CVE Vulnerabilities - 20 July 2026

The JDownloads extension for Joomla websites allows hackers to upload any file without a password. This means they can install malware or take full control of the website. To stay safe, update the JDo...

The DJ-Classifieds Joomla extension has a security flaw that allows anyone to upload files without a password. This means an attacker can potentially take control of the website and execute any malici...

Between May 11 and May 22, 2026, malicious versions of the @beproduct/nestjs-auth package were published on npm. These versions contained code that could steal sensitive information like login tokens,...

A security issue in Network-AI allows malicious commands to be executed if they match a wildcard allowlist. This could allow an attacker to run arbitrary code on a compromised agent. To fix this, ensu...

A vulnerability in FileThingie v2.5.7 allows a hacker to access sensitive information without permission. This is a serious security risk because it could expose confidential data. To protect your dat...

AVideo versions before 29.0 have a security flaw that allows hackers to execute malicious system commands. This could lead to unauthorized access or data theft. Update to version 29.0 or later to fix ...

The ktransformers library, up to version 0.6.3, can be exploited by attackers to execute arbitrary commands on a server. This can happen when a malicious pickle payload is sent to the server, potentia...

GPT-SoVITS, a text-to-image model, is at risk if attackers can inject malicious commands through its web interface. This could allow unauthorized access to the system and potentially lead to data thef...

Versions of xrdp prior to 0.10.6 contain a security flaw that can be exploited by a malicious VNC server to execute unauthorized code on a remote system. This can happen before the user even logs in, ...

Piwigo installers in versions 16.3.0 and earlier are vulnerable to code injection attacks. This means an attacker can inject malicious code into your website by sending special data to the installer. ...

FreeRDP versions 3.27.1 and earlier are vulnerable to a denial of service attack. An attacker can send a specially crafted message to the server, causing it to run out of memory. To protect your syste...

A security patch has been released for the rootio-imagemagick package, which is used to process images on Root systems. This patch fixes a vulnerability that could allow attackers to execute malicious...

Perl's Crypt::Password versions 0 through 0.28 may expose passwords due to the use of a predictable random number generator. This is particularly concerning for password storage and authentication sys...

FreeScout, a free help desk and shared inbox, has a security flaw that allows an attacker to take over the account of the lowest-id user, potentially an administrator, without needing a password. This...

A low-privileged user can gain admin access to dotCMS and potentially execute arbitrary shell commands. This affects dotCMS versions 21.02 through 26.06.22-03 on all platforms. To fix, update to a pat...

The JMedia extension for Joomla allows attackers to inject malicious code into websites through unsanitised SVG uploads. This can happen when a user with administrative access uploads a malicious SVG ...

The JMedia extension in Joomla allows authorized users to upload any type of file, potentially allowing attackers to execute malicious code on the server. This is a serious issue because it can lead t...

The Gridbox extension in Joomla versions before 1.6.0 has a security flaw that could allow an attacker to access the admin area without logging in. This means that sensitive data and settings could be...

The Konnectivity proxy-server in Hypershift does not verify the identity of agents connecting to it. This means an attacker who can reach the proxy could connect without being authenticated, and poten...

A security flaw in LightRAG versions prior to 1.5.4 allows an attacker to access sensitive data and perform actions without authentication. This is fixed in version 1.5.4, so update to the latest vers...

A security issue in LightRAG allows malicious websites to make requests to LightRAG's API on behalf of authenticated users, potentially stealing or deleting sensitive data. This can happen when a user...

Chamilo Learning Management System versions 1.11.38 and earlier have a security flaw in the user registration form. This means an attacker can trick an administrator into running malicious code in the...

Windu CMS versions, including 4.1, are at risk of SQL injection attacks. An attacker can inject malicious SQL code into the URL, potentially stealing sensitive data or disrupting the website. Update t...

RT's issue and ticket tracking system has a security flaw that allows a non-admin user to steal admin passwords and use them to access sensitive data. This happens when a user requests a specific type...

A security issue in the Pillow HEIF library can cause a program to crash or leak sensitive information when processing large images. This issue affects versions of the library before 1.3.0. To fix the...