WordPress is a content management system paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system, referred to within WordPress as Themes.

WordPress

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

CVE-2026-63030

Linux

Linux Kernel

Windows

Windows Cumulative Update

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

CVE-2026-60137

SonicWall SMA 8200v Appliance is a secure remote access solution that provides employees and partners with policy-enforced access to critical network resources. It offers SSL VPN connectivity for both managed and unmanaged devices, supporting a wide range of operating systems and browsers.

SonicWall SMA 8200v Appliance

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.

CVE-2026-15409

NixOS is a Linux distribution built on top of the Nix package manager. It is completely declarative, its system configurations are reproducible, makes configuration changes reliable and atomic, and eliminates configuration drift.

NixOS

Chainguard is a Linux distribution based on Alpine. It's the commercial version of the Wolfi distro.

Chainguard

LiteLLM is an open-source library that provides a unified interface for various large language models (LLMs). It allows developers to easily switch between different LLM providers like OpenAI, Anthropic, and others without changing their code. LiteLLM simplifies the process of working with multiple LLMs by offering a consistent API across different models and providers.

LiteLLM

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.

CVE-2026-59822

BeyondTrust Privileged Remote Access is a secure remote access solution that enables IT administrators and security professionals to control, audit, and manage privileged access to critical systems by authorized employees and third-party vendors. It minimizes security risks associated with remote access by implementing granular role-based access controls and providing real-time monitoring, logging, and auditing capabilities. The solution integrates with various IT systems and supports multi-factor authentication, ensuring that only authorized users can access resources.

BeyondTrust Privileged Remote Access Client

BeyondTrust Remote Support is a secure remote access solution that enables IT support teams to provide assistance to users and manage devices across multiple platforms. It offers robust security features, including granular access control and session monitoring, to ensure compliance with industry standards. The platform is designed for efficient troubleshooting and enhanced customer support experiences.

BeyondTrust Remote Support Client

BeyondTrust Privileged Remote Access

BeyondTrust Remote Support

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.

CVE-2026-40139

Debian GNU/Linux is a Linux distribution composed of free and open-source software.

Linux Debian

Echo is a secure, minimal Linux OS built vulnerability-free. It is fully compatible across environments and continuously patched - making it a clean, dependable base layer for modern applications. Echo is used by organizations focused on security and reliability, including those with compliance or FIPS requirements.

Echo

The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and the Mersenne Twister internal state is approximately 19,937 bits, so an attacker who observes approximately 334 session IDs (for example via the X-Urwid-ID HTTP response header) can fully reconstruct the internal state and predict all past and future session IDs (Path B). The same identifier is also used as the filename of a FIFO created in the world-listable /tmp directory (for example /tmp/urwid375487765176907690.in), so any local user on the host can list /tmp to enumerate active session tokens directly (Path A). With a valid session ID, an attacker can read the victim's terminal screen via the polling endpoint, inject keystrokes into the victim's session (yielding OS-level code execution with the session owner's privileges if the session runs a shell), and inject exit sequences or flood the FIFO to terminate or crash the session. A prior Bandit S311 warning on this usage was suppressed with # noqa: S311 rather than fixed

CVE-2026-9323

Debian

Debian Security Tracker

Ubuntu is a Linux distribution based on Debian, mostly composed of free and open-source software. Ubuntu is officially released in three editions: Desktop, Server, and Core for internet of things devices and robots. All the editions can run on the computer alone or in a virtual machine.

Linux Ubuntu

Uncontrolled Resource Consumption vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 9.0.0 through 9.1.13, from 10.0.0 through 10.1.2.

Users are recommended to upgrade to version 9.1.14 or 10.1.3, which fixes the issue.

CVE-2026-59173

Ubuntu

Ubuntu Security Tracker

The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the storeInfo function. This makes it possible for unauthenticated attackers to modify the plugin's Zoho CRM integration settings, replacing the configured data center, client ID, client secret, and user email credentials with attacker-controlled values via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVE-2026-9734

Authentication bypass using an alternate path or channel in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network.

CVE-2026-57980

Class based , object oriented programming language. Designed to have less dependencies as possible. The syntex of Java is smilier to C and C++. Commonly used for client-server applications. Java files are compiled by JVM (Java Virtual Machine)

Java

JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.

Identifiant CVE	Sévérité	Score	Technologies	Nom du composant	Exploit CISA KEV	A corrigé	Date de publication
CVE-2026-63030	CRITICAL	9.8	WordPress	cpe:2.3:a:wordpress:wordpress	Non	Oui	Jul 17, 2026
CVE-2026-60137	MEDIUM	5.9	WordPress	cpe:2.3:a:wordpress:wordpress	Non	Oui	Jul 17, 2026
CVE-2026-15409	CRITICAL	10	SonicWall SMA 8200v Appliance	cpe:2.3:a:sonicwall:sma8200v	Oui	Non	Jul 14, 2026
CVE-2026-59822	HIGH	8.8	NixOS	cpe:2.3:a:litellm:litellm	Non	Oui	Jul 08, 2026
CVE-2026-40139	CRITICAL	9.2	BeyondTrust Privileged Remote Access Client	cpe:2.3:a:beyondtrust:remote_support	Non	Oui	Jul 06, 2026

Identifiant CVE	Sévérité	Score	Technologies	Nom du composant	Exploit CISA KEV	A corrigé	Date de publication
CVE-2026-9323	CRITICAL	9.2	Linux Debian	urwid	Non	Non	Jul 18, 2026
CVE-2026-59173	NONE	N/A	Linux Debian	trafficserver	Non	Non	Jul 18, 2026
CVE-2026-9734	MEDIUM	4.3	WordPress	w3sc-elementor-to-zoho	Non	Non	Jul 18, 2026
CVE-2026-57980	MEDIUM	5.4	N/A	N/A	Non	Oui	Jul 17, 2026
CVE-2026-56741	HIGH	7.5	Java	jline3	Non	Oui	Jul 17, 2026

Base de données de vulnérabilités Wiz

Explorer par technologie

Filtres populaires

Profil élevé

Dernier

Les vulnérabilités en chiffres

Le bon, le mauvais et le vulnérable

Ressources Wiz supplémentaires

PEACH

Prêt(e) à voir Wiz en action ?