plugin: Privilege Escalation Vulnerability (CVE-2026-11551) |
| 531656 | WordPress WP Photo Album Plus Plugin: SQL Injection Vulnerability (CVE-2026-6379) |
| 531657 | WordPress FastDup Plugin: Path Traversal Vulnerability (CVE-2026-52703) |
| 531658 | WordPress WP Review Slider Pro Plugin: Multiple Security Vulnerabilities (CVE-2026-8442,CVE-2026-8443,CVE-2026-8444) |
| 531659 | WordPress WCMultiShipping Plugin: SQL Injection Vulnerability (CVE-2026-52700) |
| 531660 | N8n Prototype Pollution Vulnerability (CVE-2026-44789) |
| 531661 | N8n Authorization Bypass Vulnerability (CVE-2026-45732) |
| 531662 | N8n Python Sandbox Escape Vulnerability (CVE-2026-49444) |
| 531663 | N8n Incorrect Authorization Vulnerability (CVE-2026-54307) |
| 531664 | Apache Tomcat Improper Neutralization of Script-Related HTML Tags (Basic XSS) Vulnerability (CVE-2026-50229) |
| 531665 | Apache Tomcat Always-Incorrect Control Flow Implementation Vulnerability (CVE-2026-53404) |
| 531666 | Apache Tomcat Detection of Error Condition Without Action Vulnerability (CVE-2026-53434) |
| 531667 | Apache Tomcat Always-Incorrect Control Flow Implementation Vulnerability (CVE-2026-55276) |
| 531668 | Apache Tomcat Improper Authentication Vulnerability (CVE-2026-55955) |
| 531669 | Apache Tomcat Improper Authorization Vulnerability (CVE-2026-55956) |
| 531670 | Apache Tomcat Authentication Bypass Vulnerability (CVE-2026-55957) |
| 531671 | WordPress FaustWP Plugin: Authentication Bypass Vulnerability (CVE-2026-49062) |
| 531672 | WordPress Taskbuilder Plugin: SQL Injection Vulnerability (CVE-2026-52697) |
| 531673 | WordPress Hippoo Mobile App Plugin: Missing Authorization Vulnerability (CVE-2026-49065) |
| 531674 | WordPress Directorist Booking Plugin: SQL Injection Vulnerability (CVE-2026-49073) |
| 531675 | WordPress BookPro Plugin: Arbitrary File Deletion Vulnerability (CVE-2026-27400) |
| 531680 | WordPress Widget Options Plugin: Remote Code Execution (RCE) Vulnerability (CVE-2026-54823) |
| 531681 | WordPress GeoDirectory Plugin: SQL Injection Vulnerability (CVE-2026-54831) |
| 531682 | WordPress ProfileGrid Plugin: Privilege Escalation Vulnerability (CVE-2026-12073) |
| 531683 | WordPress Image Optimizer Plugin: Arbitrary File Deletion Vulnerability (CVE-2026-5821) |
| 531684 | WordPress Ultimate Member Plugin: Account Takeover Vulnerability (CVE-2026-7761) |
| 531685 | WordPress Ninja Forms Plugin: Missing Authorization Vulnerability (CVE-2026-1239) |
| 531686 | WordPress Everest Forms Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-57312) |
| 531687 | WordPress WpDataTables (Premium) Plugin: SQL Injection Vulnerability (CVE-2026-49080) |
| 531688 | WordPress WpDataTables (Premium) Plugin: SQL Injection Vulnerability (CVE-2026-54825) |
| 531689 | WordPress AdRotate Banner Manager Plugin: PHP Code Injection Vulnerability (CVE-2026-12242) |
| 531690 | WordPress RegistrationMagic Plugin: Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2026-12158) |
| 531691 | WordPress MainWP Child Plugin: Unauthorized Access Vulnerability (CVE-2026-27366) |
| 531692 | WordPress Gallery by BestWebSoft Plugin: SQL Injection Vulnerability (CVE-2026-57642) |
| 531693 | WordPress WpForo Forum Plugin: SQL Injection Vulnerability (CVE-2026-57636) |
| 531694 | WordPress LatePoint Plugin: Privilege Escalation Vulnerability (CVE-2026-13228) |
| 531695 | WordPress Custom Field Template Plugin: SQL Injection Vulnerability (CVE-2026-57687) |
| 531696 | WordPress WP Post Author Plugin: SQL Injection Vulnerability (CVE-2026-57643) |
| 531697 | Sitecore Remote Code Execution Vulnerability (CVE-2023-35813) |
| 531698 | WordPress Uncanny Automator Plugin: PHP Object Injection Vulnerability (CVE-2026-56031) |
| 531699 | WordPress WC Vendors Plugin: SQL Injection Vulnerability (CVE-2026-54838) |
| 531700 | WordPress WP Job Portal Plugin: SQL Injection Vulnerability (CVE-2026-57653) |
| 531701 | WordPress EventPrime Plugin: PHP Object Injection Vulnerability (CVE-2026-56053) |
| 531702 | WordPress TemplateSpare Plugin: Arbitrary File Upload Vulnerability (CVE-2026-57658) |
| 531703 | WordPress Contest Gallery Plugin: SQL Injection Vulnerability (CVE-2026-57662) |
| 531704 | WordPress Advance Product Search Plugin: SQL Injection Vulnerability (CVE-2026-56070) |
| 531705 | WordPress Groundhogg Plugin: SQL Injection Vulnerability (CVE-2026-57667) |
| 531706 | Microsoft SharePoint Insecure Deserialization Vulnerability (CVE-2026-45659) |
| 531707 | NetScaler Application Delivery Controller (ADC) and NetScaler Gateway Insufficient Input Validation Vulnerabilities (CVE-2026-8451,CVE-2026-10817) |
| 531708 | Adobe ColdFusion Unrestricted File Upload Vulnerability (CVE-2026-48276) |
| 531709 | Adobe ColdFusion Improper Input Validation Vulnerability (CVE-2026-48277) |
| 531710 | Adobe ColdFusion Improper Input Validation Vulnerability (CVE-2026-48281) |
| 531711 | Adobe ColdFusion Path Traversal Vulnerability (CVE-2026-48282) |
| 531712 | Adobe ColdFusion Unrestricted File Upload Vulnerability (CVE-2026-48283) |
| 531713 | Adobe ColdFusion Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-48285) |
| 531714 | Adobe ColdFusion Reflected Cross-Site Scripting (XSS) Vulnerability (CVE-2026-48307) |
| 531715 | Adobe ColdFusion Path Traversal Vulnerability (CVE-2026-48313) |
| 531716 | Adobe ColdFusion Path Traversal Vulnerability (CVE-2026-48314) |
| 531717 | Adobe ColdFusion Improper Input Validation Vulnerability (CVE-2026-48315) |
| 531718 | Adobe ColdFusion Improper Input Validation Vulnerability (CVE-2026-48316) |
| 531720 | NetScaler Application Delivery Controller (ADC) and NetScaler Gateway Memory Overflow Vulnerabilities (CVE-2026-8452,CVE-2026-8655) |
| 531721 | NetScaler Application Delivery Controller (ADC) and NetScaler Gateway Arbitrary File Read Vulnerability (CVE-2026-10816) |
| 531722 | NetScaler Application Delivery Controller (ADC) and NetScaler Gateway Denial of Service Vulnerability (CVE-2026-13474) |
| 531723 | Apache Airflow Improper Deserialization Vulnerability (CVE-2026-33264) |
| 531724 | Apache Airflow Information Disclosure Vulnerability (CVE-2026-48828) |
| 531725 | Apache Airflow Dependency Graph Information Leak Vulnerability (CVE-2026-48891) |
| 531726 | Apache Airflow Config API Sensitive Data Exposure Vulnerability (CVE-2026-48892) |
| 531727 | Apache Airflow Improper Authorization Vulnerability (CVE-2026-49296) |
| 531728 | Apache Airflow Information Disclosure Vulnerability (CVE-2026-49487) |
| 531729 | WordPress SMS Alert Plugin: Privilege Escalation Vulnerability (CVE-2026-11387) |
| 531730 | WordPress Zip Recipes Plugin: SQL Injection Vulnerability (CVE-2026-57663) |
| 531731 | WordPress Export User Data Plugin: PHP Object Injection Vulnerability (CVE-2026-12240) |
| 531732 | WordPress Frontend File Manager Plugin: Arbitrary File Deletion Vulnerability (CVE-2026-8095) |
| 531733 | WordPress YMC Filter Plugin: SQL Injection Vulnerability (CVE-2026-54836) |
| 531734 | WordPress Tourfic Plugin: SQL Injection Vulnerability (CVE-2026-56064) |
| 531735 | Traefik HTTPRoute backendRef Filter Cross-Route Leakage Vulnerability (CVE-2026-54765) |
| 531736 | Traefik Auth Middleware Underscore Header Spoofing Vulnerability (CVE-2026-54763) |
| 531737 | Traefik Ingress NGINX Auth-Secret Fail-Open Vulnerability (CVE-2026-54762) |
| 531738 | Traefik crossProviderNamespaces Allowlist Bypass Vulnerability (CVE-2026-54761) |
| 531739 | Apache Camel Argument Injection Vulnerability (CVE-2026-40047) |
| 531740 | Apache Camel Deserialization of Untrusted Data Vulnerability (CVE-2026-40859) |
| 531741 | Apache Camel Deserialization of Untrusted Data Vulnerability (CVE-2026-42527) |
| 531742 | Apache Camel Deserialization of Untrusted Data Vulnerability (CVE-2026-43865) |
| 531743 | Apache Camel Deserialization of Untrusted Data Vulnerability (CVE-2026-43866) |
| 531744 | Apache Camel Deserialization of Untrusted Data Vulnerability (CVE-2026-43867) |
| 531745 | Apache Camel Authorization Bypass Vulnerability (CVE-2026-46453) |
| 531746 | Apache Camel Authentication Bypass Vulnerability (CVE-2026-46454) |
| 531747 | Apache Camel Insufficient Session Expiration Vulnerability (CVE-2026-46455) |
| 531748 | Apache Camel Improper Input Validation Vulnerability (CVE-2026-46456) |
| 531749 | Apache Camel Improper Input Validation Vulnerability (CVE-2026-46457) |
| 531750 | Apache Camel Information Disclosure Vulnerability (CVE-2026-46584) |
| 531751 | Apache Camel Authorization Bypass Vulnerability (CVE-2026-46585) |
| 531752 | Apache Camel Deserialization of Untrusted Data Vulnerability (CVE-2026-46590) |
| 531753 | Apache Camel Injection Vulnerability (CVE-2026-46591) |
| 531754 | Apache Camel Improper Input Validation Vulnerability (CVE-2026-46592) |
| 531755 | Apache Camel SSRF Vulnerability (CVE-2026-46726) |
| 531756 | Apache Camel SSRF Vulnerability (CVE-2026-48203) |
| 531757 | Apache Camel Authentication Bypass Vulnerability (CVE-2026-48204) |
| 531758 | Apache Camel SSRF Vulnerability (CVE-2026-48205) |
| 531759 | Apache Camel Authorization Bypass Vulnerability (CVE-2026-48206) |
| 531760 | Apache Camel Improper Input Validation Vulnerability (CVE-2026-49086) |
| 531761 | Apache Camel Improper Input Validation Vulnerability (CVE-2026-49097) |
| 531762 | Apache Camel Improper Input Validation Vulnerability (CVE-2026-49098) |
| 531763 | Apache Camel Injection Vulnerability (CVE-2026-49099) |
| 531764 | Apache Camel Information Disclosure Vulnerability (CVE-2026-49365) |
| 531765 | Apache Camel Authentication Bypass Vulnerability (CVE-2026-53913) |
| 531766 | Apache Camel SSRF Vulnerability (CVE-2026-55993) |
| 531767 | Apache Camel SSRF Vulnerability (CVE-2026-55994) |
| 531768 | Apache Camel Information Disclosure Vulnerability (CVE-2026-56139) |
| 531769 | Apache Camel Improper Input Validation Vulnerability (CVE-2026-56140) |
| 531770 | Apache Camel Improper Input Validation Vulnerability (CVE-2026-46587) |
| 531771 | Apache Camel Improper Input Validation Vulnerability (CVE-2026-46588) |
| 531773 | WordPress Restaurant Menu and Food Ordering Plugin: SQL Injection Vulnerability (CVE-2026-57644) |
| 531774 | WordPress WooCommerce Payment Plugin: SQL Injection Vulnerability (CVE-2026-56036) |
| 531775 | WordPress Child Theme Wizard Plugin: Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2026-57655) |
| 531776 | WordPress WC Shop Sync Plugin: Information Exposure Vulnerability (CVE-2026-54848) |
| 531777 | WordPress MDTF Plugin: SQL Injection Vulnerability (CVE-2026-54843) |
| 531778 | WordPress MDTF Plugin: Local File Inclusion Vulnerability (CVE-2026-54845) |
| 531779 | WordPress Quotes Llama Plugin: SQL Injection Vulnerability (CVE-2026-56062) |
| 531780 | WordPress Block for Mailchimp Plugin: Missing Authorization Vulnerability (CVE-2026-56063) |
| 531781 | WordPress SALESmanago and Leadoo Plugin: SQL Injection Vulnerability (CVE-2026-54822) |
| 531782 | WordPress Royal MCP Plugin: Missing Authorization Vulnerability (CVE-2026-54842) |
| 531783 | WordPress Premmerce Wishlist for WooCommerce Plugin: SQL Injection Vulnerability (CVE-2026-54849) |
| 531784 | Craft CMS Remote Code Execution (RCE) Vulnerability (CVE-2026-56382) |
| 531785 | Craft CMS Path Traversal Vulnerability (CVE-2026-56394) |
| 531786 | Craft CMS Mass-Assignment Vulnerability (CVE-2026-50281) |
| 531787 | Craft CMS Authorization Bypass Vulnerability (CVE-2026-50282) |
| 531788 | WordPress Newsletters Plugin: Missing Authorization Vulnerabilities (CVE-2026-57645,CVE-2026-54840) |
| 531789 | JetBrains YouTrack CSS Injection Vulnerability (CVE-2026-59791) |
| 531790 | JetBrains YouTrack Cross-Site Scripting (XSS) Vulnerability (CVE-2026-61492) |
| 531791 | JetBrains TeamCity Arbitrary File Access Vulnerability (CVE-2026-59793) |
| 531792 | JetBrains TeamCity Cross-Site Scripting Vulnerability (CVE-2026-59794) |
| 531793 | JetBrains TeamCity Cross-Site Scripting Vulnerability (CVE-2026-59795) |
| 531794 | JetBrains TeamCity Improper Authorization Vulnerability (CVE-2026-59796) |
| 531795 | LiteLLM Local File Read Vulnerability (CVE-2026-59819) |
| 531796 | LiteLLM Arbitrary File Write Vulnerability (CVE-2026-59820) |
| 531797 | LiteLLM Arbitrary Code Execution Vulnerability (CVE-2026-59821) |
| 531798 | LiteLLM Authentication Bypass Vulnerability (CVE-2026-59822) |
| 531799 | N8n Sensitive Information Disclosure Vulnerability (CVE-2026-59209) |
| 531800 | N8n Improper Authentication Vulnerability (CVE-2026-59208) |
| 531801 | N8n Allowed HTTP Request Domains Restriction Bypass Vulnerability (CVE-2026-59207) |
| 531802 | N8n Prototype Pollution Vulnerability (CVE-2026-59206) |
| 531803 | Apache Tomcat URL Encoding Bypass (Hex Encoding) Vulnerability (CVE-2026-59083) |
| 531804 | Apache Tomcat Insufficient Documentation Vulnerability (CVE-2026-59084) |
| 531805 | WordPress OMGF Pro Plugin: Arbitrary File Upload Vulnerability (CVE-2026-57700) |
| 531806 | WordPress EventON Plugin: SQL Injection Vulnerability (CVE-2026-9711) |
| 531807 | WordPress Quform Plugin: Arbitrary File Upload Vulnerability (CVE-2026-56058) |
| 531808 | WordPress Uncanny Automator Pro Plugin: PHP Object Injection Vulnerability (CVE-2026-56057) |
| 531809 | Microsoft SharePoint Insecure Deserialization Vulnerability (CVE-2026-50522) |
| 531810 | Microsoft SharePoint External Control of File Name or Path Vulnerability (CVE-2026-54108) |
| 531811 | Microsoft SharePoint Insecure Deserialization Vulnerability (CVE-2026-58644) |
| 531812 | Microsoft SharePoint Missing Authentication Vulnerability (CVE-2026-56164) |
| 531813 | Microsoft SharePoint Cross-Site Scripting Vulnerabilities |
| 531814 | Microsoft SharePoint Weak Authentication Vulnerability (CVE-2026-55040) |
| 531815 | Microsoft SharePoint Server-Side Request Forgery Vulnerability (CVE-2026-55051) |
| 531816 | Microsoft SharePoint Missing Authorization Vulnerability (CVE-2026-55052) |
| 531817 | Microsoft SharePoint Improper Access Control Vulnerability (CVE-2026-56157) |
| 531818 | Microsoft SharePoint Improper Authorization Vulnerability (CVE-2026-58277) |
| 531826 | JetBrains YouTrack Authentication Bypass Vulnerability (CVE-2026-62422) |
| 531827 | WordPress JetBooking Plugin: SQL Injection Vulnerability (CVE-2026-54820) |
| 531828 | WordPress JetEngine Plugin: SQL Injection Vulnerability (CVE-2026-56068) |
| 531829 | WordPress JetSmartFilters Plugin: SQL Injection Vulnerability (CVE-2026-56067) |
| 531830 | WordPress Dokan Pro Plugin: Privilege Escalation Vulnerability (CVE-2026-12224) |
| 531831 | WordPress Eagle Booking Plugin: Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2025-68052) |
| 531832 | WordPress Fusion Builder Plugin: Privilege Escalation Vulnerability (CVE-2026-56008) |
| 531833 | WordPress Abandoned Cart Pro for WooCommerce Plugin: Privilege Escalation Vulnerability (CVE-2026-56010) |
| 531834 | SAP NetWeaver Application Server ABAP Memory Corruption Vulnerability (CVE-2026-44747) |
| 531835 | WordPress Essential Addons for Elementor Plugin: Email Header Injection Vulnerability (CVE-2026-15155) |
| 531836 | WordPress Events Manager Plugin: PHP Object Injection Vulnerability (CVE-2026-57713) |
| 531837 | WordPress Kirki Plugin: Multiple Security Vulnerabilities (CVE-2026-57724,CVE-2026-57726) |
| 531838 | WordPress WP Ultimate CSV Importer Plugin: Remote Code Execution (RCE) Vulnerability (CVE-2026-13353) |
| 531839 | WordPress MiniOrange Social Login and Register Plugin: Authentication Bypass Vulnerability (CVE-2026-12761) |
| 531840 | WordPress Amelia Plugin: SQL Injection Vulnerability (CVE-2026-57702) |
| 531841 | WordPress LatePoint Plugin: SQL Injection Vulnerability (CVE-2026-57714) |
| 531842 | WordPress Directorist Plugin: PHP Object Injection Vulnerability (CVE-2026-59518) |
| 531843 | WordPress WPFunnels Plugin: Remote Code Execution (RCE) Vulnerability (CVE-2026-14345) |
| 531844 | Adobe ColdFusion Uncontrolled Search Path Element Vulnerability (CVE-2026-48363) |
| 531845 | Adobe ColdFusion Uncontrolled Search Path Element Vulnerability (CVE-2026-48364) |
| 531846 | Adobe ColdFusion Improper Input Validation Remote Code Execution (RCE) Vulnerability (CVE-2026-48284) |
| 531847 | Adobe ColdFusion Path Traversal Vulnerability (CVE-2026-48318) |
| 531848 | Adobe ColdFusion Path Traversal leading to Remote Code Execution (RCE) Vulnerability (CVE-2026-48319) |
| 531849 | Adobe ColdFusion Reflected Cross-Site Scripting (XSS) Vulnerability (CVE-2026-48320) |
| 531850 | Adobe ColdFusion Incorrect Authorization Privilege Escalation Vulnerability (CVE-2026-48321) |
| 531851 | Adobe ColdFusion Code Injection Vulnerability (CVE-2026-48322) |
| 531852 | Adobe ColdFusion SQL Injection (SQLi) Vulnerability (CVE-2026-48324) |
| 531853 | Adobe ColdFusion Missing Authentication Remote Code Execution (RCE) Vulnerability (CVE-2026-48325) |
| 531854 | Adobe ColdFusion Incorrect Authorization Remote Code Execution (RCE) Vulnerability (CVE-2026-48327) |
| 531855 | Adobe ColdFusion Input Validation Security Feature Bypass Vulnerability (CVE-2026-48328) |
| 531856 | Adobe ColdFusion Insufficient Session Expiration Vulnerability (CVE-2026-48329) |
| 531857 | Adobe ColdFusion Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-48332) |
| 531858 | Adobe ColdFusion Path Traversal Vulnerability (CVE-2026-48338) |
| 531859 | WordPress MiniOrange Social Login and Register Plugin: Authentication Bypass Vulnerability (CVE-2023-2982) |
| 531860 | Joomla! Core Multiple Security Vulnerabilities (CVE-2026-48948,CVE-2026-48954) |
| 531861 | Joomla! Core Improper Access Control Vulnerabilities (CVE-2026-48957,CVE-2026-48958,CVE-2026-48956) |
| 531862 | Joomla! Core Improper Access Control Vulnerability (CVE-2026-48955) |
| 531863 | Joomla! Core Cross-Site Scripting (XSS) Vulnerability (CVE-2026-48949) |
| 531864 | Joomla! Core Multiple Cross-Site Scripting (XSS) Vulnerabilities |
| 531865 | Joomla! Core Improper Access Control Vulnerability (CVE-2026-48947) |
| 531866 | Drupal Core Multiple Security Vulnerabilities |
| 531867 | WordPress Core REST API Route Confusion Vulnerability (CVE-2026-63030) |
| 531868 | WordPress UsersWP Plugin: Arbitrary File Deletion Vulnerability (CVE-2026-13492) |
| 531869 | WordPress WCFM Membership Plugin: Insecure Direct Object Reference Vulnerability (CVE-2026-3688) |
| 531870 | WordPress Divi Torque Lite Plugin: Cross-Site Request Forgery Vulnerability (CVE-2026-4275) |
| 531871 | WordPress Salon Booking System Plugin: Cross-Site Request Forgery Vulnerability (CVE-2026-15070) |
| 531872 | WordPress WPJAM Basic Plugin: PHP Object Injection Vulnerability (CVE-2026-57371) |
| 531873 | WordPress WHMCS Bridge Plugin: Arbitrary File Upload Vulnerability (CVE-2026-14489) |
| 531874 | WordPress Podlove Podcast Publisher Plugin: Arbitrary File Upload Vulnerability (CVE-2026-13001) |
| 531875 | WordPress MiniOrange OTP Verification Plugin: Authentication Bypass Vulnerability (CVE-2026-14245) |
| 531876 | WordPress GEO My WP Plugin: SQL Injection Vulnerability (CVE-2026-15300) |
| 531877 | WordPress W3 Total Cache Plugin: Directory Traversal Vulnerability (CVE-2026-9282) |
| 531878 | WordPress Popup Maker Plugin: Missing Authorization Vulnerability (CVE-2026-8848) |
| 531879 | WordPress Forminator Forms Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-57814) |
| 531880 | WordPress Accelerated Mobile Pages Plugin: Arbitrary File Write Vulnerability (CVE-2026-6101) |
| 531881 | WordPress Unlimited Elements For Elementor Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-57718) |
| 531882 | WordPress Kirki Plugin: Missing Authorization Vulnerability (CVE-2026-57727) |
| 531883 | Zohocorp ManageEngine ADSelfService Plus Authentication Bypass Vulnerability (CVE-2026-3183) |
| 531884 | WordPress Kirki Plugin: Cross-Site Scripting Vulnerability (CVE-2026-57725) |
| 531885 | WordPress Ultimate Member Plugin: SQL Injection Vulnerability (CVE-2026-15290) |
| 531886 | WordPress Event Tickets and Registration Plugin: Missing Authorization Vulnerability (CVE-2026-57705) |
| 531887 | WordPress SureForms Plugin: Stripe Payment Amount Manipulation Vulnerability (CVE-2026-15288) |
| 531888 | WordPress SureCart Plugin: Privilege Escalation Vulnerability (CVE-2026-7655) |
| 531889 | WordPress AcyMailing Plugin: Multiple Security Vulnerabilities (CVE-2026-57739,CVE-2026-57741) |
| 531890 | WordPress DoLogin Security Plugin: Authentication Bypass Vulnerability (CVE-2026-14495) |
| 531891 | WordPress Duoshuo Plugin: Privilege Escalation Vulnerability (CVE-2026-14482) |
| 531892 | WordPress GD Rating System Plugin: SQL Injection Vulnerability (CVE-2026-57771) |
| 531893 | WordPress WP Inventory Manager Plugin: SQL Injection Vulnerability (CVE-2026-57772) |
| 531894 | WordPress WC Shop Sync Plugin: SQL Injection Vulnerability (CVE-2026-57810) |
| 531895 | WordPress Simple JWT Login Plugin: Authentication Bypass Vulnerability (CVE-2026-14262) |
| 531896 | WordPress Vitepos Lite Plugin: SQL Injection Vulnerability (CVE-2026-57385) |
| 531897 | WordPress WP Business Intelligence Lite Plugin: Missing Authorization Vulnerability (CVE-2026-15293) |
| 531898 | WordPress AI Copilot Plugin: SQL Injection Vulnerability (CVE-2026-59515) |
| 531899 | Adobe Experience Manager Detected |
| 531900 | Adobe Experience Manager XML External Entity (XXE) Vulnerability (CVE-2026-48359) |
| 531901 | Adobe Experience Manager Server-Side Request Forgery Vulnerability (CVE-2026-48259) |
| 531902 | Adobe Experience Manager Missing Authentication Vulnerability (CVE-2026-48252) |
| 531903 | Adobe Experience Manager Path Traversal Vulnerability (CVE-2026-48310) |
| 531904 | Adobe Experience Manager Cross-Site Scripting Vulnerabilities |
| 531905 | Ollama Uncontrolled Memory Allocation Vulnerability (CVE-2026-65315) |
| 531906 | WordPress WPify Woo Plugin: Privilege Escalation Vulnerability (CVE-2026-12736) |
| 531907 | WordPress Ninja Forms Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-65048) |
| 531908 | WordPress Ninja Forms Plugin: Multiple Security Vulnerabilities (CVE-2026-65049,CVE-2026-65052) |
| 531909 | WordPress Bookly Plugin: Multiple Security Vulnerabilities (CVE-2026-61949,CVE-2026-61944) |
| 531910 | WordPress Loco Translate Plugin: Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2026-15005) |
| 531911 | WordPress ProfilePress Plugin: Arbitrary File Upload Vulnerability (CVE-2026-13352) |
| 531912 | WordPress Uncanny Automator Plugin: Arbitrary File Deletion Vulnerability (CVE-2026-15008) |
| 531913 | WordPress Kali Forms Plugin: Cross-Site Scripting (XSS) Vulnerability (CVE-2026-15395) |
| 531914 | WordPress SAML Single Sign On Plugin: Authentication Bypass Vulnerability (CVE-2026-15981) |
| 531915 | WordPress SAML Single Sign On Plugin: Authentication Bypass Vulnerability (CVE-2026-15013) |
| 531916 | WordPress Core SQL Injection Vulnerability (CVE-2026-60137) |
| 531917 | Oracle WebLogic Server Multiple Vulnerabilities (CPU-JUL2026) |
| 531918 | WordPress WPFunnels Plugin: Privilege Escalation Vulnerability (CVE-2026-15103) |
| 531919 | WordPress WPO365 Login Plugin: Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2026-15212) |
| 531920 | WordPress WPDM Premium Packages Plugin: Multiple Security Vulnerabilities (CVE-2026-61948,CVE-2026-61943) |
| 531921 | WordPress Easy Form Builder Plugin: Privilege Escalation Vulnerability (CVE-2026-13439) |
| 531922 | WordPress WP Ticket Plugin: Code Injection Vulnerability (CVE-2026-15011) |
| 531923 | WordPress MDJM Event Management Plugin: Privilege Escalation Vulnerability (CVE-2026-15017) |
| 531924 | WordPress Easy Appointments Plugin: Missing Authorization Vulnerability (CVE-2026-8789) |
| 531934 | WordPress WPForms Pro Plugin: Arbitrary File Upload Vulnerability (CVE-2026-10818) |
| 531935 | WordPress Aimogen Pro Plugin: Privilege Escalation Vulnerability (CVE-2026-15982) |
| 531936 | WordPress Bricksforge Plugin: Privilege Escalation Vulnerability (CVE-2026-14956) |
| 531937 | WordPress BuddyBoss Platform Plugin: SQL Injection Vulnerability (CVE-2026-59514) |
| 531953 | JetBrains TeamCity Code Execution Vulnerability (CVE-2026-65906) |
| 531954 | JetBrains TeamCity Remote Code Execution Vulnerability (CVE-2026-65907) |
| 531955 | JetBrains TeamCity Remote Code Execution Vulnerability (CVE-2026-63077) |
Qualys Notification: Application Security Detections Published in July 2026