GHSA-25XW-CF43-5CCV vulnerabilities

Vulnerabilities for packages: chromium...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 6, 2026 to July 12, 2026)

Last week, there were 311 vulnerabilities disclosed in 254 WordPress Plugins and 8 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 167 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

CVE-2026-62355

creationtimestamp| type| source ---|---|--- 2026-07-15 21:00:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpmjafzh62u...

CVE-2026-35152

A SQL Injection vulnerability exists in Apache Fineract's Report Execution API runreports endpoint in versions up to and including 1.14.0. Report parameter values are incorporated into the generated SQL query without sufficient validation, allowing an authenticated user with permission to run...

CVE-2026-35152 Apache Fineract: SQL injection in runreports endpoint

A SQL Injection vulnerability exists in Apache Fineract's Report Execution API runreports endpoint in versions up to and including 1.14.0. Report parameter values are incorporated into the generated SQL query without sufficient validation, allowing an authenticated user with permission to run...

CVE-2026-35152 Apache Fineract: SQL injection in runreports endpoint

A SQL Injection vulnerability exists in Apache Fineract's Report Execution API runreports endpoint in versions up to and including 1.14.0. Report parameter values are incorporated into the generated SQL query without sufficient validation, allowing an authenticated user with permission to run...

EUVD-2026-44604

A SQL Injection vulnerability exists in Apache Fineract's Report Execution API runreports endpoint in versions up to and including 1.14.0. Report parameter values are incorporated into the generated SQL query without sufficient validation, allowing an authenticated user with permission to run...

PT-2026-58893

Name of the Vulnerable Software and Affected Versions Apache Fineract versions prior to 1.14.1 Description An issue exists in the Report Execution API 'runreports' endpoint where report parameter values are incorporated into the generated SQL query without sufficient validation. This allows an...

PT-2026-60341

Name of the Vulnerable Software and Affected Versions Autel MaxiCharger AC Elite Home affected versions not specified Description An issue exists in the handling of software updates due to the improper verification of cryptographic signatures. This allows a physically present attacker to execute...

CVE-2026-15751

CVE-2026-15751 affects the mastergo-design mastergo-magic-mcp component set up to version 0.2.0. The vulnerability targets the execute function in mastergo/component-workflow.md for mcp__getComponentGenerator, where manipulation of the rootPath argument enables path traversal. Exploitation is loc...

CVE-2026-15751 mastergo-design mastergo-magic-mcp mcp__getComponentGenerator component-workflow.md execute path traversal

A security vulnerability has been detected in mastergo-design mastergo-magic-mcp up to 0.2.0. The affected element is the function execute of the file mastergo/component-workflow.md of the component mcpgetComponentGenerator. The manipulation of the argument rootPath leads to path traversal. An...

JLSEC-2026-689 In the OpenSSL compatibility layer implementation, the function `RAND_poll()` was not behaving as...

In the OpenSSL compatibility layer implementation, the function RANDpoll was not behaving as expected and leading to the potential for predictable values returned from RANDbytes after fork is called. This can lead to weak or predictable random numbers generated in applications that are both using...

CVE-2026-50690

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:42+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:04:49+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:24+00:00| seen|...

CVE-2026-55048

creationtimestamp| type| source ---|---|--- 2026-07-14 19:00:58+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0237 2026-07-14 22:03:00+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:00:51+00:00| seen|...

CVE-2026-45262

creationtimestamp| type| source ---|---|--- 2026-07-14 18:35:12+00:00| published-proof-of-concept| https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-5qmh-x653-g8qj 2026-07-14 20:08:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmz3x5vth2z...

CVE-2026-58647 Microsoft PowerBI Report Server Spoofing Vulnerability

...

CVE-2026-52840

Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, Caldav::connecttoserver at application/controllers/Caldav.php:60 hands the request's caldavurl to a Guzzle REPORT call without scheme or host validation. A logged-in backend user admin, provider, or secretary...

GHSA-9MC4-RQMQ-H467 vulnerabilities

Vulnerabilities for packages: python...

Microsoft PowerBI Report Server Spoofing Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Power BI allows an authorized attacker to perform spoofing over a network...

CVE-2026-15625

creationtimestamp| type| source ---|---|--- 2026-07-14 06:12:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqlkfme2yr2x 2026-07-19 20:36:51+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqzmzxf6552i...